22cae23405ef1d6162fdbe9de167ed431e3585b748a38bda5f7ef1090c22087a

Resubmissions

22/11/2024, 17:33

241122-v4yj7a1jfk 8

20/11/2024, 13:26

241120-qpxl5axmh1 8

20/11/2024, 13:23

241120-qm63saxbkf 8

19/11/2024, 14:21

241119-rn7ldawray 8

Analysis

max time kernel
36s
max time network
41s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
19/11/2024, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DJAPPSTORE.exe
Size

1.4MB
MD5

6afc8290bc005d98203e4d28d1af8d06
SHA1

f145630a0f925865a0fb67f101b630e770f8029d
SHA256

90e14e6d711668b63a68e722abcffff1428fd82506411f1519fdd582c65d2929
SHA512

5fa0fae5d673d8735fed45ef75e1f950f8560c5d88d008ff50146643473d684a7db40eae4277eefb5f18ca87fd6e73da8ebc613711a0c4f529e5512f2e977d14
SSDEEP

3072:gKSaWbBpm3pm3pmcJdm6k8Kw2pmu64VwOAsbvjL357kuQ4wdXzsyP0ujm7pmzpR:b8byyn3mn8XEvVwOJjL357K90vS

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Deletes itself 1 IoCs

pid	Process
564	UpdInstaller.exe

Executes dropped EXE 2 IoCs

pid	Process
2836	DJAPPSTORE.exe
4564	DJAPPSTORE.exe

Loads dropped DLL 1 IoCs

pid	Process
4564	DJAPPSTORE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
6	raw.githubusercontent.com
10	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3076	msedgewebview2.exe
1524	msedgewebview2.exe
4060	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1592	msedgewebview2.exe
1592	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3140	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	DJAPPSTORE.exe
Token: SeDebugPrivilege	2836	DJAPPSTORE.exe
Token: SeDebugPrivilege	4564	DJAPPSTORE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3140	msedgewebview2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 564	1488	DJAPPSTORE.exe	80
PID 1488 wrote to memory of 564	1488	DJAPPSTORE.exe	80
PID 564 wrote to memory of 2836	564	UpdInstaller.exe	82
PID 564 wrote to memory of 2836	564	UpdInstaller.exe	82
PID 2836 wrote to memory of 3584	2836	DJAPPSTORE.exe	84
PID 2836 wrote to memory of 3584	2836	DJAPPSTORE.exe	84
PID 3584 wrote to memory of 4564	3584	UpdInstaller.exe	86
PID 3584 wrote to memory of 4564	3584	UpdInstaller.exe	86
PID 4564 wrote to memory of 3140	4564	DJAPPSTORE.exe	87
PID 4564 wrote to memory of 3140	4564	DJAPPSTORE.exe	87
PID 3140 wrote to memory of 5024	3140	msedgewebview2.exe	88
PID 3140 wrote to memory of 5024	3140	msedgewebview2.exe	88
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 3076	3140	msedgewebview2.exe	89
PID 3140 wrote to memory of 1592	3140	msedgewebview2.exe	90
PID 3140 wrote to memory of 1592	3140	msedgewebview2.exe	90
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91
PID 3140 wrote to memory of 1524	3140	msedgewebview2.exe	91

C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE.exe
"C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\UpdInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\UpdInstaller.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE.exe
    "C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\UpdInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\UpdInstaller.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4564
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=DJAPPSTORE.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=4564.4556.9689556934121178878
        6⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x114,0x7ffec1623cb8,0x7ffec1623cc8,0x7ffec1623cd8
        7⤵
        
        PID:5024
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1880,10224674013735724106,1277282351289165913,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView" --webview-exe-name=DJAPPSTORE.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3076
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,10224674013735724106,1277282351289165913,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView" --webview-exe-name=DJAPPSTORE.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2188 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1592
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,10224674013735724106,1277282351289165913,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView" --webview-exe-name=DJAPPSTORE.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2484 /prefetch:8
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1524
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1880,10224674013735724106,1277282351289165913,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView" --webview-exe-name=DJAPPSTORE.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\UpdInstaller.exe.log

Filesize
312B

MD5
94362876a82ea2b020cc31686fccce81

SHA1
54580aaf9e28b09ab7d65a166f4328767e143264

SHA256
a2fd92b60d00dc2281a0c8af75d76221e6e48d581e95213df4c715fd6fa0fe3f

SHA512
37b3ff098573bf00ab5e49a5fc3f66a2684691e28274282714f8137706b8aca5edd11fc50b1d8a0713e3897fe467c40d8ce60299d08b2376baf29c54f1a60687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DJAPPSTORE.exe.log

Filesize
1KB

MD5
3392533e5a911044c10543cfaf81cdcd

SHA1
7e2900a2a27fecbe81e59395690b0d8436421a4b

SHA256
b3f2d644973405253616e6aaffb35e19165c4369ba1828d82ce5c0c57c3868b5

SHA512
2c44cf950118637fc69a05e18004d7d1581e0177ab3aeb466ea533387b080cba4fd129f5493fb8ce3e14809185ddc1d916d8ee0cf99bcda9bc2258398c91127c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
c241e77cfecce096e24c0ee95e7b3a27

SHA1
4fd25a371965c12179b6bb953b224b5bc12c4164

SHA256
fdefd2db54a60fa2a734b4de10f6634d25f6e4b94dbd4bd88f51292aae46925d

SHA512
9df6a820d7ac10e65365f7506bfabbdf321915ac28cedf7fa578f35568748e1a91265de5dca723dbd77aa59d60d8d1eabde1345bf8933c0d99e60b0ca310a350

Download Submit
C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView\Crashpad\settings.dat

Filesize
152B

MD5
176e56f70a4715e3fa1e01b8877d14aa

SHA1
e762565d1c51bf5ecbe7c4a49c3dd3cc5a3e25bd

SHA256
1b5c54075ac303499f3ccc1ac0c465dcbb81ef93a227e81ff7959ca58803bee5

SHA512
28504410f0fb4b07ac33e1dd9a7e35d0caae8753d74508f8eb8896ef349617f3fccb4c6cfb25296fdbdc5a427505a9e18bb862cdfb89f6fe3fa7872baaa3fc90

Download Submit
C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DJAPPSTORE_WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.Web.WebView2.Core.dll

Filesize
581KB

MD5
3d9465d5161ac2ab5a83265935514349

SHA1
5d40047faf2a166e6c25f106c244b5826bd0aad9

SHA256
24d1f432632c971456e6db676f609772b98d0cf3d3a5450c78d3dbb75744399e

SHA512
8d84de25fcb88ad6786de9f077612d356eed8726a50e9b6c44a3dff456ca8a160e0707cd1902b52e4890f97f4a5a72466ac149e71d1e790267141a6710ecc70d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.Web.WebView2.WinForms.dll

Filesize
37KB

MD5
4b8bb9cd761a04f558e9b4a1a76be0bf

SHA1
0337e8418f1b991995b7adec1665a19f63e557a1

SHA256
c5a652cb75bcd84575347467c0647e6f66c207de40164d98f95ee8e6d4db6d57

SHA512
00168f4bf5455ea177730142b63ec5a4a6413acbeb965b8dd386631367e0be5c56117c0125552ea64f54c10395564206be585b31c93e441d9a357bae8ec7d261

Download Submit
C:\Users\Admin\AppData\Local\Temp\runtimes\win-x64\native\WebView2Loader.dll

Filesize
162KB

MD5
0ad9319fa14d39c0812583337546ca20

SHA1
0a76b27dc44f46756984a7a5f93f9a9b024aedb5

SHA256
1d963a02d8a7fa3e7eac2e936dad5559c4d63327f35b0a09787ffc1d58f9c18d

SHA512
01bfb6516ea8d2347863fdf6de7ce1bc598d0798a7a388a0b4478a8be4bad66362185f366ed52adb19008f518c05fbaedf46268051bbf26e448e23b017af669f

Download Submit
C:\Users\Admin\AppData\Local\Temp\upd.exe

Filesize
14KB

MD5
f849521ff0a196837245f07ec9dc78cf

SHA1
56d0ad8842db39e2ba4239d67f4cd4627e9de9e0

SHA256
6c33bceaea2cd113fce6d8bcbbf6250bf8eac05234b46ca3b4e91001386850cc

SHA512
1693a991ba8ebff536cdbebfe12826946e498d2940624ecedaf89c8cbbe254cf7faf1f636635701a7cfe98fdeb1816cbd547a0c5f7c1c8cd1a63bc47c76af33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\upd.exe

Filesize
2.4MB

MD5
48d5f00455ec070c131121961a59a16d

SHA1
008d2f477c74e274a340baf8e9a92e673131e538

SHA256
c8a252aa991c7dcd267905e81674795352e1c8424440b484482b815fa578ef34

SHA512
7054920812a33d739fb5d65f47181f68c00bb7c22f4ecacecc0d445da567147ae1088beb7754631d881a72b416d1c589ff56cd3da3e989ef65add262dff9021e

Download Submit
memory/564-19-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/564-25-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/564-21-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-10-0x000000001D670000-0x000000001D7AC000-memory.dmp

Filesize
1.2MB

Download
memory/1488-12-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-16-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-15-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-14-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-13-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-1-0x000000001BAC0000-0x000000001BB66000-memory.dmp

Filesize
664KB

Download
memory/1488-20-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-2-0x000000001C040000-0x000000001C50E000-memory.dmp

Filesize
4.8MB

Download
memory/1488-7-0x000000001C830000-0x000000001C87C000-memory.dmp

Filesize
304KB

Download
memory/1488-11-0x00007FFEC6765000-0x00007FFEC6766000-memory.dmp

Filesize
4KB

Download
memory/1488-0-0x00007FFEC6765000-0x00007FFEC6766000-memory.dmp

Filesize
4KB

Download
memory/1488-3-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-4-0x000000001C5D0000-0x000000001C66C000-memory.dmp

Filesize
624KB

Download
memory/1488-5-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-9-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-8-0x00007FFEC64B0000-0x00007FFEC6E51000-memory.dmp

Filesize
9.6MB

Download
memory/1488-6-0x0000000001360000-0x0000000001368000-memory.dmp

Filesize
32KB

Download
memory/2836-27-0x0000021683980000-0x000002168398A000-memory.dmp

Filesize
40KB

Download
memory/2836-31-0x000002169DC60000-0x000002169DC72000-memory.dmp

Filesize
72KB

Download
memory/2836-26-0x0000021683500000-0x000002168350A000-memory.dmp

Filesize
40KB

Download
memory/3076-79-0x00007FFEE6310000-0x00007FFEE6311000-memory.dmp

Filesize
4KB

Download
memory/4564-57-0x0000029F2CCA0000-0x0000029F2CCAE000-memory.dmp

Filesize
56KB

Download
memory/4564-59-0x0000029F2E2E0000-0x0000029F2E376000-memory.dmp

Filesize
600KB

Download
memory/4564-53-0x0000029F2E770000-0x0000029F2EC98000-memory.dmp

Filesize
5.2MB

Download
memory/4564-51-0x0000029F2CCD0000-0x0000029F2CE92000-memory.dmp

Filesize
1.8MB

Download
memory/4564-50-0x0000029F11150000-0x0000029F113B0000-memory.dmp

Filesize
2.4MB

Download