ba08e8d11aa2498e5a1fe842ce1c759c5c9eae713234fa5fc282fa47f7f74ad7

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
evon.exe
Size 9.5MB
Sample260623-spp86ady3q
SHA256 ba08e8d11aa2498e5a1fe842ce1c759c5c9eae713234fa5fc282fa47f7f74ad7
MD5 5ff255bc96e5cb94d802d6fe026ada92
SHA1 dbb6cc11329af7ae778b67403c28c164e1698db2
SHA512 638d8221d8b0f3e77dfea402d4c0d9c6342bf265d67743baf311023859a969031e197ba66a7b1a5e144efd7b7dc64a2ab2bf96e7001a597a3b1ef1ebb7be0430
SSDEEP 98304:UzWWZyi9MrRFsSsRn8nHIQlQsdud6Am9:ozZyi9MFUn8oQlD
TLSH
T17DA65C063F8999A9D48DCC74C2878AE70D2230EB1D36F5BF49DA052D2E796B85F1D318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	evon.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_339605117\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_339605117\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1474668412\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1474668412\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_339605117\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1474668412\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_420941274\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_420941274\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_420941274\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_339605117\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1474668412\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1474668412\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1474668412\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_420941274\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_420941274\_metadata\verified_contents.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1128	msedgewebview2.exe
1128	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1264	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4088	evon.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1264	4088	evon.exe	88
PID 1264 wrote to memory of 5624	1264	msedgewebview2.exe	89
PID 1264 wrote to memory of 5180	1264	msedgewebview2.exe	90
PID 1264 wrote to memory of 5180	1264	msedgewebview2.exe	90
PID 1264 wrote to memory of 5180	1264	msedgewebview2.exe	90
PID 1264 wrote to memory of 5180	1264	msedgewebview2.exe	90
PID 1264 wrote to memory of 3744	1264	msedgewebview2.exe	91
PID 1264 wrote to memory of 6012	1264	msedgewebview2.exe	92
PID 1264 wrote to memory of 6012	1264	msedgewebview2.exe	92
PID 1264 wrote to memory of 6012	1264	msedgewebview2.exe	92
PID 1264 wrote to memory of 972	1264	msedgewebview2.exe	93
PID 1264 wrote to memory of 972	1264	msedgewebview2.exe	93
PID 1264 wrote to memory of 972	1264	msedgewebview2.exe	93
PID 1264 wrote to memory of 972	1264	msedgewebview2.exe	93
PID 1264 wrote to memory of 972	1264	msedgewebview2.exe	93
PID 1264 wrote to memory of 1836	1264	msedgewebview2.exe	97
PID 1264 wrote to memory of 1836	1264	msedgewebview2.exe	97
PID 1264 wrote to memory of 1836	1264	msedgewebview2.exe	97
PID 1264 wrote to memory of 5640	1264	msedgewebview2.exe	98
PID 1264 wrote to memory of 5640	1264	msedgewebview2.exe	98
PID 1264 wrote to memory of 5640	1264	msedgewebview2.exe	98
PID 1264 wrote to memory of 1128	1264	msedgewebview2.exe	99
PID 1264 wrote to memory of 2584	1264	msedgewebview2.exe	100
PID 1264 wrote to memory of 2584	1264	msedgewebview2.exe	100
PID 1264 wrote to memory of 2584	1264	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\evon.exe
"C:\Users\Admin\AppData\Local\Temp\evon.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=evon.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.evon.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4088.3840.9134186777658247762 /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.evon.app\EBWebView /prefetch:4 /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x140,0x194,0x7ff9fb985fd8,0x7ff9fb985fe4,0x7ff9fb985ff0
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.evon.app\EBWebView" --webview-exe-name=evon.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1732,i,6551494593828535783,8861079834525927428,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.evon.app\EBWebView" --webview-exe-name=evon.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1732,i,6551494593828535783,8861079834525927428,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.evon.app\EBWebView" --webview-exe-name=evon.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1732,i,6551494593828535783,8861079834525927428,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.evon.app\EBWebView" --webview-exe-name=evon.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3376 --field-trial-handle=1732,i,6551494593828535783,8861079834525927428,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137 /prefetch:1
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.evon.app\EBWebView" --webview-exe-name=evon.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=1732,i,6551494593828535783,8861079834525927428,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.evon.app\EBWebView" --webview-exe-name=evon.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4580 --field-trial-handle=1732,i,6551494593828535783,8861079834525927428,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.evon.app\EBWebView" --webview-exe-name=evon.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4596 --field-trial-handle=1732,i,6551494593828535783,8861079834525927428,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.evon.app\EBWebView" --webview-exe-name=evon.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=1732,i,6551494593828535783,8861079834525927428,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:33fb3ea34b09020cd4ab92dbb8fa83b5455af137
    3⤵
    PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eeba2608dd1b5728559890880d74b770ea86bccde020b019eaab176b9d2fe702
MD5 7d796d9df961e8e9a54e3431457c3aff
SHA1 a71ea273a59ef31b6efc5cf196af98924bf3c7c5
SHA512 eb28a441237ae2c6df6c20d723587fab4c6c64266af15b26ec2c7306cfdf21223bc091ea81939777d1131ce67b842247b9855ac503288beccdef8143d3d322e0
TLSH
T1C4D0121672415934CC3022331A02610C2540C21B41094400E438851D5A045500B02491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 56d88f61db746eb5371a9066bcbd121896c462648d288113d22ae2803af03dfa
MD5 3b38690318a66dc10089bfe739461ee1
SHA1 23ec7c3724c2bc04215acbcdcf482012f35daf16
SHA512 f5e4d1dfe9510d53b4eaf6e5fbc498a291cf5c1754bf04352f6cfe533901f5c45d29a06973c042beb61cfe86f4ebb8042a1eac9e162f8fcb5fb9c7bf329635a2
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2fb83925-a8da-4216-a766-ea5b985fe82c.tmp

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Default\2fb83925-a8da-4216-a766-ea5b985fe82c.tmp
Size 6KB
SHA256 64b54a9cb719a98db0fed0bd5139df85fcd651d58de8ff979299bfeb027f3f31
MD5 902e3cc08eedc68e839cc9086a6f190a
SHA1 ea61b8d9e26be1d05c4c25cda469ecb7c1fd02c5
SHA512 f41b8965cd1dd1eb08b88e2baf90f40f68f9430fea831938951fdcf33b2605c05232775a4deecdcfc99fb2c626bed351e22117987b3200b670d6dcd8c774a691
SSDEEP 96:stW/dAshcdHOb9s2kfo5h16Z0C3s7/x+6MhmuecJMA1ejesSK+gke28XM1C7K:stOLWJ2uonEsV+FdMAQjTDG6K
TLSH
T1C5D1B7065E6868BB4CC7E149BA39BB03E2F5643231D12E58EBF8461C04DBACC6307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a70c484d2fd28cac7ab3954527e0701d1e8870b18e7f8a2b77a8be09c6ebe67b
MD5 632f0e15e9a32e5337b232be74961b97
SHA1 584baf626a9be2ecc27046ee8695538691b380b2
SHA512 059e92f00e14a036337e6ae4df14343335a75545eeb6f80f7f5ed39cb40262cfe564043466bef5ef565a1b1a4c1e84562677fe0fd103e15fc9c7e18a238c693e
TLSH
T1C4A0026523612123D54817BA14D9799033314A70D217165D90DE4474B9DA7C04191091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593510.TMP

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe593510.TMP
Size 48B
SHA256 ef8f977398111cfb2248dd07ccac97ef19de203402db481a249272c2d0be5e70
MD5 8ee4b1026dd960ec66fcd3e95a1ec281
SHA1 0865083b1b0f279b47f4a59f3be89163a46fce71
SHA512 b6c048c9e1b36c3e4adcee2d998cf1b926cff2554bfcc94caf57026de173257f11e7b4992d4c80eacb7167a21c329a3c42927818f8fdfa6b756a088fca5b6431
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 1964be794680df86159470900c77e0fb3691f54b65a648fc3693a67758cad4c3
MD5 5fb1f867fa20082048def0631a8c3329
SHA1 a9edddc2d9f885f03b33a05880c61ea1623210e2
SHA512 6b0cea0c72119dfe05c5216246a4cf4a6dd714b03830b3c3babf0123bb695046f6bbd2fc14971092ecc6d5c8a626cf80d5388f320629958a21242d2d5c480e5c
TLSH
T1E5016BA6C3D4C67D8A8157E037347913CD2E051A93283D2BCDE9EBDA57E14B5D21060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f7e3.TMP

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Default\Network\Network Persistent State~RFe59f7e3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Default\Preferences
Size 6KB
SHA256 cbe5b0a1976fe2243ee8320e087fb4ca06bb4b792f907c6dce7a47282ca1dbf8
MD5 f15c9863e154748671bdea2acdfb8627
SHA1 765acc67b514690a702b4e7dc0013c683bd8ad34
SHA512 7a60b993a21e8276a571ae5b7f589df5e99b4207ace1fa2a6ffd21477e52cc498e62a039d1abb198e47bec6adb4ba5c01ac0f02e43c6ea61fa3822afee24ed36
SSDEEP 96:stW/dAshcUGHOb9s2kfo5h16Z0C3s7/x+6MhmuecJMA1ejesSK+gpuD28XM1C7K:stOLMJ2uonEsV+FdMAQjT6G6K
TLSH
T196D1B7065E6868BB4CC7E159BA39BB13E2F5647271D12E48EBFC461C04DBADC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Local State
Size 2KB
SHA256 b576ad840f0fcfb6b74e7b390c530a2ca0f1ebf23919fe6760af48f8d3a99435
MD5 1b488930c278d1a51e67c4ad434b03bd
SHA1 464622894c76d73ce4b8b1aea41ec6de5aceb585
SHA512 b68714ea38791f56dfee5339251a5ba8fb9e6145a0a9fe5a529a6cc5e2ba750900cad7d223ec7c5ebd5e155a6c6d27dc014f15911f94174143144a6e3fe8b475
TLSH
T1CB51B3336C959A3B89B38688784B3E23AA7450A5AB523F51EBDC0B0851D7D5C2B17C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Local State
Size 15KB
SHA256 a61a060b44b177a841865e5355688f6bb283e60f71dac88b7ee205e1070613b1
MD5 974d4969125c986f4ad34f950108ef9b
SHA1 0ae9e932018976b9f8fef0246429eca359721212
SHA512 c2cd0c1313b19af4fb0aabb0570b4e91743581d4e7f2d86d3a996d3ec91d4f043d3ddca7661adad3de6cacd78d125ce65e75a90fc18ad53870364d3e59f35dbf
SSDEEP 384:pOjae3af7pOMe4tyUOh8iqLyWpMmGrNBSWptTFo/1EXFq:0jaeqD4MlshiLdMm8zTu1UFq
TLSH
T13B729F6EADB82CB78C33D445B9467A475B7090EAD6C27F5EEDD82B0D21A71CD1212C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Local State
Size 3KB
SHA256 9fcdb63a2b159d42799b7a86a802f66c2a9ef441f9993b7798bc439490463b5d
MD5 0438756ccf5adff046bf9af6f4429a3b
SHA1 872301c2e5e77babaa350b22381a648e470bc911
SHA512 8d2c44e7509d3ed2c128226f0d9cc3227b5d4bf8ae6b8b5435b207508afc4528037d79dabce598f9d071cf5773f73c3a7bd2220365daba47440a7c56a49bb6fe
TLSH
T14B71B53B6DA5993B4DB38A4478863B17B7A05037E6827F95DAEC0F0C11D7A981753C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58e2f8.TMP

Path C:\Users\Admin\AppData\Local\com.evon.app\EBWebView\Local State~RFe58e2f8.TMP
Size 1KB
SHA256 d59dcc56259c7966a6f4a0f3f600848b07cabafe6a28e6238abd7f5df12b0b9a
MD5 c912c66383973b25c3a1f966574153ad
SHA1 7bcc6d966d641be489c4c26542546cc8c12a5337
SHA512 d09ceec2e68c15161f770d88a0c5cdac68858ccee1a9d2b3f2ad21ed82615353daba7eebe48ccc0131fb740bb174664332ab824a37314169f01f457d537be275
TLSH
T15F31C6B79CD60B72AC62528531437E872F10107A9342AF44A2CC470812E7C4DAA3FC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/972-81-0x00007FFA1D750000-0x00007FFA1D751000-memory.dmp

Download

memory/1128-318-0x0000017784600000-0x0000017784601000-memory.dmp

Download

memory/1128-313-0x0000017784600000-0x0000017784601000-memory.dmp

Download

memory/1128-311-0x0000017784600000-0x0000017784601000-memory.dmp

Download

memory/1128-319-0x0000017784600000-0x0000017784601000-memory.dmp

Download

memory/1128-322-0x0000017784600000-0x0000017784601000-memory.dmp

Download

memory/1128-321-0x0000017784600000-0x0000017784601000-memory.dmp

Download

memory/1128-317-0x0000017784600000-0x0000017784601000-memory.dmp

Download

memory/1128-320-0x0000017784600000-0x0000017784601000-memory.dmp

Download

memory/1836-254-0x00007FFA1D780000-0x00007FFA1D781000-memory.dmp

Download

memory/1836-253-0x00007FFA1E3A0000-0x00007FFA1E3A1000-memory.dmp

Download

memory/5180-203-0x0000018F3F7B0000-0x0000018F3F7DA000-memory.dmp

Download

memory/5180-26-0x00007FFA1D750000-0x00007FFA1D751000-memory.dmp

Download