blakcsee_stealer | hxxps://sellietuskar[.]com/2cldm1bbhgao/EasyBCD-Platform-Tool[.]github[.]io

Analysis

user interaction
yes
max time kernel
120s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sellietuskar.com/2cldm1bbhgao/EasyBCD-Platform-Tool.github.io
Sample260719-243bpse18j

Score

10^/10

discovery blakcsee_stealer persistence ransomware stealer

Malware Config

Extracted

Family

blakcsee_stealer

37.77.150.162

Signatures

Family: BlakcSeeStealer
BlakcSeeStealer is a Windows stealer written in C++.
stealer blakcsee_stealer

Executes dropped EXE 1 IoCs

pid	Process
3124	EasyBCD-Platform-Tool-8.51.5.exe

Loads dropped DLL 2 IoCs

pid	Process
3124	EasyBCD-Platform-Tool-8.51.5.exe
3124	EasyBCD-Platform-Tool-8.51.5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3124 set thread context of 4300	3124	EasyBCD-Platform-Tool-8.51.5.exe	113

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2940	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289761652069019"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{BA4A2592-414B-46E8-B470-62D24FCDB3EB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3936	mspaint.exe
3936	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4156	7zG.exe
Token: 35	4156	7zG.exe
Token: SeSecurityPrivilege	4156	7zG.exe
Token: SeSecurityPrivilege	4156	7zG.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4156	7zG.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3936	mspaint.exe
3936	mspaint.exe
3936	mspaint.exe
3936	mspaint.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4584	4888	msedge.exe	89
PID 4888 wrote to memory of 2940	4888	msedge.exe	91
PID 4888 wrote to memory of 4872	4888	msedge.exe	92
PID 4888 wrote to memory of 4872	4888	msedge.exe	92
PID 4888 wrote to memory of 4872	4888	msedge.exe	92
PID 4888 wrote to memory of 3332	4888	msedge.exe	93
PID 4888 wrote to memory of 3332	4888	msedge.exe	93
PID 4888 wrote to memory of 4472	4888	msedge.exe	94
PID 4888 wrote to memory of 900	4888	msedge.exe	95
PID 4888 wrote to memory of 4472	4888	msedge.exe	94
PID 4888 wrote to memory of 4472	4888	msedge.exe	94
PID 4888 wrote to memory of 900	4888	msedge.exe	95
PID 4888 wrote to memory of 900	4888	msedge.exe	95
PID 4888 wrote to memory of 5244	4888	msedge.exe	96
PID 4888 wrote to memory of 2576	4888	msedge.exe	97
PID 4888 wrote to memory of 5244	4888	msedge.exe	96
PID 4888 wrote to memory of 5244	4888	msedge.exe	96
PID 4888 wrote to memory of 2576	4888	msedge.exe	97
PID 4888 wrote to memory of 2576	4888	msedge.exe	97
PID 4888 wrote to memory of 2836	4888	msedge.exe	99
PID 4888 wrote to memory of 4376	4888	msedge.exe	100
PID 4888 wrote to memory of 2836	4888	msedge.exe	99
PID 4888 wrote to memory of 4376	4888	msedge.exe	100
PID 4888 wrote to memory of 2968	4888	msedge.exe	102
PID 4888 wrote to memory of 4864	4888	msedge.exe	101
PID 4888 wrote to memory of 2968	4888	msedge.exe	102
PID 4888 wrote to memory of 2968	4888	msedge.exe	102
PID 4888 wrote to memory of 4864	4888	msedge.exe	101
PID 4888 wrote to memory of 1472	4888	msedge.exe	103
PID 4888 wrote to memory of 4356	4888	msedge.exe	106
PID 3124 wrote to memory of 4300	3124	EasyBCD-Platform-Tool-8.51.5.exe	113
PID 3124 wrote to memory of 4300	3124	EasyBCD-Platform-Tool-8.51.5.exe	113
PID 3124 wrote to memory of 4300	3124	EasyBCD-Platform-Tool-8.51.5.exe	113
PID 3124 wrote to memory of 4300	3124	EasyBCD-Platform-Tool-8.51.5.exe	113
PID 3124 wrote to memory of 4300	3124	EasyBCD-Platform-Tool-8.51.5.exe	113
PID 3124 wrote to memory of 4300	3124	EasyBCD-Platform-Tool-8.51.5.exe	113
PID 3124 wrote to memory of 4300	3124	EasyBCD-Platform-Tool-8.51.5.exe	113
PID 3124 wrote to memory of 4300	3124	EasyBCD-Platform-Tool-8.51.5.exe	113
PID 4888 wrote to memory of 1884	4888	msedge.exe	115
PID 4888 wrote to memory of 1768	4888	msedge.exe	116
PID 4888 wrote to memory of 1536	4888	msedge.exe	117
PID 4888 wrote to memory of 4784	4888	msedge.exe	124
PID 4888 wrote to memory of 4784	4888	msedge.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sellietuskar.com/2cldm1bbhgao/EasyBCD-Platform-Tool.github.io
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffe41a7c188,0x7ffe41a7c194,0x7ffe41a7c1a0
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,9294048987415588846,13275974691416562145,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,3003332971728809692,16089025998783797701,262144 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,14189292556622756576,3709812169448852146,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,17566824709210111685,13406421638024518807,2097152 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,8280737227598576115,4715992892144584793,2097152 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,12881409088990958335,11279253465044456304,2097152 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,10542559558255161552,15949137834445138676,2097152 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,15383337357181017355,11960952915508790630,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,13509152084248805124,8834350819274964188,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,7013248367673058467,3250213324180401368,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6108,i,14168307402868916072,11351515089416482401,2097152 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,18408491516007230875,16488395038622454766,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,13367305358408169226,3596091866996231125,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,13367305358408169226,3596091866996231125,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,7264140029366754433,2536770372129287607,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,2120121923304125786,3546503175551433280,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=1368 /prefetch:14
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,10090068060975707304,5918786667178027498,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:14
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,3576085657634786624,5753308029664713764,524288 --field-trial-handle=2796,i,16163588768266734933,586561614482218295,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2224

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\EasyBCD-Platform-Tool-8.51.5\" -spe -an -ai#7zMap20972:118:7zEvent2589
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4156

C:\Users\Admin\Downloads\EasyBCD-Platform-Tool-8.51.5\EasyBCD-Platform-Tool-8.51.5.exe
"C:\Users\Admin\Downloads\EasyBCD-Platform-Tool-8.51.5\EasyBCD-Platform-Tool-8.51.5.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:4300

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\EasyBCD-Platform-Tool-8.51.5\k-icon.png"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 49b7785ece2d86a70ca297353f1bcd81eba52680a21a9a70ac76d0630c7186e4
MD5 27075978bb79e134860cdacefd2cba13
SHA1 b523683c54d7ef3b145aba5dab9a78ac80c3970d
SHA512 9cc4eb9e114951cd1a9594eb65108303b2a0b7c333bff9237f17438a117ea1fa45086cd022d5cc52d064e3ead67c2ef25de58b24dfdc5aac2d7f671b56a59c87
TLSH
T1885165830771DBC0C7BA867923EDA79E3BF0E4A9414B1E10A06E6DBC0D86F4B58D0153
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59afce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59afce.TMP
Size 2KB
SHA256 6f95aeb0377dc2399df43baee7115f8435d72e4a1979a4efcad8c7a3bc10db91
MD5 0a9ed8ba44b4d74da8d49f83dd44dc75
SHA1 bfcc00d431c2d587bc98afefa5975c161e89a16e
SHA512 f34489d3708acd7938ad4b0bba775eddf9d49453f34794fe830a43a371359b6f7b8ba98d8f697933548d01d258533a60f59370cf145b08343c123b75ad98b0c1
TLSH
T1385176930771DBC0C7BA867923EDA79E3BF0E4A9414B1E10A06E6DBC1D46F4B58D0153
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6d11c53857c97f840ec2024e98998ece920337730729767f0b39ca8228c05c24
MD5 b561cc4bced8084c66864c1f8d96f133
SHA1 d157586c89dd69178eea28b139323ca04b3efce0
SHA512 44f65b3fcd9c6a5ccbc3f411d946917497ab4a659c812a71475f73cf3498426b91b644f0e955bf7d8287739093c29d5a649b359ac946412ba3d58e2de429fdb3
TLSH
T11951C0F7C3E5866D891146F0AB187E2BCE1C0914432C3C5AC9E4AF5BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 51886753daa6e0eacbe0890cc89482852c1479b249c4749e478c8b47d179b3be
MD5 7bdcf94341ca42af4b43623e90476f37
SHA1 d8ea3e707019ec825a53e4bce2b936605227d063
SHA512 977684728a4d09e7e4c65316d364a4f3ac186cb4b0470129a3cbba3b248392ffc62f0d24856b051ba2e71c29a7e6f802261d60a992a46dae67d9c64c8eb87213
SSDEEP 192:sxReRxOn/fkshysKrjDjzoA8p3g/g6+WNtLp/YEAiKCGZIgDNJ:sxReCn/fkshysPQ/5r/9K7
TLSH
T15242D8166928993B9CC7E21DBB657F53E6F9513261D02E48A7FC870C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eabdeea413a178b5acb9fbc9f433c48e709369022794a3ba638c5e91775261f9
MD5 cf97c35356c383e775edd36dd4ee1efe
SHA1 418faa735644c4bbb47b573318e10fbb7b29b52d
SHA512 0fddf45b1979e013a6be9f8860a93b7a8bb66d1ec32f1018feb0b7674b77e9522435717644c075dd87a5e9e20a29073a1c497ad2a15638b80c0ba197f92da277
SSDEEP 192:sxRhRxOn/fksDyWKrjDjzoA8p3g/g6+WNtLp/YEAiKCGZIgQJ:sxRhCn/fksDyWPQ/5r/FK0
TLSH
T17A32C7166928993B4CC7D25DBB25BF53E6F95132A1D02E48A7FC860C05EAADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8b7cef84e5e4a6bae2eaa06854ff7361043b37926c2f056d984db7e1d4f2df8b
MD5 c05f805a9a470442653cda74e938b6f2
SHA1 b1b80762a14c3b46d3d9987000b7da9a18349e9d
SHA512 d095eb7ff1c95d758a8962d8f108d87f44611b474d7aba597371b73ae3426499b9c4c688ae5cf44cd63ad2fb4f1bfdf20a9aeace1742a80e6b2583f5f159dd4e
SSDEEP 192:sxReRxOn/fkshyWKrjDjzoA8p3g/g6+WNtLp/YExiKCGZIgD7J:sxReCn/fkshyWPQ/5r/IKR
TLSH
T12342D8166928993B4CC7D21DBA657F93E6FD513261D02E48A7FC870C05EBADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 f4488f5e4fc9ddd477c76128bfcb3b0a76842c6254ebfd728eb409e33dadca19
MD5 5235f5a9bb3c3831e0400457129c3362
SHA1 edab2147117afac3ba59b15a45070dbac71ea5a8
SHA512 abfa88bd2ec4f05d99986c1af97b5d421486f888d8fc98e6969ff49573aa9d74d39915c1cc8f5a48c831f55dd10241b950ff7917168db0c9d65f71e8ff17b667
SSDEEP 384:0OhQi3gfCtgHZFfeQKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwY9VHRAsroZCG:0UQi3aWgH7feQ8F1+UoAYDCx9Tuqh0V7
TLSH
T1F7B2FB2B600DCB7E5F801AADEC296FD76D9802C796588D4047FE994C03C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

9956500f-0b94-483a-96af-98efef117af7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9956500f-0b94-483a-96af-98efef117af7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 26c4a34322a658233b126ca0bd272b27b955303177feb271f0641823551321f7
MD5 a8d67648a10502702ef608183c471392
SHA1 313e7acb5f7686227d0eec9c91cb72810d77460b
SHA512 86c0ee2a720fd2a6f8cca41ffa441053600d5607099b6be9a538e43e5b2427d1260e63e34a02165a4ed73818d0d0a56a7175f67294a4e81de124c12650ef8a76
SSDEEP 768:yrv+4UNbdf39a7qG8QDaZtxRK48dHeByERRFzjK3Y41:ybsbJ39aGGjaZtW48dHSyw/G1
TLSH
T18C03CF71A8685EB34CF7D289B6477617BFF4410385C42668D2DD6F4D818A4DD130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0666a19eff3e6374125a6da27536bb4a14c14d220ae372959d913496036573bb
MD5 90e39bf9a0b007a337939e9305be4b83
SHA1 49a2324ee9e610c343876c981c254c5acd0c4be8
SHA512 96534e1f0b07d9af9c3ae39849d5a032ed69f199b66716e4f625f44629a193140cb4a4968447d56416f611c18840e05361c10d1b9f3d12f41a1cf5aeb7f9eab0
SSDEEP 768:Bj+9y3ga7qGEQDaZtxJK48dHeByERRFzjK3Y4b9Mw:c9y3gaGGbaZtG48dHSyw/Gb+w
TLSH
T1AAF2BE7468655EB34CA7C29A76573B5BFFF0421782C82A58D6DCAF0E42C75AC4307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c06dae461cd50ed8b5851afe7d3928c787295e8f6acac2380dff97a4b7f6b7d1
MD5 1ebf989821a90b8763fd8810e648c2c9
SHA1 8af57c7419a1e34de801e483919b1e1f0702e9e4
SHA512 71f664dce4d1599b10dba1009cdbb3d360edd7b623ae22c94757aaebe9feef16644884df12117b172f517d66d39aff98e7362245b5219c04fa54aa95f34c76ca
SSDEEP 768:Lj+9l30a7qGUQDaZtxJK48dHeByERRFzjK3Y4b9Mw:e9l30aGGLaZtG48dHSyw/Gb+w
TLSH
T15BF2BE7468655EB34CA7C29A76473B5BBEF0421782C82A58D6DCAF0E42C75EC4307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 78117a658de2fa0572f5baa726af0089e6d9a12f7756b99c8991a74818f9f930
MD5 59cb1908611e85cd9e31bbcaac3130e9
SHA1 249b3cce517ea78a77ff19bf23ff0e8a1fc72f13
SHA512 523cc33b30fd52f34026ecffb7fb9a22bc92272a5aff4a247f191583d4eadd493a9cd9f09717deb96841ccfce6aecfb2b5c3afd4042b0a342f500798cd6d4ee1
SSDEEP 768:HFjj+973Ywgia7qGEQDaZtxdK48dHeByERRFzjK3Y4b9Mw:s973paGGbaZte48dHSyw/Gb+w
TLSH
T1A503AE725C948EB79CA7878AB65B3657EEF04257C5C46A64E3CCAE0D41871DC4307C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 089f8cf475ebd63be80d35d3918395b76f70ab0eb816af24a306e6183d24baea
MD5 a346d245e5f49a8a795a302f92cce183
SHA1 8b9965536fd864c84bfafb3ca916f1af841fe87e
SHA512 0fb4ebe9ef3894b0836fe321e3678179c2774add38fb46beacf027077eba4bc4617de73786eec767ae22ea4fc543d7ef493cbee59a6464dc80754e2e61a27edd
SSDEEP 768:nj+9y3Xa7qGEQDaZtxJK48dHeByERRFzjK3Y4b9Mw:K9y3XaGGbaZtG48dHSyw/Gb+w
TLSH
T1C1F2BE7468695EB34CA7C29A76573B5BFFF0421782C82A58D2DCAF0E42C759C4307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d08af2d5f337d2b4fed2bd4e921f6327918d1d9694f8e88af21d3e80af7c1f17
MD5 b9b4f0b3e9174554ec5ad5191db1d6ff
SHA1 98bb85678993703b6d3af91a5f5aaca51a581c43
SHA512 daa2db2d8f2b28107924b0b84c56e0a18614cb3de5f16963da7d57f63087fc14d575245b3c1fe30952c899568df896dab69dd1fb10e3b5c6bf1438d149015cf8
SSDEEP 768:Qrv+4UNbdf38qGCcDaZtNK48dHeByERRFzjK3YMeVH1SCj:QbsbJ31GxaZtk48dHSyw/mEH1Z
TLSH
T10903CF71A8A85E735CE792897683B61BBFF4411386C41B64C1CD6F4E868B4DD130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32975595-52dd-4f07-ac0c-ef3507cc6b6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\32975595-52dd-4f07-ac0c-ef3507cc6b6c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

EasyBCD-Platform-Tool-8.51.5.exe

Path C:\Users\Admin\Downloads\EasyBCD-Platform-Tool-8.51.5\EasyBCD-Platform-Tool-8.51.5.exe
Size 22KB
SHA256 3be2a5198dc46686ac514b8c70ecb28a8aff4dd56d4d0c60f66ebf5518ec85c9
MD5 41ad4cb04af8def70763d895973584e2
SHA1 24fd6c86360d98e565bc7f3a6aa8165bc34c325f
SHA512 db3e871cc646eeab7eb2bbeceb323f0951199ea698f91eaa5eec367e48b461748c472867383560c22bce5cba1d4f09fb25983a92f219c867e8fd40d0c53bb43e
SSDEEP 384:gMoZapK5vwxSYjWAlaWFOSxE1+aHRN7t0jHvDyR9zv:gnZaBgyEN+2t0rD+9z
TLSH
T1FFA27C9ADA78058BF8EA18B08279E98BBC3DB7D31B5092CB0354E6181D137C5FA3475D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\Downloads\EasyBCD-Platform-Tool-8.51.5\VCRUNTIME140.dll
Size 120KB
SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 0d35c5e99871b4f02c490b9fd9dace34
SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
TLSH
T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k-icon.png

Path C:\Users\Admin\Downloads\EasyBCD-Platform-Tool-8.51.5\k-icon.png
Size 3KB
SHA256 64b9a0d099dc1522a11157c00f12b551b0ec0e06400e421ed43c03e681cf5c1d
MD5 7f9f93ab2e653ddb591f4a6b24fce818
SHA1 55b48eeff3e75805bb5cd98521b3f8454715bc4f
SHA512 4bb8f54f16124049d2aff4ac0b34bdb72ff7dcf60a47cad5d26e0a1473b3a06bd8423be0837a7deed2ab7217fe339e00062dd7819764a294a8f9853feff7f1da
TLSH
T1A4718D86C6F04876CCA56BE6282E536D1B604BDB81E3F8240E663C35430CC14179FA0F
MD5 SHA1 SHA512 TLSH

Submit Download

vsdbg.dll

Path C:\Users\Admin\Downloads\EasyBCD-Platform-Tool-8.51.5\vsdbg.dll
Size 2.6MB
SHA256 7e24f119331c0484be9174478c036d2249daa26dc9dd88e5bf63af7bb9c9fb3e
MD5 31e1af32483e8560203eefe83dfa9a8a
SHA1 6d3cbf1d8f49aa5fa8f790a4740df7957ef59b1a
SHA512 c98d22007739a6cc0b4cb786c136b4ac745d24883865bd9df83a286fdbc42870b14e8b31c0ba460374330c49015a800a388046466536a6d2ef8d9b41c6fe1f20
SSDEEP 49152:zZdfIDGdD1gFE4gHJZL2KFTQGDwfLoRKEN+rI3sYi1pjc:z75L2KFMGDwToRKk+rI3s
TLSH
T1A0C5D025E3D901B8E133DA78CBA29232D6B1B8560771E58F0689C3152F73EE09B7B315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4300-235-0x0000000140000000-0x00000001400E1000-memory.dmp

Download