80d2e07529cd4034f9349a69e957359aae9e839a4991e6806f4962833e45204f

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AccountExploit_Cracked-0.2.0.exe
Size 14.0MB
Sample260828-cv347sstd1
SHA256 80d2e07529cd4034f9349a69e957359aae9e839a4991e6806f4962833e45204f
MD5 9deea02329b0f03425b61617a9d37a16
SHA1 1365957a28d53a05b6709fef5ca8d9691cada338
SHA512 21b6ad3135d0e3d7de64f3690c97479088b235021aa980e3d6640823f58154d2932aa0d817f23a3dc360e7953192346e2010e5dfaa57d82153117af34470b128
SSDEEP 98304:Tu90+XKqbzfai1xSCg7/e54wjDpYURD5ZLxl+HahZ+HQduErr7:yh60OISCgK54qDfD5p+HahZ+HQdLrr
TLSH
T10CE65B07E96549D9C0EED234C96692267B70BC444B3123D72FA0F6292F77BD06EB9390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
376	AccountExploit_patched-0.2.0.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AccountExploit_patched-0.2.0.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3004	AccountExploit_Cracked-0.2.0.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2528_1084347653\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2528_647980035\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1751980930\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2528_1084347653\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1751980930\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2528_1598995565\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\Part-FR	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\Part-DE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\Part-IT	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\Part-RU	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\Part-ZH	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2528_647980035\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1751980930\keys.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\Filtering Rules	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\Part-NL	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2528_647980035\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-ml.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4548	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323575998150350"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{D09F2A39-8E1F-463C-9A2D-BC8218DB5243}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
1040	msedgewebview2.exe
1040	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
1712	msedgewebview2.exe
2528	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2528	3004	AccountExploit_Cracked-0.2.0.exe	86
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 3004 wrote to memory of 1020	3004	AccountExploit_Cracked-0.2.0.exe	87
PID 2528 wrote to memory of 3108	2528	msedge.exe	88
PID 3004 wrote to memory of 376	3004	AccountExploit_Cracked-0.2.0.exe	89
PID 2528 wrote to memory of 4548	2528	msedge.exe	90
PID 2528 wrote to memory of 3332	2528	msedge.exe	91
PID 2528 wrote to memory of 3332	2528	msedge.exe	91
PID 2528 wrote to memory of 3332	2528	msedge.exe	91
PID 2528 wrote to memory of 4976	2528	msedge.exe	92
PID 2528 wrote to memory of 4976	2528	msedge.exe	92
PID 2528 wrote to memory of 3576	2528	msedge.exe	93
PID 2528 wrote to memory of 1928	2528	msedge.exe	94
PID 2528 wrote to memory of 3576	2528	msedge.exe	93
PID 2528 wrote to memory of 3576	2528	msedge.exe	93
PID 2528 wrote to memory of 1928	2528	msedge.exe	94
PID 2528 wrote to memory of 1928	2528	msedge.exe	94
PID 2528 wrote to memory of 2452	2528	msedge.exe	95
PID 2528 wrote to memory of 2452	2528	msedge.exe	95
PID 2528 wrote to memory of 2452	2528	msedge.exe	95
PID 2528 wrote to memory of 4640	2528	msedge.exe	96
PID 2528 wrote to memory of 4640	2528	msedge.exe	96
PID 2528 wrote to memory of 4640	2528	msedge.exe	96
PID 2528 wrote to memory of 640	2528	msedge.exe	98
PID 2528 wrote to memory of 640	2528	msedge.exe	98
PID 376 wrote to memory of 1712	376	AccountExploit_patched-0.2.0.exe	100
PID 1712 wrote to memory of 2708	1712	msedgewebview2.exe	102
PID 2528 wrote to memory of 892	2528	msedge.exe	103
PID 2528 wrote to memory of 892	2528	msedge.exe	103
PID 2528 wrote to memory of 892	2528	msedge.exe	103
PID 1712 wrote to memory of 1156	1712	msedgewebview2.exe	105
PID 1712 wrote to memory of 1156	1712	msedgewebview2.exe	105
PID 1712 wrote to memory of 1156	1712	msedgewebview2.exe	105
PID 1712 wrote to memory of 3680	1712	msedgewebview2.exe	106
PID 1712 wrote to memory of 3084	1712	msedgewebview2.exe	107
PID 1712 wrote to memory of 3084	1712	msedgewebview2.exe	107
PID 2528 wrote to memory of 1476	2528	msedge.exe	108
PID 2528 wrote to memory of 1476	2528	msedge.exe	108
PID 2528 wrote to memory of 4516	2528	msedge.exe	109
PID 2528 wrote to memory of 4516	2528	msedge.exe	109
PID 1712 wrote to memory of 3904	1712	msedgewebview2.exe	110
PID 1712 wrote to memory of 3904	1712	msedgewebview2.exe	110
PID 1712 wrote to memory of 3904	1712	msedgewebview2.exe	110
PID 2528 wrote to memory of 5280	2528	msedge.exe	113
PID 2528 wrote to memory of 5740	2528	msedge.exe	114
PID 2528 wrote to memory of 5740	2528	msedge.exe	114
PID 2528 wrote to memory of 5748	2528	msedge.exe	115
PID 2528 wrote to memory of 5748	2528	msedge.exe	115
PID 2528 wrote to memory of 6076	2528	msedge.exe	116
PID 2528 wrote to memory of 6076	2528	msedge.exe	116
PID 2528 wrote to memory of 6132	2528	msedge.exe	117
PID 2528 wrote to memory of 6132	2528	msedge.exe	117
PID 2528 wrote to memory of 5556	2528	msedge.exe	118
PID 2528 wrote to memory of 5556	2528	msedge.exe	118
PID 2528 wrote to memory of 5108	2528	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\AccountExploit_Cracked-0.2.0.exe
"C:\Users\Admin\AppData\Local\Temp\AccountExploit_Cracked-0.2.0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/OpenYourWalletBru
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ffcbb38c188,0x7ffcbb38c194,0x7ffcbb38c1a0
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,11568907325535469750,11232012122811075371,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7854027965917313045,6552660007288067520,262144 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,15385310097693379018,558750039566193880,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,7711559362617442376,16004957547020890542,2097152 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,12551768531796906489,13447380857073404324,2097152 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1226175736485498961,6924048614456135188,2097152 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,16103479176561053118,13550001856216325123,2097152 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,1416317252357296663,17073082969807809844,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5320,i,6087528691168031831,17347703015910897590,2097152 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,15447441519421839219,4067581136732702217,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,2009613904049384083,4199305312665855571,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,14658452682304529695,7437483135024584217,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,14658452682304529695,7437483135024584217,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,8777257613726049517,3522877768026965529,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,14021222262790283192,1655621310507671426,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,17529691667026340937,8817469101354161997,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11175229633060524096,8525093374078920013,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,3000265488171577199,7640710149459521386,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,14701480167678656043,11966386728180975071,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,17492860994879870016,17929159356375950014,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,9928583243441420586,16186632141895587851,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,2952587601830183543,13988838875731650850,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2984,i,14600523192084942527,9584612697567099514,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,3991531194937835971,11611641032536885582,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=856,i,10395823945529086983,1706024125810645524,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
    3⤵
    PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=860,i,5868866159878364098,7627938211500956054,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4224,i,11344016623847399648,18179327399586523597,262144 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2689313540453857302,14658114241339939910,524288 --field-trial-handle=2340,i,12592487266378091596,1764292008051071612,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:5348
- C:\Users\Admin\AppData\Local\Temp\AccountExploit_Cracked-0.2.0.exe
  "C:\Users\Admin\AppData\Local\Temp\AccountExploit_Cracked-0.2.0.exe"
  2⤵
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\AccountExploit_patched-0.2.0.exe
  "C:\Users\Admin\AppData\Local\Temp\AccountExploit_patched-0.2.0.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=AccountExploit_patched-0.2.0.exe --webview-exe-version=0.1.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=376.3412.4843453069205312201
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffcb88db078,0x7ffcb88db084,0x7ffcb88db090
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView" --webview-exe-name=AccountExploit_patched-0.2.0.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1704,i,8625523338068045899,8695512722568138612,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView" --webview-exe-name=AccountExploit_patched-0.2.0.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1856,i,8625523338068045899,8695512722568138612,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:3
      4⤵
      PID:3680
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView" --webview-exe-name=AccountExploit_patched-0.2.0.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2308,i,8625523338068045899,8695512722568138612,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView" --webview-exe-name=AccountExploit_patched-0.2.0.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3716,i,8625523338068045899,8695512722568138612,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView" --webview-exe-name=AccountExploit_patched-0.2.0.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4488,i,8625523338068045899,8695512722568138612,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView" --webview-exe-name=AccountExploit_patched-0.2.0.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,8625523338068045899,8695512722568138612,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView" --webview-exe-name=AccountExploit_patched-0.2.0.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4632,i,8625523338068045899,8695512722568138612,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1040
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView" --webview-exe-name=AccountExploit_patched-0.2.0.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4408,i,8625523338068045899,8695512722568138612,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
      4⤵
      PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1751980930\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1751980930\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1712_1787290457\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1712_789065795\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2528_1084347653\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2528_1598995565\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2528_647980035\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2528_961680064\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 46ecd50b0b9dd28e2583b09dbc82416cb407c58038f3ae2d1e27b39697fe2561
MD5 8cc0b49147f75efa3b7aca0deac5884c
SHA1 a151a14c9ceefe970efbf86ff32166f67cf625e8
SHA512 9e890ff690fdb3841221d21e6dd6f422b2d6abcd0511422e8145e34f96663a6f7ed25081c62087bd39261d932d08ace1e0fe2127a6e2cf036e593d6e4bd246cb
TLSH
T125713B2942FE035DF3262232F1D95A5434F3679B0E937D5E10A88FBC6536B348DE5809
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58972a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58972a.TMP
Size 3KB
SHA256 bec98cbdfa7f15643f3ca92b54ad4d591ac06c5bc8daeb5cdab3c633e0c578b9
MD5 3fe32dd0a17e537bcbb0cb471f150810
SHA1 616023c1ef8cd16b5b2c2a721f52f7618df7f3d5
SHA512 5f1dbb778a2d894e1795efdd36ebb48d485856118d83cf64209b0066f741833a2ecda102ef8bd1ab158beb3603f58e967caeb66f806a0e5f8a70ee808626b2f3
TLSH
T1E2712B2952FE075DF3262232F1D95A1834F3679B0E977D5E10A88F7C2536B348DE5409
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 15e840d24f1bb31f56983b487caf13fc8df319429eea8c83529f5c4a1a497dd8
MD5 b18df7df80016ee816122a6cd0554ffe
SHA1 08b515fe18e664a1fa37cd5efe6798ff19153e19
SHA512 1f970f7b831be3a1caa1f5f3b1f2c214f3ade19d04fd76aa7ea80c0e69931959b4ce37665dd24689f04eabe57425325a986da23663a3651552441827acd3df54
TLSH
T10641BFF7C3E8962D891196F0AA146E2BCE5D0915432C3D5A88E4EF2B93E3471E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 516788e748d664c42f6e93255e2be114d6b7187752718cc57a78946e51680779
MD5 4934ac241ff215febb2f1c428e58191c
SHA1 428254be6a8bc9f46b931eb9aaf503e42346d9ae
SHA512 1bab831b0242f67f6fa5195a3f7cc5d588efd995c8567f43bb69b081a1b26bc64092fc255078ba7c5f8cb531ada6fc7cbb13347c2f93e8a7b06041487364ba4b
SSDEEP 192:sxZkR/1yM/jK1Ml8MiP/fWsajOXEdpXyHW6+WNcOd/Y4VfbIg4J:sxZknqP/fWsajOUCHbj/Dc
TLSH
T17F42F911AB349A77CCDBD219FA54BB53D6F95462A2810E8499FCCA1C00E6BEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ccce00f0c0f5d74d67878210ae15a79eed354edab647885ad16f1dd3f572b5d1
MD5 72745dd1693bea300fcc67910793ae39
SHA1 f05403a75e2f16ac434749bc775f9a29a2406104
SHA512 aa90ad4303aa7db99b01f2349ed2c5cf6e2743a4898bff47364bde9b392f191d2ce0395e147ec61c0fc09eb4685ab3494d19934f500aa3d216c520d499fa14f2
SSDEEP 192:sxZkR/1yM/jK1Ml8MjP/fWsCjOcO9IdpXyHW6+WNcOd/Y4CUsbIg5lJ:sxZkn7P/fWsCjOuCHbj/ot
TLSH
T1DF520905AB345A77CCD7D319F955BB53D6F85462A2810D84A9FCCA1C00E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c3fecc951cd36b485e69f5d742ca2387350a6319c2a3b4bba5c194f5a458d5c5
MD5 dcba1aff0211321ffa74cc2bea82774f
SHA1 86600a38fcc7d1e72646e201a8caceedc05c22b6
SHA512 bb533eca095b40f2ff95c6d63aa77463eaf317638a12d40fe14c57ad747d67035821bb0329b23c3bdabfb9bb245cdc941742259655ad4f4cd85d7aab02f41ebc
SSDEEP 192:sxZkR/1yM/jK1Ml8UQxyP/fWsCjdcO9IdptyHW6+WNcgHXY4y1/bIg5TJ:sxZknqcP/fWsCjduwHbrXGv
TLSH
T11C621805AA345A77CCD7D219F955BB53D6F85472A1900E84AAFCCA1C00E6BED221BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bed86da80fd8aa4f48767601832bc9799647155beacbcca8cb622cc84b302c14
MD5 2440e54652474a3e29997bc021876934
SHA1 7f9eb924c68cc556f9a45a7bdf00ec41736a3c1d
SHA512 2e125fb63a7d007a5e642c981e13c9ea6393320b9b642c996d83e3cd65fcde02ce63299d198389964042112e9d64d61261e97b7d5217fee036125268d0b86baf
SSDEEP 768:2E8iJANWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzALl6opdVroVktUn8:2E8iJANWvx76ru1jakALocduIU8
TLSH
T16FE20B3B680CCB7E4F844E9CEC266F966DE801CB5A944D5447FA884C03C77EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4ead9029ceb4840d6eb2ee5cef283dbe9e815bfd672b6e6425eda6ff9fe8eab6
MD5 bb584c1bae3bb543447e47418d2c4197
SHA1 c8e06afb917ec9e0827a1a8d4d3dc1a1aa71c01f
SHA512 cfdee609365ebf734673b4e9b41766b20b4414fe45e1052cf4372ca864fcf16cbeebcb94c9b7c94ce1101590cb232d47e5588ba8f1ebf4abe119e41d43bbc56f
SSDEEP 48:K0YIjKlqcbyRyIfKnqo7aIPK3q0Hyi8hQsa2ikJ:K0YwKlqqCy8KnqYaYK3qeWJ
TLSH
T15491561634BB12923C3F241896A18B569B82B6633019E42B7FBD40711F6BE258CFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1eb97c4f-5430-4925-b61d-b4097777bfd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1eb97c4f-5430-4925-b61d-b4097777bfd5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ce99765c9297d3e3f1ea3be9add9eaad284b18e80d6eebb61f4b35772ea4f636
MD5 9aee5c72b767cab971584902fbe2566f
SHA1 c6f6430429d88be7ffb597bd074e543af7bf1b9f
SHA512 26ae90d803bc545091a670665661a408d132be88bad5172f4c0dbebd961ee6842a25c16f695543ba838ded1b770732a340ad7a0a0e5e18d0d847c59a8cf64bf8
SSDEEP 384:n/iFAZcInsNh8TUNTUlIlAcMe6mxlTW0DfwdywmfTp+Zcf7zoq:KF+nUwgJff0sXTpec/B
TLSH
T1BEB21872D8A4DA3BACF79786F64676879EF410A389C99EC4D9D99E0C00C36DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 2d13ab993b44943f6a8191f34ded66520799b923cd85a4be930890f0b7ca8e9d
MD5 12d6ed10a94355b4c19148b92b2928d2
SHA1 1ae78fc4ec9f0a0d306b4070999b5f2ef3cbe530
SHA512 9ee36445f603aa6cb62b81e204df312f35ed5cff3353c2f23e647a7226e2e409d990f416da7aac21efa83ed820336b5a74dda8c056eca5bbfafff80a2bc8b0b0
SSDEEP 384:n/iFPZcInsNh8TUNTUlIlAcMe6mxz1W0Dfxdywmf+p+Zcf7zoq:KFHnUwgJf3NsX+pec/B
TLSH
T1A2D293F188D78937D8AE9743A77D6D428EBCD0A375894984B7D49D0CCC826BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 5a17f665b01a6ee16642fda3da9fd836fc1cb0377cd76c76cb0dad0d9a8b93f1
MD5 f16c2fd11822bb13d8e2e89ab16d2d3d
SHA1 ce9c98302f5630cbe445a974afef432fdf26a266
SHA512 5a92f25edff1ad9d9d718ffee5e8da0c41c0606ef992934ae28c63b9830c30962e289d3d89f5710071a5ca15e59991ea70f8b528d824e489d5f55cf1e5c1a8c5
SSDEEP 384:n/iFbDZcIisNS8TUNTUlIlAcMe6mxz1W0ffxdywmf+p+Zcf7zoq:KFbbipwgJf3xsX+pec/B
TLSH
T13BD2A3F188D78937E8AE5743A77D6D428EBCD0A375884984B7D49D0CCC826BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d5073ffa8e1c3c96e887824a67900bfc00a113ee2e917bb0139f30b0013a3aa
MD5 4ba1eae36356599cf2874ea80f2d8dfb
SHA1 34e0708c308894128cbec3318fa4ba195d0741fd
SHA512 6c78d396229cefdd087de18effa4c96eecc290a4fd688eb75763df201961370fcec68faeb95f6b12e4e02b7bf8abade9ffbf756f007150c3429504c8bdb76222
SSDEEP 96:ZqONkrwQsjpfmUTmDK5ih/cIPURHl8h4otop555DIBhPwivh50xy0SFYKNAxOYoW:gONw6kDfQmiUyL8Z903iow+QiL90oU6
TLSH
T16E02E93568786CBB8EA36E55F44637275FA8217BEAC52F84DAE81B1C00D725C1347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 981b42291ad5ee4e69ef0d61c851e995bad7bfd547a9fe143707395828bf252d
MD5 bb14574118b041f0b07bcdc7aed0f97b
SHA1 967f9cf747af50757636a3ca0d7c99e4563a3c61
SHA512 bd69f67a7d0153d698c49de92b0bc2d0c646364e02b8211e157930f42d2fa6cdbbcbbd16a690c2e0468ea917693bec3abe15fbcb8843c9890b8236e74d16a2db
SSDEEP 384:nCZcIhsN/EcMe6mxlJWkywmfop+Zcf7zoq:whmfVGXopec/B
TLSH
T19D826B7118B9AC7758F7A206F9863A538FB860B799C98F84D9E4E71C00C7799170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ec102ae60d715bc25765e52a6da1cff6f785bd2a44b90742a80b7109ad5d7c96
MD5 e858c616feeca0695770a9134df5c422
SHA1 f4dafa65502f74262da43fe411c52d48fa3ad92e
SHA512 02a20aaff94ecdb03c65f036e723620ad21a25a30c75b22be5bdc274c3d11a694ae4f7cff13809a2d878d8a7939ab3e92de24d776a7387d2e27ddb762dc5ed07
SSDEEP 384:ngZcIvsN/RcMe6mxlTWkywmfop+Zcf7zoq:evpffGXopec/B
TLSH
T107827B7118B9AC3758F7E106F9463A538FB860B79AC94F84D9E8D71C04C6799170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fd420fbc27e22fef7790584aa8950d48f15a38260eda8998161d6f601ca5ef5e
MD5 4eef9d2e06aedfe69c78a8a0a9fa9086
SHA1 21456a45b5dd28fd67fff36f01022845c7743c36
SHA512 9008b4f687cbc18432e6b3b4a7a073740fba192fc3352496c12fbebdc4dcd4a692038e2c1374a1ec5d58567de4deaa049a8211da862f37bc7493b10ea33a0cc5
SSDEEP 384:npZcIvsN/AcMe6mxlTWkywmfop+Zcf7zoq:hvOffGXopec/B
TLSH
T1B9926B7118B9AC3758F7E106F9463A538FB860B79AC94F84D9E8D71C04C6799170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8ac0f2b9d270452a0ffaeb89431a6f06985919a7ee183b279963fcde3230b1fb
MD5 df070239b4669f6acab481481e280255
SHA1 7cdd0eed3f3654bd64cda56c3034edd18b4b3eae
SHA512 77d646ef0165d1046b9866e5305cd874a133f430f13f144bfd170971702eb3a6a2de8eceb320b1d03849d18f771c6939b33fd6d4318acdaa3cfaa3a2a54deb86
SSDEEP 192:tONK6k2QmiUyq8C903iowmcEJGcRLrqBEU6:tONK6PCC9ywmfFpU6
TLSH
T1EB121A70686CAC6B5DE3A516F48737A39EA82077DEC66F85E5E4561C04C73882B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

cd2243c8-f13f-4e4c-bd88-ae987f136879.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cd2243c8-f13f-4e4c-bd88-ae987f136879.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d6441759f5943e84d315c7608f1e0acf10ca260121d2aa841d76ba4ae1fa4976
MD5 db40a20e9dfd777d43924e991c3a189d
SHA1 23fc669054b86dbc65001c922ae0f1d553584f49
SHA512 29ca07b638625abebc93a578df12aa4f80f9a7786f69a6aa585429e0137eef3c2a8733d59f749c71dc461f94f553d98794af26715761ae5df51202bf22e917e7
TLSH
T1B641345CA6E91108B3B76F5AABF6A86D487FB9732E06D85D00110E4E0A62B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

9ed6e62a-fac9-44a7-b1bb-cb0a34fa9df3.tmp

Path C:\Users\Admin\AppData\Local\Temp\9ed6e62a-fac9-44a7-b1bb-cb0a34fa9df3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

AccountExploit_patched-0.2.0.exe

Path C:\Users\Admin\AppData\Local\Temp\AccountExploit_patched-0.2.0.exe
Size 13.7MB
SHA256 e3e8d2b93f8b23b49b60c8e67da67403fca827c41adefd6ac63e5aabf836829d
MD5 37bd5ffed02530cdf1616d7668afc523
SHA1 f0bda55a0fc8405775a293c086bf7a894a21a92c
SHA512 3d02020f8b5b52284da35550cf7e361a21526278fab11f7e109af69b5320654d250f9b4769d8f082977739087353ca279315285f06a492d6f194dcfd0d34e5c3
SSDEEP 98304:5u90+XKqbzfai1xSCg7/e54wjDpYURD5ZLxl+HahZ+HQduErr7:ch60OISCgK54qDfD5p+HahZ+HQdLrr
TLSH
T160E65B07E96549D9C0EED234C96692267B70BC444B3163C72FA0F6292F77BD06EB9390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6eb2a66-63ee-4ece-b708-45616a6924d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\d6eb2a66-63ee-4ece-b708-45616a6924d7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2528_1471100109\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec07a1b5-f767-4b0a-8ca9-63cf2ea95e9e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2528_205403533\ec07a1b5-f767-4b0a-8ca9-63cf2ea95e9e.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7764e8cd95de9d4bd6c0fc3f981bcb1fb6927c881fd194c1a25546b353666333
MD5 aec4446690ee1db8b52a1cb18f35d09c
SHA1 4d47588e55a136848e3253d1a3b1a0e583d9150b
SHA512 e0e0c97155944a7b8398125803a977307c2ddc9c1cfedd3d34e6608c4d7b14acab714bd318095ac950d46d2177f0185e6f4ea13fcb05d3c48c590c7429cf5094
TLSH
T15DD0121672024AB4C41060330112634C0442C21F440F80445D2C951D2A1446C0E12841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 580456a870f1535d3fe629b07617310391168b008cdace61218b118e7758ad6c
MD5 2ae96020b9f53b4c89d4341771b1914f
SHA1 c3a215aab6daeafd58a6e553cbe7027fcd9eee5a
SHA512 6a4369833c3393f33a7aca1b22dec13d9ec1cf2ee764902f92d103accc0b67dca28f8166b038009abe23114b314b56d2b55ba6362b4ac24822a19ad7b5b65fc8
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7a3a9697598e2a5262e14fb3e8a8b6d472f4efce4f51c824a7180dddc2157a8e
MD5 93a706ab8d696c3618d99eda561377b1
SHA1 f37fd3acb9ab8e7d869673f9f0846c6aad5055f7
SHA512 6af9166b5261c2b9fda391f380106157b1f2c83d02320afb5678083f05fbd8c8fdf7755e9105131392c187eb0f2601da762a025eacde325d6fd4208e456a5b49
TLSH
T149A0025406C10441CE1B02F730468B402775CD54EA16536386A301A5AE6A6C09105140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c975.TMP

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58c975.TMP
Size 48B
SHA256 b10f125a8ce6c48d9d4d08f886c84d09491c38441cac782f2aab8e00c4be9526
MD5 cf61bfaadd555ffdba52c424bcec8938
SHA1 651ab7eb404d5c2e0b2da1e3210866af13e27d70
SHA512 3cec75557d64bd66475230673b661557af8712b5b8a1ffd83d5ebe7436366c9d6c718aa0dc0f45399bced26dbbd4aec255d8dbcb7086d775915caf3373f3ad56
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe598553.TMP

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\Network\Network Persistent State~RFe598553.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 aab6b621d620c6732a671c25d2307b26e235027a98af119fbc23a38e616bb0a0
MD5 f4b036fc7a521fc0cbbbf3819ab91413
SHA1 e7fb75a0e5deff2dd61ae9dee7dc3deae79f28d5
SHA512 d49fdd6d0410519c118090a510789e7876a5479ccc6b871adecfe8bc849772482e2e39bb1a68d9a9475dcc8a6c8be581da7c1bea44ab194f386644d679ed5e10
SSDEEP 96:stPZ05+1eMb9affwZ8i0vhEekcbm/7qx+WVHMSm+uecSy1S1idQj5P+gBgAMEB:stx0Uof4Z8pakK/S+WiQyswdqP8AM8
TLSH
T106D198025E28B9774CC7E619BA39FB13D2FA602265D50D98ABFC851C08D67CC620BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 7ce1c5d984710f189e93f17417332b46f53b7436795f624305700a554f2e8564
MD5 02ba8001dbb2544b8b6a09aeff27dd90
SHA1 f7a7e6b69b6abfba4a971f4661ff913a378420f3
SHA512 fba4ded66d9011562ee653b2d16ba4ffb5d6c010ea43c2d53c86797e7da6da644b69333cd00cc1362016936e794b697eb680d383721ae4f9e3d6696a8c5f614a
SSDEEP 96:stPZ05+1eMb9dffwZ8i0vhEekcbm/7qx+WVHMSm+uecSy1S1idQj5P+gYgAMOB:stx0Uvf4Z8pakK/S+WiQyswdqPNAMC
TLSH
T1F6E199025E287D774CC7E619BA39BB13E2FA606265D50E989BFCC61C04D67CC620B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58a052.TMP

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\Preferences~RFe58a052.TMP
Size 6KB
SHA256 6f6e3409d6f7c6933a5df0d600dfc6df6cf8656b8efaf4587aab55bfb081e715
MD5 c69d8038460337fc549c15ca978bb8b4
SHA1 8e4420e8275d24de25a08629ea58171dff1997f5
SHA512 268ccc84e0b18304b432fc7946ba2e2c05b93247cb6257053e1a1921458ee197f38632aff580eef7d71b856498040065e28b0339757b4aabe0ec04d8c10f1073
SSDEEP 96:stPZ05+1eMb9affSdZ8i0oEekcbm/7qx+WVHMSm+uecSy1S1idQj5P+gBgAMEB:stx0UofMZ8pFkK/S+WiQyswdqP8AM8
TLSH
T115D188025F286A774CC7E219BA39BB57D2FA602165D50D98EBFC865C08D67CC620FC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Local State
Size 17KB
SHA256 6c4274763b47d1b05d5bd3e6791856dfdfe202f7558b36fa94010e0ce1fa79ae
MD5 fe48ed715aba5fdb0659ad5608cec640
SHA1 e02a5b77e964ad195ef14313d0a1fbd04a4b49ff
SHA512 ae5f1cb4e5cc775c7c54276a7a014d72974cff002ea12b483f6687b70a5c750af3ef804dce89d46fca1b4433f5212646ae0f198bfdfc39690c552da80c38abd2
SSDEEP 384:z7+aQikB+z/xvxjg/qhEiNbRh2JXv0yIn29zA:+/UxvxjgC+CYR0yIn2FA
TLSH
T17B829E36E468BE2798F3E644BA4E2B8BDAB4547240C51FE88AE95F0D06C739D0347C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Local State
Size 17KB
SHA256 d0cf1ecbacc5fff3470a2daff56c329deb1f430b114ac84b6b1fd344720199c0
MD5 452eac9604a119ccbbbbbf26b3e95fcf
SHA1 5736f95e3495e903407c6e9e6e7cea0decf69cf3
SHA512 4fbda5ac3105e41faa7264f2e311232e73f25c61587a62906cba5bad313448c6169a64a7847bb154dd2d0a6b785160bdaa26c3f27d2e008eed78e6e1ede929ff
SSDEEP 384:zZ+aQikB+z/xvxjg/qhEiNgRF2JXa0yIn29zA:I/UxvxjgC+HcE0yIn2FA
TLSH
T198829E36E468BE2798F3EA447A4E2B8BCAB4557250C51FE88AE95F0D06C739C0347C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Local State
Size 1KB
SHA256 2d949c108a717835e0f781a4a86d0e8125f0464bd08f85ab91bbbe67714dc599
MD5 520d21018e0f1e4b73d73b2c8f656eab
SHA1 d3d6d27e51f398982a02bb9d87296d459db2e9ac
SHA512 8c85fea0d8b28cc48048b7e60a4030618dd73e4ebfcac0758b60e5a40ebb196948afc98840c9d9607b6f888e5bb33ab5eca8e41647b5faaced55d18dbda2bf79
TLSH
T1D8318772A0D41F376C926566B246BF476D30102EC4214F98E1DECB1C02E33CD522AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Local State
Size 2KB
SHA256 279a9c8232b7bbafecfa931a56b85ac5a675154bebf06c15edcc962f6097e52a
MD5 893011f24e8ab36cf68ca5b2a5f08a20
SHA1 a9ee59e50386ff349acd6884c594d0348f48192e
SHA512 bf20cabaf94a4cee59a40e302d3a0f37da22dd1a5c4637b5e253329a1850d7174b91064957819fb87645db0b90af7ad175e08e4a0876836f3b495bf4d41e62b3
TLSH
T1F251C573B8586F3789E39964BA4A3F13ED31216999622FE495DD4B0C02E739C2306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Local State
Size 4KB
SHA256 00e431d91f694c257fd46de286c159059cbb1dcfc6305d65258de2daa1c9b7fa
MD5 48c684fbdf886ffd7ae3b38f7027cfe7
SHA1 359f55256ded277b8a8844fa715d46a2c81944ab
SHA512 0f9271a231abc5762e93272ad34df8bdde70590e92be50e0dfcf0ae9297d103f710424f6dce2b394ead001df5432fb704be4b69a735787c6057fee6e0bfc2f60
SSDEEP 96:zu5bNkCEffrUb58Frh/cInURoDotoizrD7BtZp6MBZ/JrTmlza:zMbNbEUmooDUDbFtZD3F
TLSH
T15A819432A974AA274DF3D915B98A3F07AA605027D4A62FE8D9ED4F0C02E738C1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Local State
Size 3KB
SHA256 1c3bbd47eb7a0d17ce4ec0d7f38516cb1c98d27e91ebb00681d92e152062479f
MD5 05b2c640c4f7d360d4b02937ff35306f
SHA1 bfc49a1f3aaf350fde2d9b485aa2d04613ffccd4
SHA512 e305d898fb158d3e650c369e5955ae232dc450e0287407e17cb8570075fc9bc11f1b807f9cb4e2a6c9847063c2b58f2c280adc29c704226f0e17f14d2472fa4f
TLSH
T12D719676A964AA374DF39914B9862F07B661113BD4963FE8D5ED0F0C02D73981342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Local State
Size 16KB
SHA256 29bb21eff5fa2d1f99674a11c4405e42dfb6e761976ade775259bb47283a9aad
MD5 a8c7837613f429b25c8d9767ec22448c
SHA1 76b323b87b63d63658c0f185f0c791f9cf948759
SHA512 5dbb92b94235755180a3149cceacf9154a1f3be9e1b1194c7c254f2fb9f4cf8525699db81bafa5725c142eacc8ce7c15252695cf55e2ace2d82dec183ae5317b
SSDEEP 384:zc+aQikB+z/xvxjg/qhEwNbuh2Jyn29zA:n/UxvxjgC+tYAn2FA
TLSH
T10F729E37A5683E2799F2F914B94D0B4BCAB594B280C12BF88AED9F0D06DB3940346D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe584b2d.TMP

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Local State~RFe584b2d.TMP
Size 1KB
SHA256 643719d3d3be5e55f92642f8b708f160b6470cb07ad6307cf5e6efbd6ae28b41
MD5 e2e7b5c3c0ec6db1b331fbee40344bf4
SHA1 82061d83bd6f4f3dcb868dd74693c23f101449b8
SHA512 4c1e2ec602f09d220963556a65451b37fdc4180bb07d5e8579d01828c0331162a4e8d383864bec734cd07ea7210acfbab1ec7a11f470a0f1b47b469817eff39a
TLSH
T1DF219577D0D82E37AC921861B252BF4B2D60113E94254F6CE1DE861C12E72CD8266C33
MD5 SHA1 SHA512 TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\AccountExploit_patched-0.2.0.exe\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1020-13-0x0000000140000000-0x0000000142E16000-memory.dmp

Download

memory/1020-0-0x0000000140000000-0x0000000142E16000-memory.dmp

Download

memory/1020-706-0x0000000140000000-0x0000000142E16000-memory.dmp

Download

memory/1020-9-0x0000000140000000-0x0000000142E16000-memory.dmp

Download

memory/1040-1280-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1040-1281-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1040-1272-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1040-1270-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1040-1276-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1040-1277-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1040-1282-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1040-1271-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1040-1278-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1040-1279-0x00000251CBE70000-0x00000251CBE71000-memory.dmp

Download

memory/1156-398-0x000001EEC6E10000-0x000001EEC6E40000-memory.dmp

Download

memory/1156-104-0x00007FFCD6C70000-0x00007FFCD6C71000-memory.dmp

Download

memory/3004-14-0x00007FF6642F0000-0x00007FF6650F9000-memory.dmp

Download

memory/3084-172-0x00007FFCD7800000-0x00007FFCD7801000-memory.dmp

Download

memory/3084-173-0x00007FFCD60B0000-0x00007FFCD60B1000-memory.dmp

Download

memory/3904-213-0x00007FFCD6C70000-0x00007FFCD6C71000-memory.dmp

Download