42fdc8c7e56b04936014f724b5ca1ccecdc1fa15efc1cc7e1c4e2fd0d817e21a

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
asure-live.exe
Size 14.0MB
Sample260517-ajx3psev9m
SHA256 42fdc8c7e56b04936014f724b5ca1ccecdc1fa15efc1cc7e1c4e2fd0d817e21a
MD5 930308ab61db3683830be099f691a67a
SHA1 cde664106a50d83d23e08fe613de969f88793f25
SHA512 cb1a1a48bdf6e6314ef315dabdf327514226fa8b8853169cba00137977f7552768f2b324bb81091264372997da0053612ccb2280ba0d4e7641443bbb577cce88
SSDEEP 196608:MmcKHw3ZshmqzPzfOFbm/iiKIs5mOLkcIG:/4ZshmqzPzfOFbmKITOLkc5
TLSH
T1F9E6F7217B5B99ACD09AC47483478A764A7130DB0B35B9FF449492383F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	asure-live.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237314000216980"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2552	msedgewebview2.exe
2552	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3332	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4240	wmic.exe
Token: SeSecurityPrivilege	4240	wmic.exe
Token: SeTakeOwnershipPrivilege	4240	wmic.exe
Token: SeLoadDriverPrivilege	4240	wmic.exe
Token: SeSystemProfilePrivilege	4240	wmic.exe
Token: SeSystemtimePrivilege	4240	wmic.exe
Token: SeProfSingleProcessPrivilege	4240	wmic.exe
Token: SeIncBasePriorityPrivilege	4240	wmic.exe
Token: SeCreatePagefilePrivilege	4240	wmic.exe
Token: SeBackupPrivilege	4240	wmic.exe
Token: SeRestorePrivilege	4240	wmic.exe
Token: SeShutdownPrivilege	4240	wmic.exe
Token: SeDebugPrivilege	4240	wmic.exe
Token: SeSystemEnvironmentPrivilege	4240	wmic.exe
Token: SeRemoteShutdownPrivilege	4240	wmic.exe
Token: SeUndockPrivilege	4240	wmic.exe
Token: SeManageVolumePrivilege	4240	wmic.exe
Token: 33	4240	wmic.exe
Token: 34	4240	wmic.exe
Token: 35	4240	wmic.exe
Token: 36	4240	wmic.exe
Token: SeIncreaseQuotaPrivilege	4240	wmic.exe
Token: SeSecurityPrivilege	4240	wmic.exe
Token: SeTakeOwnershipPrivilege	4240	wmic.exe
Token: SeLoadDriverPrivilege	4240	wmic.exe
Token: SeSystemProfilePrivilege	4240	wmic.exe
Token: SeSystemtimePrivilege	4240	wmic.exe
Token: SeProfSingleProcessPrivilege	4240	wmic.exe
Token: SeIncBasePriorityPrivilege	4240	wmic.exe
Token: SeCreatePagefilePrivilege	4240	wmic.exe
Token: SeBackupPrivilege	4240	wmic.exe
Token: SeRestorePrivilege	4240	wmic.exe
Token: SeShutdownPrivilege	4240	wmic.exe
Token: SeDebugPrivilege	4240	wmic.exe
Token: SeSystemEnvironmentPrivilege	4240	wmic.exe
Token: SeRemoteShutdownPrivilege	4240	wmic.exe
Token: SeUndockPrivilege	4240	wmic.exe
Token: SeManageVolumePrivilege	4240	wmic.exe
Token: 33	4240	wmic.exe
Token: 34	4240	wmic.exe
Token: 35	4240	wmic.exe
Token: 36	4240	wmic.exe
Token: SeIncreaseQuotaPrivilege	3864	wmic.exe
Token: SeSecurityPrivilege	3864	wmic.exe
Token: SeTakeOwnershipPrivilege	3864	wmic.exe
Token: SeLoadDriverPrivilege	3864	wmic.exe
Token: SeSystemProfilePrivilege	3864	wmic.exe
Token: SeSystemtimePrivilege	3864	wmic.exe
Token: SeProfSingleProcessPrivilege	3864	wmic.exe
Token: SeIncBasePriorityPrivilege	3864	wmic.exe
Token: SeCreatePagefilePrivilege	3864	wmic.exe
Token: SeBackupPrivilege	3864	wmic.exe
Token: SeRestorePrivilege	3864	wmic.exe
Token: SeShutdownPrivilege	3864	wmic.exe
Token: SeDebugPrivilege	3864	wmic.exe
Token: SeSystemEnvironmentPrivilege	3864	wmic.exe
Token: SeRemoteShutdownPrivilege	3864	wmic.exe
Token: SeUndockPrivilege	3864	wmic.exe
Token: SeManageVolumePrivilege	3864	wmic.exe
Token: 33	3864	wmic.exe
Token: 34	3864	wmic.exe
Token: 35	3864	wmic.exe
Token: 36	3864	wmic.exe
Token: SeIncreaseQuotaPrivilege	3864	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	asure-live.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 3332	1876	asure-live.exe	87
PID 3332 wrote to memory of 3344	3332	msedgewebview2.exe	88
PID 3332 wrote to memory of 60	3332	msedgewebview2.exe	89
PID 3332 wrote to memory of 60	3332	msedgewebview2.exe	89
PID 3332 wrote to memory of 60	3332	msedgewebview2.exe	89
PID 3332 wrote to memory of 4856	3332	msedgewebview2.exe	90
PID 3332 wrote to memory of 5020	3332	msedgewebview2.exe	91
PID 3332 wrote to memory of 5020	3332	msedgewebview2.exe	91
PID 3332 wrote to memory of 2360	3332	msedgewebview2.exe	92
PID 3332 wrote to memory of 2360	3332	msedgewebview2.exe	92
PID 3332 wrote to memory of 2360	3332	msedgewebview2.exe	92
PID 1876 wrote to memory of 4240	1876	asure-live.exe	93
PID 1876 wrote to memory of 3864	1876	asure-live.exe	98
PID 3332 wrote to memory of 2552	3332	msedgewebview2.exe	107

C:\Users\Admin\AppData\Local\Temp\asure-live.exe
"C:\Users\Admin\AppData\Local\Temp\asure-live.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=asure-live.exe --webview-exe-version=0.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1876.3368.10981143813407920049
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fffe7b2b078,0x7fffe7b2b084,0x7fffe7b2b090
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView" --webview-exe-name=asure-live.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,5488220524031061397,5027623951479716870,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView" --webview-exe-name=asure-live.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,5488220524031061397,5027623951479716870,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView" --webview-exe-name=asure-live.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,5488220524031061397,5027623951479716870,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView" --webview-exe-name=asure-live.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3660,i,5488220524031061397,5027623951479716870,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView" --webview-exe-name=asure-live.exe --webview-exe-version=0.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4456,i,5488220524031061397,5027623951479716870,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2552
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name=\"asure-live.exe\" CALL setpriority "\"high priority\""
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4240
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name=\"asure-live.exe\" CALL setpriority "\"high priority\""
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 431b4f9c22eafcd0b404fb1b85a66326a5324ec4b5d370e18b5207d4652d6c87
MD5 670b106f20a84d59b288b3677f0d1eb6
SHA1 020c1563d2e3d7bb18a7a8da7a345e1aced5dd92
SHA512 8821cf0a7805e3b6058678524ae699931ef24f4bcec0666bd3446d29ba8fc2d6b434845c8a842b4888c1855b6c3d150fed4292dfb8197773116833c88c063edd
TLSH
T1ABD0121632414234D42020330012B10C2C01E10B40CD4148743C972E5A140500D03491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 265fc3cff7c4ed99b2a49a18df5d2e45d5a6cff6b74a08c40ac197306caca461
MD5 977de102c6b5675a392597fefc2e4f90
SHA1 a17b7395f8d72d75b1de7724def686464c827fc7
SHA512 4cf812325421a461b1a7454be56d3b61da070980ef87d98cc5fb5fa7d133a2d1d8f76906525841d93d9eb5459b10e2e10ddea33c9fc8bb1c28df4a6685dc0110
TLSH
T12CD0041451404110F45450330034D11C3D01744114DD075C3174131D44501000443050
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7f5511d1c75dbd978053c11b3ac5aefd879f05cccf0c4ff72d04e96ff798e5a9
MD5 0347e8c8311e8d1987d4ffb2c8eda5b2
SHA1 7135b72e404c2f2df1bd1e64b580339ff11af1b5
SHA512 b51c1e4a90ed6ad4e0eefbe99868f6cb5ac430e85c377d1d1f9f0bf18ffa0644d2442c8d27052522549d0e6a70a2e3246f82d06d361be5724eb07389718a23d6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 c26ce2cc5c96d9aa14e1e52f47594b9e58a2e809c0f50bb869373e6f806de55b
MD5 06c4d770af5eec8b4bb9af6a42d9e724
SHA1 8d4db068ee1ae2a3c705753ea27646db10f4ec31
SHA512 ffe1864a8cdc1f1cce3a1532946b22286493a0dc778b058b5dccbc8ee2a6fbfe5e4809bc8391ef755daa7b37fafaaca1941741e994b4e1bd9a9a404222a91640
TLSH
T19CF0E535A4C0580DEF313A7587CC5C7072FA5933150BABCB92A32735593BBC94521474
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Network\Network Persistent State
Size 358B
SHA256 a8642a938fa60e54a4b5f50bdc854b077ddac1099a87fcf90428c468145bed60
MD5 6d507d6219f35ccd7914e7edf84a8394
SHA1 ea480110452300fc61eebb03ac7b73afcb37d1d7
SHA512 5aa7714584a01bba5e9219748e9eef0133d4a57aec4f7f34a482faace4283e3cdb62273310a44fdc38876172c103bba380ca9b5b1e72b6268ad30a3489dff3df
TLSH
T1A9E0D1B64270686DCB9292F01514A91BCF6F0417171C5979C5F06F154775574D104B07
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5957ab.TMP

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Network\Network Persistent State~RFe5957ab.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 be7753e25c2ff87d7ca896ea484b25d30a04c5280eaeda7915226bf4cf263c0c
MD5 470469bb7c1ea0661d4104a447241ca8
SHA1 26d77f9300ae35009d015a99d1e60060a8225ed0
SHA512 66638d738d58a8208da302c03e04878f626772b5247a1b6afa1d32a8fb29d749b31c35febe2e357dc644927b57b26796d935a21e4bc3a2dd7ddb3457bc302ef0
TLSH
T11FE068A3407BA0BA102886950B44BA08DF37E13421C2A0E8DEA2806D60480B6511B472
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58ddd8.TMP

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Network\TransportSecurity~RFe58ddd8.TMP
Size 356B
SHA256 2a7ece707a6ab17ab2dc4cf762c62dbf1a8b9b70232abd3713d1befdab525b1c
MD5 10bfed69f798f551ec8a30b9caadfa21
SHA1 5af107e03ab366f4a1009ab2a5a8845abc0c5a96
SHA512 1de21892a2da94ec9193c705b12a2a8af299f699633c9157f6e6f64f94ae08edc3874104e6812d04f40e959c3eb679a0216e1ef8dde08dab714baae5889871bd
TLSH
T169E0C0E3417FB06F102885550E44BE08DE36F13830D1A0F8DFE2446D704D0B711275B2
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 b1cca3e3764c8173bd91b65f889f2945455796e41be98f2d40699e3b61415fca
MD5 25c1d8cf226bfb3c8f17c8466551a257
SHA1 b25f4c92f2e3210e096495f048184efb9383dd0f
SHA512 4e84278e0fe3e9953edd63bf7ad9112e59bccc5bb3f3330bb23fbff41b2e8fa13bb1a39644ff6c569b69497376a8bc2f549691340fdf6653313713442851a57d
SSDEEP 96:stm05l3mVb9uffzZ8i0vhElkXLcJm/7qx+WVHMSm+uecBAY1idQjE+gRPMOB:stm07tfrZ8paZM/S+WifAYwdpTPMC
TLSH
T124E1A6035E286D778CC7F2197A35BB16F2FA106266D40E58ABFC861C08E66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58dffb.TMP

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Preferences~RFe58dffb.TMP
Size 6KB
SHA256 e0de364863cc133c1f5a4e1f4a5de3a733241bd41bb6012c665de46a7546cfd8
MD5 1fb46cdfb0a17622a21a41ec541ba744
SHA1 fe7ac4da415c4f13a0a20befd08620aa3b35cbe2
SHA512 d5bc4099215ec5ad902cd73bef115726ce86cd9d86aa627429166a767e8048a2090348c24b7c0740b9fa78461cc8345f3b8fdccf0e67678da123b443585c1d09
SSDEEP 96:stm05l3mVb9bffzZ8i0vhElkXLcJm/7qx+WVHMSm+uecBAY1idQjE+gDPMEB:stm07kfrZ8paZM/S+WifAYwdpVPM8
TLSH
T159D1A7035E2869774CC7F3197B35FB56E2FA106266D40E58AFFC861C08E66DC521790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Local State
Size 2KB
SHA256 81cf6aa1c5be191528e4ec7bf344191c47af78e870698136ba5b964c9937410e
MD5 4b726e2e7f2f584de61ebee92d349628
SHA1 786cd03a43b350ec2fef35b3155a07fefb01afa5
SHA512 49167d9908748c9e9ddf10e16fcf147747c239354f7e7c12062692787a30e9fe89f22394fb50ee27ba6eeab2cccc19922bc88a8cc7cbb80102a63fcd8b240d81
TLSH
T1BC519433B848AB338DE25609BA0A3B136F3550E597912F5199ED0B0801DB59C2712C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Local State
Size 3KB
SHA256 8e56117f1cf1a0b6e673b7e7fb751280625c257116deab5dab33746ef27d69b8
MD5 9ef4a1191334a9df6918393c87ddaa6b
SHA1 109d639856eb27412d26a95b3f54f2c9d63c92ee
SHA512 07bb34b5cb7f309bf753c8b2b358983a9edb71948eb5cc8a90b4b0249d140b078687f85df90a993e3fa17b179e1a03688a85b58babf7c730378a513d3d038e48
TLSH
T13771B633A9A8AA374DF39905B9863B177B615067D2C13F95D9ED0F0C01DB2D81352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Local State
Size 16KB
SHA256 50e2fc6303744d8532f872520c224dff90d5d9a4d3c5298c02413059efb640f2
MD5 13f1257ee44bc21b253fd1895766e875
SHA1 6a7adb059e0b0091a2d4d23c9bcce9ec1f609437
SHA512 66b01399e0fd57945cb1d61aaaa228adbd44edfb2870ad1fff6f9fd64c379ba74d217839a58557ddd3e59e7c80618b7fa1491884dac8488570858b7efeb4683c
SSDEEP 384:zRvsrvyOiyp4+IWA1eUVWGfvvLgNb/vOP/6XJVTo4t:V0raxyp4sQe6WGfvi+iXJ1T
TLSH
T12C72AEB116B45A3B8CE6B84BBC8A291B7FD548A6DAC11F94B5E19F0F014B1CC1B06D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Local State
Size 1KB
SHA256 d53800c7293aef9165f00e8e9ff30849f61839325044be887e0dab1e2a3e3ff7
MD5 1e8aad648d54c9f0425bff137da4ecf0
SHA1 4be5c2eb2384ea3ffb4f7f21da1fae0d4ea7b780
SHA512 7d315767607337b1c52474c3fc8747bd03aaddb7b5a4f19bc339e9af07107f190dd6f9ae6cc548737c076d8808b82cfe26025b2dd149eb2777fda466ad283fc5
TLSH
T183317773F4942F32ACA6560BB24679573F2150E783519F4169DE0B1802EB5DC9A3AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5840cd.TMP

Path C:\Users\Admin\AppData\Local\live.asure.desktop\EBWebView\Local State~RFe5840cd.TMP
Size 1KB
SHA256 596cecaf67734407687251356edfe64cf1376a1fadd2f0fcc431ff191b3bc0c3
MD5 3bdbc49c8f23a86290956bea9d7a03f2
SHA1 c6a8203eb2dc5051ab02a44c4f74bac568ea26dd
SHA512 2742cba7881dd1586d087a1e76d525ff9db607423008a3f92d5f9a69f1a6ce06c2d22a28162b5f75159f4626f4fcce1563e717f7549d9c2c2c9c1af306a5d667
TLSH
T1B5218473E4986F32AC65450AB202B64B3F5050EA93509F05A9DE071803EF4D89B3BC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/60-288-0x0000015BE1860000-0x0000015BE198A000-memory.dmp

Download

memory/60-25-0x00007FF8046B0000-0x00007FF8046B1000-memory.dmp

Download

memory/2360-117-0x00007FF8046B0000-0x00007FF8046B1000-memory.dmp

Download

memory/2552-376-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/2552-366-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/2552-368-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/2552-367-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/2552-372-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/2552-378-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/2552-377-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/2552-375-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/2552-374-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/2552-373-0x000001FB456F0000-0x000001FB456F1000-memory.dmp

Download

memory/5020-48-0x00007FF803E80000-0x00007FF803E81000-memory.dmp

Download

memory/5020-47-0x00007FF8030A0000-0x00007FF8030A1000-memory.dmp

Download