36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Size 4.6MB
Sample260527-scqddsg16k
SHA256 36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a
MD5 501a468759edaa435b31de9324bb2566
SHA1 3626251071aa6e21d7fd9ecae82efa2e86fc5c3c
SHA512 3968f8f33b68f8ae80aca53d6e5d915f16e83bf1651dc584a10b6d8266c9e527e1cebd46f34b6b732290674140f3a719ac9a5cf065e693429f57601276c3759f
SSDEEP 49152:rudaZRrSlf/qHkhySxZvv17QK+mrvGH5MFAUym0HmG6Nf3:Kdeyf4kdQK+mrvFFAUyk93
TLSH
T11D266C137388613FE06B5E3A983BDB50583FB66825138C4BA7F40A5C8E763416D2E767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
95	2324	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
106	2168	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Loads dropped DLL 2 IoCs

pid	Process
2168	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
2168	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
107	api.ipify.org
108	api.ipify.org
109	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243676756337056"	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\AppUserModelId	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe,0"	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2324	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
2324	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
2168	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
2168	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
956	msedgewebview2.exe
220	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	2324	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 956	2168	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe	109
PID 2168 wrote to memory of 220	2168	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe	110
PID 220 wrote to memory of 1768	220	msedgewebview2.exe	111
PID 956 wrote to memory of 748	956	msedgewebview2.exe	112
PID 220 wrote to memory of 4520	220	msedgewebview2.exe	113
PID 220 wrote to memory of 4520	220	msedgewebview2.exe	113
PID 220 wrote to memory of 4520	220	msedgewebview2.exe	113
PID 956 wrote to memory of 3884	956	msedgewebview2.exe	114
PID 956 wrote to memory of 3884	956	msedgewebview2.exe	114
PID 956 wrote to memory of 3884	956	msedgewebview2.exe	114
PID 220 wrote to memory of 3628	220	msedgewebview2.exe	115
PID 956 wrote to memory of 4900	956	msedgewebview2.exe	116
PID 220 wrote to memory of 2424	220	msedgewebview2.exe	117
PID 220 wrote to memory of 2424	220	msedgewebview2.exe	117
PID 956 wrote to memory of 4896	956	msedgewebview2.exe	118
PID 956 wrote to memory of 4896	956	msedgewebview2.exe	118
PID 220 wrote to memory of 1056	220	msedgewebview2.exe	119
PID 220 wrote to memory of 1056	220	msedgewebview2.exe	119
PID 220 wrote to memory of 1056	220	msedgewebview2.exe	119
PID 956 wrote to memory of 3684	956	msedgewebview2.exe	120
PID 956 wrote to memory of 3684	956	msedgewebview2.exe	120
PID 956 wrote to memory of 3684	956	msedgewebview2.exe	120

C:\Users\Admin\AppData\Local\Temp\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
"C:\Users\Admin\AppData\Local\Temp\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324
- C:\Users\Admin\AppData\Local\Temp\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
  "C:\Users\Admin\AppData\Local\Temp\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe" --uiaccess
  2⤵
  - Downloads MZ/PE file
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2168.716.16041719246474519445
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffa49dbb078,0x7ffa49dbb084,0x7ffa49dbb090
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,11000431222958024218,4146241651239898663,262144 --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,11000431222958024218,4146241651239898663,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,11000431222958024218,4146241651239898663,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3732,i,11000431222958024218,4146241651239898663,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
      4⤵
      PID:3684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2168.716.107661227900553415
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0xfc,0x7ffa49dbb078,0x7ffa49dbb084,0x7ffa49dbb090
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1756,i,2279510643935075906,16449211636237132057,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1900,i,2279510643935075906,16449211636237132057,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1672,i,2279510643935075906,16449211636237132057,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:8
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3712,i,2279510643935075906,16449211636237132057,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fcff60ac592f4a68f54cec2f13575c82693992bac0c1fec91c96dc1e8b436042
MD5 98ef8a8f74882978fbd90a1a2aed0a5c
SHA1 17b0a83f202ee751ad3f51ab2ea72374880b252b
SHA512 1b084886b16b27bcf3582737d4eb6e7bcf1940375affef4efef292dd4878ed8f6fd8c0538b66334d090f96dd46f8aa09745e25f919e3a79b1f9e0f2b2d8fd608
TLSH
T1A241D65876EA1148B3B36F56ABF7A4AE487BBD372E06D55E10010E4E0A63B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\WebView2Loader.dll
Size 113KB
SHA256 cd2f07e47e98e52472bd744912edc9e9e645b544f5e612e2f38f89b7acb1e064
MD5 25473edbafc8f33413bcb284d79d30ff
SHA1 f64da5ddb853c4275a3da0cb6036216d93decb25
SHA512 8589ef4175d674a623b9d0b44dbf357417610eecb939fb494bad32f04c25fcf51855545eb25187266ead60d7cd72dd7f212f6019d4055d2e88d746bfbe8b5980
SSDEEP 3072:wnbFYqJx7sXRq2KVs9iiamgqeNZPTn7EtJlAlH5bgf4fmFf:wZYqJx4gkYiabEtJe9K2mV
TLSH
T1B0B35B5176D08072E5BE0A380874DB755B3F79A0DFA09DEB67841AA94F317C08E35E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

turbojpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\turbojpeg.dll
Size 856KB
SHA256 206d0de2fe74165879efc47a5bd0ed6dbb1379320f6531e03e77e1ab77de9b08
MD5 056c45d9c1b7da428fd39d9d03e83029
SHA1 e31480f1dcb4e8378bafb5f38b6574073a512f79
SHA512 4652ac610d9fb525458bb47820c44ffd90346ab4774235f134174607b87c0995d520e2acb0c268d7f5a89a2483d9d63c8c44cdd54964ea929d8215f05d618f75
SSDEEP 24576:Qfu4I/0UCTaRJpZKxVSd+IwR28nmUQc4gaF8mGbe:QfgC7xV6AlnWD82
TLSH
T1E8154B42B2929D92CBC50071CC6AE3B56B393E2D5BF385F3B190BB5DB8306D27935285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 817f61b9f43c29496ce743242bb74d7a0538cb200ff83e2d3df2e7743c6bd2d3
MD5 84f4aa2af4ca62b06fcdafcda8db6623
SHA1 f283098467904159ce2152ebf2beb40db603d511
SHA512 fd88cebd787ae2d6df7c65628477f38dc15e0f9a1d1b9ceaebb080df1d55211dfad39d1d555bcccfa8544aee5bd18ca3bc5bdb4bc26f5a214bd9f9d98edbeea1
TLSH
T138D01222BB811634C01021B312D3654CD800C10F400640046C28951D1A484740912C51
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f54d670c42a6dfb54ad37cc272b8498e2dbbf178acd7109281f36c82119b21ef
MD5 748f52e4f49aac09c26a97f337bc14ca
SHA1 fc5ba867cb8418a603f37bccf718a5252e6d755f
SHA512 f611e0e37bb387331e508a7f8fdb9878002d3bad197e3c2aa85aeb8c425b9e4afebefc59d19f166d259ca77646ee75cc6c5aa78f37dc2e95d65bb00061b9e6f3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 03953924a17723e7687335004df085140af785b133dced23a694e671e4ec06d8
MD5 b50aac1b5994d638b4999c2af9505a34
SHA1 8aac94c75a7a0a26be8af27c5cef7599680ff4a3
SHA512 f1e1564195876b765002c7bedd34fd7d973bea5ee1f6e8ceb2e55f383149d83d538994f867ced94f505d4b25fbfb94bd61afc34c539042de6229807519b573f9
SSDEEP 3:LstlNllkll/l6fPp/l:LsX3lEt6fR/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 1KB
SHA256 1b676811afac5b1a45801c3d2d00703aa74a870a99d5b5556c5fab6303dd9c17
MD5 d15934de966eec773eef7bcac7d47f9c
SHA1 ade79d8389735a0fea5e670b0a92b27793d4310e
SHA512 189f5a2eea8c02f6447e1c603d66de7b03cfb6ea7696698137f32323f963053e71dad22578aa6e3f71e3f688f0cf73036504c2671b5b612b53f59e3b82269f1c
TLSH
T115316772B45C5F32A8C669D1B545FE471E212116C2954E4861EE4F0512E718CB12AC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 2KB
SHA256 0d1d60a47e13a886436e793c0a0801e91e0f7fd5af8c5b5583e8f1a39159ef3d
MD5 72010a67d3313d68257e79c5f8acac86
SHA1 f1b40bfc8a2137adf8cd8cb241fb83f42a1c30ec
SHA512 e44a7bfffd0b85233d594c0aa244d9958f2fe66fa9ae6fe99154b2432bb962ba07d89bebfa6f1f090204bc61fb05e9cc8986e158ed1da3213dd980a85c155b07
TLSH
T1C7519633780CAB3789D39D94BD4ABF136B366156969A1F5465ED0F0801DB25C3306C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 15KB
SHA256 cfe4f723abacefd22904b7af963fb2b556b06d43da78008a5884fae01687e77d
MD5 dcee9e559f39b281ab8a54091a66f118
SHA1 0f5d28539b470a219a25a733d684a9f99bd9f25f
SHA512 99221b9051ac3c1d4c6075e8ff6f14866b980556d95a4e0c23a861d44c63e40abf87bc9f844a8fb059f8ced4b4abfd5e05b2ccfa87413640f92fd83bccb8363f
SSDEEP 384:zlsr8vAVy7dG5UI6limIfB8pNbIYEy0JVW+U:Or84y74GVll0JlU
TLSH
T14472BF31B1385F2A8CD3ED01FD0A9A1A7E78468AC5CB1FB895EC5F0A43972D91352D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 3KB
SHA256 9ccb2b1eead9c7eea192e0c83c8cfee67dba4659085bff4f3a5a5740e14c9ca1
MD5 1f293862df4544e144e505a8bb9ee009
SHA1 32da2be82e201152b05052e988c9fb7874d78db1
SHA512 e44670fa9dad1170850099dc990f2ee7d19aab97fb7ebd2108f85eadaaca893c0b6354f05c6ab42d2e3d2780a98449ad1b2c570662eaa25fc9a18c8eaeed5e05
TLSH
T1837173227968AA378DE3AD50B88A6F0677652127D1D92FA8D5ED0F0D01DB2982342C16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a013a.TMP

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State~RFe5a013a.TMP
Size 1KB
SHA256 68f9e7f5bfad636e97f48102d8b3024642b6ad8be7aa3e4bdf282002fd1fa3ad
MD5 3f4f6e877133b8b6b5fb541ff68f904d
SHA1 898aacda49a79a4106856baa7910143d68015dc0
SHA512 a9fd926a040f77fc9a89ea0a6262fa06ec86c63fa77e52ce97e705c68947a69a65706a72d7a8c848b9547dcbc4952748572c3786e0d94c2ee65d46502fca1066
TLSH
T1A8214533A49C6F32A4C65CE1B605FE472E51112A82994E1861DE4B05129B59CA23AC36
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3fe6689b5d5daa3a0dfea0669ae387659d52be5fb019edd3d268df9152d53e88
MD5 8562068ed11e6bb64300cb6f9a27b173
SHA1 bc41b1ce4c8dc7058f21ba63ad77dae183fb93bd
SHA512 529be1d3e5c46f3b4b70e2f63f126f80443a4b2295bdf5bfa33dae3f06458744a298157c106544a54d53d4d6516b6f166790ab0b4032922c270f39a7e382d9f3
TLSH
T1E8D0122376910138C11130330146F54C0502D10B400A40095839899E6A440600E03841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 daf9b7feaf7d97aa56a7611663d3f68e5717ad1db0e41efab3a53975af1b59a6
MD5 653940b09501a90f3f41463e201f6c01
SHA1 e7601c4bc69bbb745bd788eb68984a086fe256d3
SHA512 62037b7553f4ffee67ade6271b70db01bfadd2403b31ea2f3d4348e3a06876590cf4dfa7736969fe2fbf0b27ec43bbf26fcd9af7bebd6b2b48cfae7a7666a900
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 1KB
SHA256 60f0e7a88e2322acd67ed0cf58237c804e0966757f943abc1e2933395433c735
MD5 6700df38602cae44b3d32942d18c3186
SHA1 67871694057d1761bf129bbabc5412b36e875e99
SHA512 83a56884ae530bca36aa189d0f13ab8cc601efa5bebb845e88784919818e6dab466c65572eefff6eaedfd94647b6558f1d130cf8c6740656de84092db5105751
TLSH
T1AB3162B3B4582B369CD6AA017696FB572E32212BC2198E0861ED0B1801F77DC6126C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 2KB
SHA256 771ca2a7b22735eb13afae96913b47cefc2e9a0f994a3ce95c8ddd08c2d0d443
MD5 713f7e39e8dbd8251bdf70ce07e48ce3
SHA1 566b280dd1e9ce6cf35bcaf06e850d188a192052
SHA512 4c94e3d571b26e5315b3f4259c839c3acbfa617b1b1fe8c1088eac1d69200a258b2f1463e10b4ed01752b5d8490ace6c14298f26cff7f893a5166075a2c23c23
TLSH
T18251BA737818AB3B88D39E007D897F13AB366156D6591F5495DD0B0801EB79C2302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 3KB
SHA256 a1668df5c1d63f7f581560a6de4a39a055f612410c66d11a0b307ec669c27aaf
MD5 7f8b235a9517bbd9824c462dd8d5f65b
SHA1 0f9bf29f70c02c25e9b4294a06febaec2e7443e1
SHA512 5627bfc8efad93edd04ef95dc76ac783e0beccdc764c700de7ce554d306cc0eabdffd780232ea4d5b6ebc0223229c118375eb9e2cab081f14c4d43671c0bf343
TLSH
T1067187767868AA3B4DE2AD00BDC57B16B7655127E1992F58D9EC0F0D01D73D81312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 15KB
SHA256 08afa8a898646bb3db25f7fecdf52bd345722e56c0789dc1714c5bf5a2fd1e34
MD5 4be82069ff12d3437a4aa6f3235abf83
SHA1 ee4da28d79282d375f695154f79dae1181e285ad
SHA512 625d3777748f23a7fc5bdebc3e00cf00b1d4ad776e167e038150a022ddf601f214b1fab7fb0a32f8cd6cc9aa7ac5d30144ab3bc7d04a5696dda3fbd4656e1e5e
SSDEEP 384:zQsr8vAVy7dG5UI6limIfB8pNbO+nyth4JVWa5:Xr84y74GVidL4JB5
TLSH
T1A272BF35A0346F2E8CD2ED01FD0A9A1A7E78828BC5CA1F79D5EC5F0A43976D90352D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a013a.TMP

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State~RFe5a013a.TMP
Size 1KB
SHA256 8ba724cf91578b247e4596412cb0892c28373d38058d5b9d028507c29a7ec4e3
MD5 b06b574f5a1ac52a9b1245012186dbba
SHA1 41a4ecd4dcb89b34b4f4c6681decf595de9d267d
SHA512 f9aeeaee58436b0f9fa06e41f8f8af0a46e8b2ef23ad59bd3ff49f05c94a6a42dc3b7ed26d3a94b9c740934c4a650ee10f3e1490fb9437cc50c9c351a8a49ece
TLSH
T1902142B3E45C7B76A8D56901B696FB4B1E60612B92188E0CA1DD071901EB6DC5137C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2168-21-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2168-459-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2168-23-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2168-424-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2168-22-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/2168-20-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/2168-462-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2324-1-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2324-19-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2324-2-0x0000000001970000-0x0000000001971000-memory.dmp

Download

memory/2324-10-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2324-8-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2324-4-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2324-3-0x00000000005C0000-0x0000000000A5C000-memory.dmp

Download

memory/2324-0-0x0000000001970000-0x0000000001971000-memory.dmp

Download

memory/2424-213-0x00007FFA66210000-0x00007FFA66211000-memory.dmp

Download

memory/2424-204-0x00007FFA67340000-0x00007FFA67341000-memory.dmp

Download

memory/3684-288-0x00007FFA66B40000-0x00007FFA66B41000-memory.dmp

Download

memory/3884-426-0x000001F185A60000-0x000001F185B8A000-memory.dmp

Download

memory/3884-85-0x00007FFA66B40000-0x00007FFA66B41000-memory.dmp

Download

memory/4520-425-0x000001FC2D860000-0x000001FC2D98A000-memory.dmp

Download