36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Size 4.6MB
Sample260527-scqddsg16k
SHA256 36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a
MD5 501a468759edaa435b31de9324bb2566
SHA1 3626251071aa6e21d7fd9ecae82efa2e86fc5c3c
SHA512 3968f8f33b68f8ae80aca53d6e5d915f16e83bf1651dc584a10b6d8266c9e527e1cebd46f34b6b732290674140f3a719ac9a5cf065e693429f57601276c3759f
SSDEEP 49152:rudaZRrSlf/qHkhySxZvv17QK+mrvGH5MFAUym0HmG6Nf3:Kdeyf4kdQK+mrvFFAUyk93
TLSH
T11D266C137388613FE06B5E3A983BDB50583FB66825138C4BA7F40A5C8E763416D2E767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2916	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
2916	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com
1	ip-api.com
1	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_982200150\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_9352280\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2188_1576333788\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_9352280\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_9352280\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_9352280\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2188_1576333788\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_982200150\protocols.json	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2188_730308155\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2188_730308155\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_9352280\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_982200150\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2188_730308155\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2188_1576333788\manifest.fingerprint	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243675967743300"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\AppUserModelId	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\AppUserModelId\KLRemota.Cliente.Notify.v2\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe,0"	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2080	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
2080	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
2916	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
2916	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2188	msedgewebview2.exe
984	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	2080	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 984	2916	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe	83
PID 2916 wrote to memory of 2188	2916	_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe	84
PID 984 wrote to memory of 3196	984	msedgewebview2.exe	85
PID 2188 wrote to memory of 2412	2188	msedgewebview2.exe	86
PID 2188 wrote to memory of 2392	2188	msedgewebview2.exe	87
PID 2188 wrote to memory of 2392	2188	msedgewebview2.exe	87
PID 2188 wrote to memory of 2392	2188	msedgewebview2.exe	87
PID 984 wrote to memory of 572	984	msedgewebview2.exe	88
PID 984 wrote to memory of 572	984	msedgewebview2.exe	88
PID 984 wrote to memory of 572	984	msedgewebview2.exe	88
PID 984 wrote to memory of 1500	984	msedgewebview2.exe	89
PID 2188 wrote to memory of 2084	2188	msedgewebview2.exe	90
PID 984 wrote to memory of 4984	984	msedgewebview2.exe	91
PID 984 wrote to memory of 4984	984	msedgewebview2.exe	91
PID 2188 wrote to memory of 4740	2188	msedgewebview2.exe	92
PID 2188 wrote to memory of 4740	2188	msedgewebview2.exe	92
PID 2188 wrote to memory of 4028	2188	msedgewebview2.exe	93
PID 2188 wrote to memory of 4028	2188	msedgewebview2.exe	93
PID 2188 wrote to memory of 4028	2188	msedgewebview2.exe	93
PID 984 wrote to memory of 2236	984	msedgewebview2.exe	94
PID 984 wrote to memory of 2236	984	msedgewebview2.exe	94
PID 984 wrote to memory of 2236	984	msedgewebview2.exe	94
PID 2188 wrote to memory of 3244	2188	msedgewebview2.exe	97
PID 2188 wrote to memory of 3244	2188	msedgewebview2.exe	97
PID 984 wrote to memory of 3240	984	msedgewebview2.exe	98
PID 984 wrote to memory of 3240	984	msedgewebview2.exe	98
PID 2188 wrote to memory of 1432	2188	msedgewebview2.exe	99
PID 2188 wrote to memory of 1432	2188	msedgewebview2.exe	99
PID 984 wrote to memory of 4108	984	msedgewebview2.exe	100
PID 984 wrote to memory of 4108	984	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
"C:\Users\Admin\AppData\Local\Temp\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080
- C:\Users\Admin\AppData\Local\Temp\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe
  "C:\Users\Admin\AppData\Local\Temp\_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe" --uiaccess
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2916.1120.14797468665606906320
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff97923b078,0x7ff97923b084,0x7ff97923b090
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,4648086484276985502,15854978312932670421,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,4648086484276985502,15854978312932670421,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2284,i,4648086484276985502,15854978312932670421,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3644,i,4648086484276985502,15854978312932670421,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2152,i,4648086484276985502,15854978312932670421,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,4648086484276985502,15854978312932670421,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
      4⤵
      PID:4108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2916.1120.5577328437172435028
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff97923b078,0x7ff97923b084,0x7ff97923b090
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1672,i,1011725786269685974,16777255782498513900,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,1011725786269685974,16777255782498513900,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2288,i,1011725786269685974,16777255782498513900,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3628,i,1011725786269685974,16777255782498513900,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2152,i,1011725786269685974,16777255782498513900,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:14
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView" --webview-exe-name=_36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=700,i,1011725786269685974,16777255782498513900,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:14
      4⤵
      PID:1432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\WebView2Loader.dll
Size 113KB
SHA256 cd2f07e47e98e52472bd744912edc9e9e645b544f5e612e2f38f89b7acb1e064
MD5 25473edbafc8f33413bcb284d79d30ff
SHA1 f64da5ddb853c4275a3da0cb6036216d93decb25
SHA512 8589ef4175d674a623b9d0b44dbf357417610eecb939fb494bad32f04c25fcf51855545eb25187266ead60d7cd72dd7f212f6019d4055d2e88d746bfbe8b5980
SSDEEP 3072:wnbFYqJx7sXRq2KVs9iiamgqeNZPTn7EtJlAlH5bgf4fmFf:wZYqJx4gkYiabEtJe9K2mV
TLSH
T1B0B35B5176D08072E5BE0A380874DB755B3F79A0DFA09DEB67841AA94F317C08E35E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

turbojpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\turbojpeg.dll
Size 856KB
SHA256 206d0de2fe74165879efc47a5bd0ed6dbb1379320f6531e03e77e1ab77de9b08
MD5 056c45d9c1b7da428fd39d9d03e83029
SHA1 e31480f1dcb4e8378bafb5f38b6574073a512f79
SHA512 4652ac610d9fb525458bb47820c44ffd90346ab4774235f134174607b87c0995d520e2acb0c268d7f5a89a2483d9d63c8c44cdd54964ea929d8215f05d618f75
SSDEEP 24576:Qfu4I/0UCTaRJpZKxVSd+IwR28nmUQc4gaF8mGbe:QfgC7xV6AlnWD82
TLSH
T1E8154B42B2929D92CBC50071CC6AE3B56B393E2D5BF385F3B190BB5DB8306D27935285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4a2db9815c1fd517cf65076191b4345552c80c208268f76adbb932b1570c8250
MD5 288020768e1dbfde26171775a7f247ee
SHA1 53f9d55cc3b21c109a1dfb2aabecf1b112a155c5
SHA512 8423f4ab93ed130f189542df6c734166e54c847f4454a5c20c086298ecc38a6c7ecf3df7f84006a4bc5a4656c1e985e09919b0bb7798a3221a8687dd1d24de89
TLSH
T11CD0121632150174C42030F3165261880900C23B414684016428DB1D1A482601B03441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3cd87ed9cd8d10b76c29a3f4baac6d91becf2d02d95198d00be2d2e1989ff1e5
MD5 1bbfe42400ff651c68a13429a7d328c3
SHA1 f2e2e5479b740d53116063b0105b88c590ff824c
SHA512 419a958dadd46c9e1efe7417fe942574ac02ce2275c850f3205b0f0ffe8eeb6f483d047092582799c1a922bacde96dbed3d6d16a98e26b663ea7acffa7708f06
MD5 SHA1 SHA512

Submit Download

96e947ee-3358-43a7-970f-65eeb2524a76.tmp

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Network\96e947ee-3358-43a7-970f-65eeb2524a76.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Preferences
Size 6KB
SHA256 5b19227db9b8d55a9ceac8734e8521a568299ceee4000ac47b44c6a20bae57a3
MD5 280b5be1e2940fae93ae06955e3f9573
SHA1 b82cd051b02ef1b38f3554ee824354262bb39cd9
SHA512 8a5b427f153274d37a123dcd324bbda8a6bdb87e20291b6dcbae44ec56abc681e93fb9927ee5bfe3a55865a13f0de3b1ddc6fd5997dac509744295a11d1c56a4
SSDEEP 96:stZ05k+wKb9pffBZ8i0vhEyklm/7qx+WVHMSm+uecadQjv+gyjMEB:stZ0CkfJZ8pak/S+Wi8daUjM8
TLSH
T161D197036F28A9774CC7E619BA35BB42D2FA102265D81E58EBFC871C08D66DC634790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Preferences
Size 6KB
SHA256 111659e5c86d73ed274f63e71b2f6f5026302047aeca4a618ceb0f82db6e01b7
MD5 8b0ce9daca6973198059f33e015d889d
SHA1 42874af7738c3dbf409540afcc9f4a5ca4701a0d
SHA512 0be9595215ce9310dfd4c795ad6a78cadfff995f6e45568cf3ed99c4e47060103d66f22a622811a2e4e2d569290a3821351589e2845affdc710eb50e616f9517
SSDEEP 96:stZ05k+wKb9BffBZ8i0vhEyklm/7qx+WVHMSm+uecadQjv+gGjMOB:stZ0CYfJZ8pak/S+Wi8dagjMC
TLSH
T1C0D1A8036F68A9774CC7F619BA35BB42E2FA502225D41E58EBFC871C09E65CD234790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 1KB
SHA256 acc8d2c3ef9e31e4bbb07367273911cf8cdb32effe6a97177ffe917c00598056
MD5 02646cee2054e0039083fefd92483a10
SHA1 7ada88ccd03094dd4f6288cf1acf2f7e05ca4270
SHA512 bec0c49ca2ffe206cbc1b71943ad5147a13eaf781e2e46d99b98446493636d20801f183316d41388aac06a581252a42257f984d91401496efecc4918a8ac0c42
TLSH
T1FF31A773E4A46F776CC0A906B5457BA3AE302177D2598E4861FD870C01D369CA227C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 2KB
SHA256 b8b311d97e05c4133ee639ef860996d1c71ebe977e15fd90ed7445d76103a72f
MD5 5c82eb195fc77df7fef03344b1c11e23
SHA1 8ec6f3e18f31f5b955288e68568e0f34fa05bc72
SHA512 9a7423e6a85dff1ced99a2521a732a88fec0124256db1513b3180fbdacac64cfa6ad4fe874c2988785d629f29c11fe0b6d1a98fef7fc7f0b33b17b268585bac1
TLSH
T12551B833B8689F778DE29904BC497F63EE3911629A591F5469FD0B0C01D766C2302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 3KB
SHA256 5ea8db91e50251b743ece0cb8c553e6e20d1b4142fb26210194a1f465c4c8ed7
MD5 0a76edaa4b4cfc396b165585eec1a61e
SHA1 7e4ec03814fc227a18c5d2ee63b7f332cdd175ac
SHA512 9b9d7ea966cd77196e780e60718e975cca757426acd5146cd642e576984705390c4a46d4cda3889c3cbf786c4e94f1b0fd7bd2f75c8f1ce0b25cd2d03f1caf23
TLSH
T139717427A978EA7B4DE29D04B8853B12B7751127E5997F98D9FC0F0C01D73982342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 3KB
SHA256 f08f1dd87ca8b3486881a30ed060dbfd915d508d551720386508b1cb236c01bc
MD5 ddf7985b4412737ba47b41531cb4db5a
SHA1 e586e6fdfa01dd658b37a05dc9213ba72d40dce2
SHA512 367719be6605cc6f72e341cb306f770b6ee7f3290aebee6fa0c5eee38221781323dc3634fe9bb52158686e2edc603eb698ab7ef3eeabcefbd7204f3d29c5b1bd
TLSH
T10C81A626A474DA774CE2E905B8853B13B6755137D5993F98DAFD0F0C01CB3982342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State
Size 14KB
SHA256 56203d2bb642e2f0f97d5f3e9c269734c82cf32869167da2125e07d7ffde442e
MD5 aaab0f067af3c6800b64d08c1fa5de97
SHA1 d0f28cd6a32de9e54ba92c1ac0fea5f4e30a0402
SHA512 01ab5ac952d6dbbb8defc087b0a461380fa0796f80410c7f5dc4479e17a996cdeacf6fe1abb44d7d7933a71cc4a21c7a4ec9b0c2710a26d69ceda1b53826fcb4
SSDEEP 384:zGsr8vAVy7dG5UI6limIfB8pNbZlNmKgSb:Vr84y74GV9m7Sb
TLSH
T19462AE317534AF2B4CD1DE01FC0A6616BD78425AC98A1FB999FC5B0C43D72DA1392D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58f652.TMP

Path C:\Users\Admin\AppData\Local\misge.WebView2A\EBWebView\Local State~RFe58f652.TMP
Size 1KB
SHA256 2462ea2ea35bf31266ab650dbf4ea245b0a284c2bb853341e2c176b61e9c5d1d
MD5 2832368d5a7b0d27debe94db9ca97cf2
SHA1 b165f19f47e558cbc3b7a7a0683e85a74ae1b38c
SHA512 332a5b211a2412b23c59612b0fa6d4461168456eef5ae011ba444e8f794c1b019c3aa1f880e154406314acf52800a5a8d8b5c10694295a47c240014207948e46
TLSH
T1A3216273D4A8AFBB6CC09805F512B7C76E60217692188E0C61ED830C01C35AC9267C77
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 33eb18f36988e1f536bc081083673908143842a3ae3808215b8404babfae8242
MD5 aa2fdb4c65e6fa3ed60300b2e8a9c73c
SHA1 0942b5ac217c441d786e720fbe86aa28bb894be1
SHA512 3646c659884cc0e376a37f69b85c26551d56773eee1fd2fb6b5f2b73ef92e7bf4558534fd256da3b45d5bee1b9a8d487ec565000023861a2d719552a22fd9406
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 43bd0eec5915f9584d383514d524fa4063de60a79fe58a6d14e53f2f5f060ebf
MD5 a7a805923812c41dd8d89e90337ee244
SHA1 a1d90c00a363e289e97a6cc04a9a8221599e1d3c
SHA512 8b8d0ace30008d832943edf3a7b156a6805f159ef98ee6caa453f765d685ecb907274fa74ebaaad5b2d6f1998946605a6c21e76d1cc499ac7f0d2b4d0c670e20
TLSH
T141D01216B3110234C01120330002620C1585C90F41858009D439D52D1E540A40E02882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 93094a9d6e6bdaad18fba9ebb1dec31b8adb61a8f9980e4f3be42528a3b16b0a
MD5 640cc8bd132e430b0a8b3c3852029d60
SHA1 2b7efa188ec3822fcdad979fdae018229939af8e
SHA512 987b7681974909dd10ce9bdc44cf12ed9f49df8f64e3fdb6423bd085e1c4e612b33001a7af06a653b8d4863c62a693df201ca7c35ee3d4619420110ea275d41b
SSDEEP 3:LstlNllkll/l8Tt:LsX3lEt8Tt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Preferences
Size 6KB
SHA256 ca4986d289a6960bfc76f7484f03d251550233f5b62d39af64d74675e4aac753
MD5 88b811651c02587e58b3b1fee0522ce0
SHA1 615a02704633a424445ba06225ff32e197b9e262
SHA512 f4a8f93238475cf5504a1207bc0f26b28b96d3f2ac62ae397cd35da931a4e395091f7f77de4d2a5e073c15ba97923a38f7fb8985fb8fc3009233f5c88819718f
SSDEEP 96:st805kT+/b9Wff6Z8i0vhE2klm/7qx+WVHMSm+uecadQjT+gme5MOB:st80CHfSZ8paY/S+Wi8duUe5MC
TLSH
T18FD197036E68A9774CC7F619BA35BB42E2F9602265D41E58EBFCC71C09E66CC530790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe599716.TMP

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Preferences~RFe599716.TMP
Size 6KB
SHA256 a512ad5a9df99bb9f49dec04187ce9ea5ab4d69b41a8ba3d11f2c87ac258e3ae
MD5 bfa41c76ca1927972a0683b0c148555d
SHA1 374d64bcf41c320d7863f81ee4cec45a257e47ee
SHA512 98afa278dc38f1561537752940cd615a6cb221d9f51d73be86be131a4b5554a70d7a8b40478a0769e2f12a2996bb16c5e09fabc5ebee49d2e2a060a2144d86ef
SSDEEP 96:st805kT+/b9nff6Z8i0vhE2klm/7qx+WVHMSm+uecadQjT+gmD5MEB:st80C6fSZ8paY/S+Wi8duUD5M8
TLSH
T115D198035F68A9774CC7E619BA35BB42D2FE106266D41E98EBFC861C08D66DC5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 1KB
SHA256 1b814decba5ece205c0995641af30c275db4a0ea04a9124e26a313c646d7ea93
MD5 235d7f0da0baa0670a64a77c06b6534d
SHA1 166f185740120773bfbd3f8998ddec0a344ecb30
SHA512 ce1bb671f717a891bbb1979d9410b056eee239de745098dadd0eea64913462babd5b27972594e3d594c6c627548814f73c9d487f24919d495ab464efe7418855
TLSH
T1673179B3A4946FB65CC2560FB786BB976F302035C2188E4876ED470901D75DC9635C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 2KB
SHA256 f21d61cc1cce65de6227f7bde7db9e5f100ce2e3dd20830c341a70d1f6a6cb26
MD5 9d0220a393b1377c7f6682bfa6ef3710
SHA1 433f07488546fd1f748deefc89423045996256b4
SHA512 c6e11fdbb27b2fdeddbbb1379d1849a0e2d588ab522480cf2eff41c8fca8ff56fc708f5713d5fa057fa9e1551def56e3ef8cd1fbc189501b4d0a3f71a836adc6
TLSH
T19251A7737858ABB78DD38A09BA8A7F23AF386061D7591F5479EC0B0C00DB55C2302C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 3KB
SHA256 76fd2edb0693f48ba31fc1188ee47998c0947d58a88543a8e359527a3b6e57db
MD5 dd91e6829fd7ce50f0446e0b562218e8
SHA1 481dbe78c4d7d722da49ef3f4e3fe9c115d88d57
SHA512 4ac78f0a2ed1d2321667049616aa29ef5bbcda66a7696bae87b4763c8f59d45a18dd8da18cd0b4fc0ba62ff31c2421f17ee6f7bced1e63e07303dda443ce7c9e
TLSH
T1E07196666964EA674DE29E05B9CA2F17BB741033D5982F98E9FC0F0D01D76981301C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State
Size 15KB
SHA256 3bb1152fa11809a799d8b957bd4c90e575c4bdb3f331c5133778f00fbfb183d9
MD5 4f3e80b3ac7126e2cc77754582d83513
SHA1 172d327bb1db23469e14af33826e370a3bdcda67
SHA512 2f1c9af4ba89087024047654e1b88b0e02a020020d512d9206d4ebe95f5a487c4cf24d3449db98f7305235c9c24ef332a7cd4c3acf5b93d3ddc9b7dac244e3f5
SSDEEP 384:z8sr8vAVy7dG5UI6limIfB8pNb4CYN/CJVOR:br84y74GVsFZCJoR
TLSH
T14772CF3264749F6A4CD2DD01FD0A6A1B7D78829AC98E0FB8E9FC5B0943CB1D90392D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58f652.TMP

Path C:\Users\Admin\AppData\Local\misge.WebView2B\EBWebView\Local State~RFe58f652.TMP
Size 1KB
SHA256 35be9e94838efc66797cb75cc452993e3fd7169d5827f66c2b642b3b25443e6f
MD5 cccc935045e8765e769d6be6fc908a04
SHA1 7f7a9ebee56da082afbaa524abeab06d15175b7a
SHA512 8fcae5756825a1ccd45ef8281e0f736b003b5e4393f3416d3bf7f21ef71101d60b061cd791482b7f6960a1e319b1b0a51f5c5b2269b322c2555d0ae386bbf242
TLSH
T1312162B394986BB6ACC6990EF382BB872F302035C21C8E48B2ED430901C759C8632C77
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2188_1576333788\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2188_730308155\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2188_730308155\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_9352280\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping984_9352280\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

memory/572-468-0x000001EA25C80000-0x000001EA26138000-memory.dmp

Download

memory/572-424-0x000001EA25C80000-0x000001EA26138000-memory.dmp

Download

memory/572-423-0x000001EA22E30000-0x000001EA231A8000-memory.dmp

Download

memory/2080-0-0x00000000018B0000-0x00000000018B1000-memory.dmp

Download

memory/2080-1-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2080-3-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2080-20-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2080-2-0x00000000018B0000-0x00000000018B1000-memory.dmp

Download

memory/2236-447-0x000002167C150000-0x000002167C4C8000-memory.dmp

Download

memory/2392-414-0x0000020AB5E70000-0x0000020AB6328000-memory.dmp

Download

memory/2392-466-0x0000020AB5E70000-0x0000020AB6328000-memory.dmp

Download

memory/2392-76-0x00007FF996A00000-0x00007FF996A01000-memory.dmp

Download

memory/2392-413-0x0000020AB3000000-0x0000020AB3378000-memory.dmp

Download

memory/2916-518-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-624-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-561-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-469-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-511-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-460-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-445-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-685-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-508-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-22-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-21-0x0000000001A00000-0x0000000001A01000-memory.dmp

Download

memory/2916-648-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/2916-276-0x0000000000900000-0x0000000000D9C000-memory.dmp

Download

memory/4028-253-0x00007FF996A00000-0x00007FF996A01000-memory.dmp

Download

memory/4028-446-0x0000029556E00000-0x0000029557178000-memory.dmp

Download