7643f989a6b22411ac72a4c17ae5ddee007440bd794d1d3be416bb5b45b53f9b

Analysis

max time kernel
296s
max time network
295s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/08/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CeleryApp.exe
Size

8.8MB
MD5

74c366b46a85acac6c83e9671e64dda7
SHA1

dc9a7b4cc7511b701401aa86e0106d3495e3a0fe
SHA256

6a25cc6c05e54ca56e8b51d2b2bd8b9a17a96ecb1d1f6d4442d36378dc809ed1
SHA512

e0df64a74c3c9e1c36f5957d346d961cc92741b1803e05d41454dde4371a0e9420f9e79163bed9fe2d8b588b9da6f2faaa08003ca50be37a6425a8320acd15cb
SSDEEP

98304:wEgLIRfyC7egWJ3iJzdjf4fwraOWcD9XdMPABIw/t6KHDicVwzUs7:wEguhegD4fJOWs9XNBZ16M2cuU

Score

6^/10

discovery

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3384	msedgewebview2.exe
4484	msedgewebview2.exe
2444	msedgewebview2.exe
3288	msedgewebview2.exe
3904	msedgewebview2.exe
476	msedgewebview2.exe
2020	msedgewebview2.exe
1832	msedgewebview2.exe
772	msedgewebview2.exe
3452	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4500	msedgewebview2.exe
4500	msedgewebview2.exe
3384	msedgewebview2.exe
3384	msedgewebview2.exe
2444	msedgewebview2.exe
2444	msedgewebview2.exe
2444	msedgewebview2.exe
2444	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2512	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	msedgewebview2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2512	3672	CeleryApp.exe	82
PID 3672 wrote to memory of 2512	3672	CeleryApp.exe	82
PID 2512 wrote to memory of 1964	2512	msedgewebview2.exe	83
PID 2512 wrote to memory of 1964	2512	msedgewebview2.exe	83
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 2020	2512	msedgewebview2.exe	84
PID 2512 wrote to memory of 4500	2512	msedgewebview2.exe	85
PID 2512 wrote to memory of 4500	2512	msedgewebview2.exe	85
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86
PID 2512 wrote to memory of 1832	2512	msedgewebview2.exe	86

C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe
"C:\Users\Admin\AppData\Local\Temp\CeleryApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=3672.3660.7693710642571782894
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x1b4,0x7ffecb0b3cb8,0x7ffecb0b3cc8,0x7ffecb0b3cd8
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2496 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4668 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4492 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4524 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3452
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5012 /prefetch:2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=1184 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1876,8169844127372550667,313299099560115737,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=CeleryApp.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
012ff0796de31c4a7440921e5e282f5d

SHA1
1550585130513d1288895d6abd24aeb71dee7eb6

SHA256
58ac0adce8db497befe2b08812ce12ef3e3077b2bb4a5e4a98a40c6901a7d330

SHA512
03767d83d09090c0a03ce9d6d0cc563ad8980e254af461518d75db5e7704ec8333181e4e0b62981746b36f5e37f360b781d3e0e00af03e20832179cf3384eaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
a99556f8317748974e076c44e0145829

SHA1
6d30cd2037a74bc862c1347d04338778f0410f9f

SHA256
a1213203ceb16e149efecc74f49bd79191f8aa9cf1b6c843be6966c4a73eba3b

SHA512
42fe842ce0e1f33d84c435713b8fcc2a742fa0b134e9654e4419009b6fac935602cc578dda18b6cdb98a2109bd94babd021f612dd528510694ac1ebe174b2376

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
1ae3ef5070fdf44824f968398e6b1240

SHA1
737da5f39a49e8c6dbce21a03e894895e9364150

SHA256
147720a2cccb28419c0fb5830da70b5abf552ef77812a92a94310739c25ce167

SHA512
fd42c1b821a04b98db713ba39da94d1970dcad24a533a55eac5f163421a0a86bb5871b88219fa5c0a570521bd3040960e5d8c28a23f9d52a2b40e5cce1c80cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Network Persistent State

Filesize
299B

MD5
476228b07407472d628592c4418d85df

SHA1
b743cd3678ac7e2bd0316e82178d8507ac32daff

SHA256
7b579b0467768300436bf91bf71354fb0b084cf86db44cbc8377763d19edb0d5

SHA512
c3c649e5294faee3d0d5c4caa978322fe50c701ea9ddc91889847ff4a99da7f5c7e940266b31f79aa724a210ccd0d399c4aa2853c3c63da0091cf19ae4406be3

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Network Persistent State~RFe58b4f3.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Preferences

Filesize
3KB

MD5
48fb93ca4a9c50a050b07a4396206cdd

SHA1
70d158613465e72b31bf5f653d59141cd2550ee5

SHA256
b07d282a3d94513ca9dab865f2f6fb7a6e5cea76a6117b3e87687ad0801fab48

SHA512
04ecc949fabe59bd3d88df5a06f2208ffb76ccfc986e12c138d9f1c62b7de8c6b8f6c64e11a92b848e5d35a7774bad4f08451b0bcc90a8bdf216ef2ade9043a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Preferences~RFe58a227.TMP

Filesize
3KB

MD5
90eb4acbc76b67ff8b5c8de1f483a713

SHA1
6c4754c7898b0f1e11b0bf420c6055976c6eceee

SHA256
a5fb47d545df5238fc356b0b11c23a708858ffcd3771c3e8f4e1b2a929fdfea1

SHA512
5ba512e4ff2af3ab5d35a575b89ac7b7e6f361ae8bcde173f55782a804a924b4a19a3ff17f7fab8344140d1684cf06756b2244efc8d20b7c8dde58618aba9a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State

Filesize
8KB

MD5
827d2565584ea10c683efe77ece2f43e

SHA1
05e463bb26d124abe992a67dd30c52a3db3a4e06

SHA256
960c9fd5739746f12819e564a141a87ead4a61f031c713af8d7901709044eca1

SHA512
354eb923d545413f9da661f2a409f344628259d6a300de45c7c9105eb041687153af724f849e3c0af271245e8c8416d02cce9664917f6957ef5aaf88145cb338

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State~RFe57dc18.TMP

Filesize
8KB

MD5
97879dae14e83fe31cc6733731f87dce

SHA1
fa50c08f394ba8a1cf6270cfc1a01f7b3f73011b

SHA256
1b8eb0aa734ebabbf2957e8391891b8ecf2b2e429bb9bc92aabfd7980e1acab9

SHA512
21b21c240f6fe09f75656c84fcb2ffd68f482610f67da4f69154cf0774dc3eaceb954f9570dbfbc1b5374cddc1667c701d20f56c06e66cec63f888f7d0b2be2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Advertising

Filesize
24KB

MD5
131857baba78228374284295fcab3d66

SHA1
180e53e0f9f08745f28207d1f7b394455cf41543

SHA256
b1666e1b3d0b31e147dc047e0e1c528939a53b419c6be4c8278ee30a0a2dbd49

SHA512
c84c3794af8a3a80bb8415f18d003db502e8cb1d04b555f1a7eef8977c9f24e188ae28fc4d3223b52eab4046342b2f8fd0d7461130f3636609214a7b57f49cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Analytics

Filesize
4KB

MD5
da298eacf42b8fd3bf54b5030976159b

SHA1
a976f4f5e2d81f80dc0e8a10595190f35e9d324b

SHA256
3abd2e1010e8824f200878942e0850d6e2620a2f0f15b87d32e2451fdda962ec

SHA512
5bf24c2df7cc12c91d1fb47802dbac283244c1010baa68bfae9eb5eb8ee25758156bb1e21f6cc3f55e7d71e5c330888ffd41469b2630eb86237c9970d7ede75e

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\CompatExceptions

Filesize
689B

MD5
108de320dc5348d3b6af1f06a4374407

SHA1
90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b

SHA256
5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53

SHA512
70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Content

Filesize
6KB

MD5
97ea4c3bfaadcb4b176e18f536d8b925

SHA1
61f2eae05bf91d437da7a46a85cbaa13d5a7c7af

SHA256
72ec1479e9cc7f90cf969178451717966c844889b715dff05d745915904b9554

SHA512
5a82729fd2dce487d5f6ac0c34c077228bee5db55bf871d300fcbbd2333b1ee988d5f20ef4d8915d601bd9774e6fa782c8580edca24a100363c0cdce06e5503f

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Cryptomining

Filesize
1KB

MD5
16779f9f388a6dbefdcaa33c25db08f6

SHA1
d0bfd4788f04251f4f2ac42be198fb717e0046ae

SHA256
75ad2a4d85c1314632e3ac0679169ba92ef0a0f612f73a80fdd0bc186095b639

SHA512
abd55eff87b4445694b3119176007f71cf71c277f20ea6c4dcadfb027fdce78f7afbcf7a397bd61bd2fa4bc452e03087a9e0e8b9cc5092ec2a631c1ebb00ee25

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Entities

Filesize
68KB

MD5
571c13809cc4efaff6e0b650858b9744

SHA1
83e82a841f1565ad3c395cbc83cb5b0a1e83e132

SHA256
ab204851f39da725b5a73b040519c2e6aaf52cb7a537c75802cb25248d02ec1b

SHA512
93ff4625866abf7cd96324528df2f56ecb358235ff7e63438ac37460aeb406a5fb97084e104610bb1d7c2e8693cabedc6239b95449e9abb90252a353038cb2a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Fingerprinting

Filesize
1KB

MD5
b46196ad79c9ef6ddacc36b790350ca9

SHA1
3df9069231c232fe8571a4772eb832fbbe376c23

SHA256
a918dd0015bcd511782ea6f00eed35f77456944981de7fd268471f1d62c7eaa3

SHA512
61d6da8ee2ca07edc5d230bdcbc5302a2c6e3a9823e95ccfd3896d2e09a0027fece76f2c1ea54e8a8c4fa0e3cf885b35f3ff2e6208bf1d2a2757f2cbcdf01039

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Other

Filesize
34B

MD5
cd0395742b85e2b669eaec1d5f15b65b

SHA1
43c81d1c62fc7ff94f9364639c9a46a0747d122e

SHA256
2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707

SHA512
4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Mu\Social

Filesize
355B

MD5
4c817c4cb035841975c6738aa05742d9

SHA1
1d89da38b339cd9a1aadfc824ed8667018817d4e

SHA256
4358939a5a0b4d51335bf8f4adb43de2114b54f3596f9e9aacbdb3e52bef67e6

SHA512
fa8e1e8aa00bf83f16643bf6a22c63649402efe70f13cd289f51a6c1172f504fedd7b63fc595fb867ecb9d235b8a0ea032b03d861ebb145f0f6a7d5629df8486

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Advertising

Filesize
2KB

MD5
326ddffc1f869b14073a979c0a34d34d

SHA1
df08e9d94ad0fad7cc7d2d815ee7d8b82ec26e63

SHA256
d4201efd37aec4552e7aa560a943b4a8d10d08af19895e6a70991577609146fb

SHA512
3822e64ca9cf23e50484afcc2222594b4b2c7cd8c4e411f557abea851ae7cbd57f10424c0c9d8b0b6a5435d6f28f3b124c5bc457a239f0a2f0caf433b01da83f

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Analytics

Filesize
432B

MD5
01f1f3c305218510ccd9aaa42aee9850

SHA1
fbf3e681409d9fb4d36cba1f865b5995de79118c

SHA256
62d7286cd7f74bdfda830ee5a48bce735ee3661bda8ceac9903b5627cbd0b620

SHA512
e5b665e981f702a4a211d0569bb0bc42e3c29b76b3f75aaf8dc173f16f18f7c443f5cf0ccf1550df3aa2b151e607969c2c90ab1a6e7a910dfeb83854cea4e690

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Content

Filesize
48B

MD5
7b0b4a9aafc18cf64f4d4daf365d2d8d

SHA1
e9ed1ecbec6cccfefe00f9718c93db3d66851494

SHA256
0b55eb3f97535752d3c1ef6cebe614b9b67dddfcfd3c709b84c6ecad6d105d43

SHA512
a579069b026ed2aaef0bd18c3573c77bfb5e0e989c37c64243b12ee4e59635aaa9d9c9746f82dcc16ca85f091ec4372c63e294c25e48dfffbed299567149c4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Cryptomining

Filesize
32B

MD5
4ec1eda0e8a06238ff5bf88569964d59

SHA1
a2e78944fcac34d89385487ccbbfa4d8f078d612

SHA256
696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5

SHA512
c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Entities

Filesize
42KB

MD5
f446eb7054a356d9e803420c8ec41256

SHA1
98a1606a2ba882106177307ae11ec76cfb1a07ee

SHA256
4dc67d4b882621a93ffdb21a198a48a0bc491148c91208cf440af5f0de3ef640

SHA512
3cc3a521b297e4f48ed4ba29866a5ade380c9f0c06d85bea4140e24b05c6762d645df3d03d0a7058383b559baa3ae34ad3ed2b06017e91a061632862911a823b

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Fingerprinting

Filesize
172B

MD5
3852430540e0356d1ba68f31be011533

SHA1
d3f622450bcf0ced36d9d9c0aad630ebccfcb7ff

SHA256
f1f413704c32a28a31a646f60cad36cc2da793e143f70eee72ae56f736df8054

SHA512
7a4faa493c141ea88d6cd933dfc0b50ef6d25983323db2b931c7512e039859d60c4935e56b771264ca72b45c035b1962ad8680d616eaaf04fbc5a6e0b674e435

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Other

Filesize
91B

MD5
09cedaa60eab8c7d7644d81cf792fe76

SHA1
e68e199c88ea96fcb94b720f300f7098b65d1858

SHA256
c8505ea2fe1b8f81a1225e4214ad07d8d310705be26b3000d7df8234e0d1f975

SHA512
564f8e5c85208adabb4b10763084b800022bb6d6d74874102e2f49cc8f17899ce18570af1f462aa592a911e49086a2d1c2d750b601eedd2f61d1731689a0a403

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Social

Filesize
3KB

MD5
318801ce3611c0d25c65b809dd9b5b3c

SHA1
b9d07f2aa9da1d83180dc24459093e20fe9cf1d8

SHA256
2458da5d79b393459520e1319937cfc39caadbc2294f175659fae5df804e1d03

SHA512
7daff0253da90f35bf00141b53d39c7cadacf451a7ecf1667c4ca6e8aed59a0c4a6b44ddc2afffa690e12c2134eddb9f46f72e4317ce99c307d9e524a5fd1103

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBWebView\Trust Protection Lists\1.0.0.26\Sigma\Staging

Filesize
16KB

MD5
39bdf35ac4557a2d2a4efdeeb038723e

SHA1
9703ca8af3432b851cb5054036de32f8ba7b083f

SHA256
04441a10b0b1deee7996e298949ac3b029bd7c24257faf910fe14f9996ba12ae

SHA512
732337f7b955e6acaf1e3aaa3395bc44c80197d204bd3cbb3e201b6177af6153cc9d7b22ad0e90b36796f92b0022806c32ac763eaec733b234503890900bf284

Download Submit
memory/772-150-0x000002C142150000-0x000002C1421F3000-memory.dmp

Filesize
652KB

Download
memory/772-221-0x000002C142150000-0x000002C1421F3000-memory.dmp

Filesize
652KB

Download
memory/772-200-0x000002C142150000-0x000002C1421F3000-memory.dmp

Filesize
652KB

Download
memory/772-187-0x000002C142150000-0x000002C1421F3000-memory.dmp

Filesize
652KB

Download
memory/772-175-0x000002C142150000-0x000002C1421F3000-memory.dmp

Filesize
652KB

Download
memory/1832-148-0x000002D5E0200000-0x000002D5E02A3000-memory.dmp

Filesize
652KB

Download
memory/1832-174-0x000002D5E0200000-0x000002D5E02A3000-memory.dmp

Filesize
652KB

Download
memory/2020-33-0x00007FFEF1E30000-0x00007FFEF1E31000-memory.dmp

Filesize
4KB

Download
memory/2020-147-0x00000240EAAD0000-0x00000240EAB73000-memory.dmp

Filesize
652KB

Download
memory/2020-170-0x00000240EAAD0000-0x00000240EAB73000-memory.dmp

Filesize
652KB

Download
memory/2020-395-0x00000240EAAD0000-0x00000240EAB73000-memory.dmp

Filesize
652KB

Download
memory/2020-368-0x00000240EAAD0000-0x00000240EAB73000-memory.dmp

Filesize
652KB

Download
memory/2020-173-0x00000240EAAD0000-0x00000240EAB73000-memory.dmp

Filesize
652KB

Download
memory/2020-219-0x00000240EAAD0000-0x00000240EAB73000-memory.dmp

Filesize
652KB

Download
memory/3288-315-0x000001789A200000-0x000001789A2A3000-memory.dmp

Filesize
652KB

Download
memory/3452-267-0x000001EE49E00000-0x000001EE49EA3000-memory.dmp

Filesize
652KB

Download
memory/3672-22-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-10-0x00000243EA730000-0x00000243EA768000-memory.dmp

Filesize
224KB

Download
memory/3672-169-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-151-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-154-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-103-0x00000243F0C50000-0x00000243F1178000-memory.dmp

Filesize
5.2MB

Download
memory/3672-95-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-0-0x00007FFED1623000-0x00007FFED1625000-memory.dmp

Filesize
8KB

Download
memory/3672-155-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-20-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-13-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-12-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-9-0x00000243E7930000-0x00000243E7938000-memory.dmp

Filesize
32KB

Download
memory/3672-149-0x00007FFED1623000-0x00007FFED1625000-memory.dmp

Filesize
8KB

Download
memory/3672-11-0x00000243E7940000-0x00000243E794E000-memory.dmp

Filesize
56KB

Download
memory/3672-8-0x00000243EA6B0000-0x00000243EA724000-memory.dmp

Filesize
464KB

Download
memory/3672-7-0x00000243E78E0000-0x00000243E78EE000-memory.dmp

Filesize
56KB

Download
memory/3672-6-0x00000243EA770000-0x00000243EA82A000-memory.dmp

Filesize
744KB

Download
memory/3672-5-0x00000243E9BA0000-0x00000243EA4BE000-memory.dmp

Filesize
9.1MB

Download
memory/3672-4-0x00000243E9AB0000-0x00000243E9B00000-memory.dmp

Filesize
320KB

Download
memory/3672-3-0x00000243E9180000-0x00000243E91C0000-memory.dmp

Filesize
256KB

Download
memory/3672-2-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3672-1-0x00000243E6B80000-0x00000243E7446000-memory.dmp

Filesize
8.8MB

Download
memory/3672-168-0x00007FFED1620000-0x00007FFED20E2000-memory.dmp

Filesize
10.8MB

Download
memory/3904-392-0x00000293A7A00000-0x00000293A7AA3000-memory.dmp

Filesize
652KB

Download
memory/4484-240-0x0000020D02320000-0x0000020D023C3000-memory.dmp

Filesize
652KB

Download