2b698aa3cd7e195f699b8b5b2ca0617f70a2fc484081d0a7f26596e38b3f0e68

Resubmissions

27/06/2026, 12:11

260627-pczqaaat2x9

27/06/2026, 11:58

260627-n49twsas8s9

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nfa-loader-latest.exe
Size 1.4MB
Sample260627-pczqaaat2x
SHA256 2b698aa3cd7e195f699b8b5b2ca0617f70a2fc484081d0a7f26596e38b3f0e68
MD5 f89c0a1ccfeac11adcd7f592ebdf4944
SHA1 cf1e01989c16c61a4bbef2d0905ce039382c38f2
SHA512 a3164ba08dc1641552ef9b10e4bdb0702b0231249202e04c9ba825a035266900cc17154c963d7cd1b9bad7aa4e2e29b7fdd6e1a5f5ad5824127dd549b6686d93
SSDEEP 24576:ZCAunPk/G8g3UWMex8SQX0sQJSgp85Js0e+8f2/PMjEHf8mJy5xL:ZCAwUe3EU311sUj45Ja
TLSH
T1B56533785FACA5E1D388BDF113E812343D26B4502CC15E94A00F9DDEABE05A565C3E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan upx

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nfa-loader-latest.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5064-0-0x00007FF7F7C00000-0x00007FF7F804F000-memory.dmp	upx
behavioral2/memory/5064-184-0x00007FF7F7C00000-0x00007FF7F804F000-memory.dmp	upx
behavioral2/memory/5064-203-0x00007FF7F7C00000-0x00007FF7F804F000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1517212028\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1718085453\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1718085453\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1648976036\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1718085453\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1517212028\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1648976036\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1648976036\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1648976036\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_491169819\male_names.txt	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1980	msedgewebview2.exe
1980	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1808	msedgewebview2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5064	nfa-loader-latest.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5064	nfa-loader-latest.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 1808	5064	nfa-loader-latest.exe	89
PID 1808 wrote to memory of 3532	1808	msedgewebview2.exe	90
PID 1808 wrote to memory of 5144	1808	msedgewebview2.exe	91
PID 1808 wrote to memory of 5144	1808	msedgewebview2.exe	91
PID 1808 wrote to memory of 5144	1808	msedgewebview2.exe	91
PID 1808 wrote to memory of 5144	1808	msedgewebview2.exe	91
PID 1808 wrote to memory of 2272	1808	msedgewebview2.exe	92
PID 1808 wrote to memory of 5692	1808	msedgewebview2.exe	93
PID 1808 wrote to memory of 5692	1808	msedgewebview2.exe	93
PID 1808 wrote to memory of 5692	1808	msedgewebview2.exe	93
PID 1808 wrote to memory of 2652	1808	msedgewebview2.exe	94
PID 1808 wrote to memory of 2652	1808	msedgewebview2.exe	94
PID 1808 wrote to memory of 2652	1808	msedgewebview2.exe	94
PID 1808 wrote to memory of 2652	1808	msedgewebview2.exe	94
PID 1808 wrote to memory of 2652	1808	msedgewebview2.exe	94
PID 1808 wrote to memory of 124	1808	msedgewebview2.exe	98
PID 1808 wrote to memory of 124	1808	msedgewebview2.exe	98
PID 1808 wrote to memory of 124	1808	msedgewebview2.exe	98
PID 1808 wrote to memory of 5596	1808	msedgewebview2.exe	99
PID 1808 wrote to memory of 5596	1808	msedgewebview2.exe	99
PID 1808 wrote to memory of 5596	1808	msedgewebview2.exe	99
PID 1808 wrote to memory of 3640	1808	msedgewebview2.exe	100
PID 1808 wrote to memory of 3640	1808	msedgewebview2.exe	100
PID 1808 wrote to memory of 3640	1808	msedgewebview2.exe	100
PID 1808 wrote to memory of 1980	1808	msedgewebview2.exe	101
PID 1808 wrote to memory of 1788	1808	msedgewebview2.exe	102
PID 1808 wrote to memory of 1788	1808	msedgewebview2.exe	102
PID 1808 wrote to memory of 1788	1808	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\nfa-loader-latest.exe
"C:\Users\Admin\AppData\Local\Temp\nfa-loader-latest.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5064.5340.13173797149841196323 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.loader.app\EBWebView /prefetch:4 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x164,0x188,0x18c,0x140,0x194,0x7ff9dfb35fd8,0x7ff9dfb35fe4,0x7ff9dfb35ff0
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,3885659310999853631,11481009859623368364,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1780,i,3885659310999853631,11481009859623368364,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1780,i,3885659310999853631,11481009859623368364,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3352 --field-trial-handle=1780,i,3885659310999853631,11481009859623368364,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0 /prefetch:1
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=1780,i,3885659310999853631,11481009859623368364,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0
    3⤵
    PID:124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4428 --field-trial-handle=1780,i,3885659310999853631,11481009859623368364,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=1780,i,3885659310999853631,11481009859623368364,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4460 --field-trial-handle=1780,i,3885659310999853631,11481009859623368364,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4268 --field-trial-handle=1780,i,3885659310999853631,11481009859623368364,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d7d8ebaa6af7da94611e4154f8c327ee95232fe0
    3⤵
    PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2274765033451db3c2e7c2f26cdb70b258a0d987bd70a8e5249d3dc6a014bb06
MD5 9ba4aebbc2509b890c08f37da78e99e8
SHA1 c6e0fe7804da6d794a84daec7c59a1ff6ffc0ea9
SHA512 10fe37b1282cc640ee12f0f79406b00b379ecd1f2a83cd8dc55e289016044817916f89136b13535d2abc12ebd0d65e0b8b47b8e925af25b80d4f14d5ae6079cb
TLSH
T153D02223B3A20A38C82032330023B20C0C00C22F828EC0C8AC3CCEAE2F080F80E03882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7a7e5885d340a05a024fb762d5fede37cb4badf9c81d3225809d3a8034f37264
MD5 06ee1bcab7abd2866505be32dddf6f88
SHA1 e3d8d3da779ab9e9aa4dd5e7c229b8dc50b185f5
SHA512 c85fc49429aa64225165d811626d8636c78984c50ac90854f1ad6f7450c1e22923eba54a90ae7f626d17c5ff2d255042850b07c5ba45d43fe7aa4c71a531d77f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

474d4464-b216-49f0-aa3c-65a398e20757.tmp

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\474d4464-b216-49f0-aa3c-65a398e20757.tmp
Size 6KB
SHA256 91229bf8fb87feabc1051401f8eb5f32980733932fd8f8b6e4f5ffdcab35fd41
MD5 b7dbd029ad4575332f1752da20de86cb
SHA1 2af7310ff120c7048fc439ae79858092b46a174c
SHA512 21cf2e9578a875d04c6e76b07b273bbe16d724876a4f93527fa7cdd0c2c77eb4dffcb52cf6cbda0f09ecf9f356338b992ea967a7bace28060dfcb9922bd9422a
SSDEEP 96:stf/dgLRt/b94Mkqno5h16Z0Ds7/x+6MhmuecJU71ejelK+grbm28XM1C7K:stnayMXonDsV+FdU7Qjf5mG6K
TLSH
T17CD195025E28BD7B4CC6E119BA39BA47E2F9507261D11E98FBF8861C14DB6DC2347D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 87575ed888b3db51e8d4fba9d9851660d970016ed5d0e873fe2b8da6eb3f5273
MD5 29360a3268a582f56488646ee920ed51
SHA1 fa4cb3c6bbfdc64767973ec4b7124ac904b1977c
SHA512 c4a87f46b3877b739bf144c230cdd019dcd0c14e3074009b31d10f1085f90cd45fbfbb14dbf7864b1bab5feb29308a0d8847d868b1d198807ff3812869fc5b4d
TLSH
T137A002D945E04412C14053B030D2056437B08A245287DAC398F000749A703515251491
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591ca6.TMP

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe591ca6.TMP
Size 48B
SHA256 880bb2ae459c4618d44dd756222c36c72eab4c13fd484ed953bf921b7a9cffe3
MD5 d0fc75ed79c1abcbac922356eb16f619
SHA1 f38831c4dd8099785815303b17c29dd43a57aa64
SHA512 c55c50bdd0f77510dc045f7ff80d9a358317aa804576227c615ccaa13484deacd6a8eb7a96ea935c7fe281a6ded3712128cfc08aa971b79e01f50531bfb2c2e9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Network\Network Persistent State
Size 571B
SHA256 c861fa38e45ee02a43abb2f6e4729e8b22a8c43c4d485cc088a9a33bceb11485
MD5 d492df83d221970de9ad461143793dc5
SHA1 586f69b51107e61bc4afe365c6144b702d854aa6
SHA512 ad88c0c5777345b1e64c95ba6c9dfa096df1eb7c7632232686ff4b2d010fc1527975c454506ad229652aa8b62a5bd6df89c206fee51c74eef50d2be9e10e8db9
TLSH
T159F08152C6E4D66E875913E017307537C53D040552283D1BEDEAFB9A57D2075D12150B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59e0c1.TMP

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Network\Network Persistent State~RFe59e0c1.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Preferences
Size 6KB
SHA256 3727a35143bf764a0f36e1b5ede3cdddcd61c5527f237dadb258fc17ece5ae63
MD5 aec533ce374fc48ab4b82a49fdc9f3f7
SHA1 b68b6df692852c2bd9cf51689a54063d318fea87
SHA512 8a6b6bbf97d2dc895729c1f5512deb9a2002e80c623f7406592e345d47183051b393fcc984a035583b05cdbcf44ca243034ffa8584924ef2f628f7019b2ddd45
SSDEEP 96:stf/dgLREG/b94Mkqno5h16Z0Ds7/x+6MhmuecJU71ejelK+g2cbf28XM1C7K:stnaoMXonDsV+FdU7Qjf/fG6K
TLSH
T1E5D195025E28BD7B4CC6E118BA29BB57E2F5507261D11E98FBF8461C14DB6DC2347D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State
Size 15KB
SHA256 bc0783491e43ca1506cf4e4efb62bb07b95213db10f85720332749e516e16af0
MD5 ea363acf8736aaa4f91e2eaf9f33c51f
SHA1 6629eabfb205fb76f574c14c6aa01139eae08af6
SHA512 f69dd8435cd38ea883b9d082c5ea690d9f83313c4d4391c522879e6e5bad864bacb95af6dbbf6fa4406b700740a171cbe7b201bbec2d02dfcd87afad12bef137
SSDEEP 384:Ssrv+89zHqlDNP9oid6NBSiB1FPzi3hNP:drv+4UNbdIr5zi3hNP
TLSH
T14D72AE33E538AA339DB38448B44AAA077FB8609752C25BA4E8995F4C429F4D92347D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State
Size 2KB
SHA256 3873c89f52584038f97041537137a18acefdb5f7865e9701b123fc9cf9e14f0d
MD5 b10c667d91da9a5ac2e3a2efdfcd695c
SHA1 7a5a58929d872aef76e115e20f1b9f679b08a3ff
SHA512 0adbb70cd2b16838fab3f84dca95b1dd2d31b3b07414d3546c5a6dd153d9e637c430244460c33f63c02a60fa4ffc9542f3c1312dad608b287da2924e7741de0a
TLSH
T1D5519633A9242A73C9A28644798A7F97DFB540626B922F54A9DC0B0C12D751C2347C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State
Size 3KB
SHA256 47f5a1c898afd4e39be55d471fe019885970df1c390636585b925d2071d68ac5
MD5 0a8671217477b0cc8339d53527f145ea
SHA1 0dd906af8234bbc4d19c0510379807888fb5e093
SHA512 7ca61cf7eaf958501e4aa21b0711ae19f7e1a75483ebcaac77e1230280cfb08f41fe2d1f1d82c3b9c788f75c15ae277fd6fad28347a00b6579bfc3ed307c06bb
TLSH
T19871B637A97069778DE3890478892B46BBE14033A6C17F95E5EC0F0C12D725C2383C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58cc54.TMP

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State~RFe58cc54.TMP
Size 1KB
SHA256 ec52b49fbb99f4bc742ae53fc2c768db3ec2fd81515b2dc731b084e9bcef75df
MD5 25669a03779e750aa7103191408a28b6
SHA1 47921caede1c979b0f6c0e8d35b054df9c2cabe7
SHA512 09746500c780a9462e5b2626ff67d8b844b9ce291b8cfcaeeb4b9cdc7dc1e547ceedb76e7ce0cb3fcdff9eed4e996d383f52763a5061f486ae465b88c1bdcf23
TLSH
T1833130B2D5601AB2EC86958A3159EBCBAFA200B752415F44B4CD4B0C13EB40D766BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/124-251-0x00007FFA00870000-0x00007FFA00871000-memory.dmp

Download

memory/124-250-0x00007FFA01190000-0x00007FFA01191000-memory.dmp

Download

memory/1980-347-0x0000018C32650000-0x0000018C32651000-memory.dmp

Download

memory/1980-337-0x0000018C32650000-0x0000018C32651000-memory.dmp

Download

memory/1980-339-0x0000018C32650000-0x0000018C32651000-memory.dmp

Download

memory/1980-343-0x0000018C32650000-0x0000018C32651000-memory.dmp

Download

memory/1980-348-0x0000018C32650000-0x0000018C32651000-memory.dmp

Download

memory/1980-346-0x0000018C32650000-0x0000018C32651000-memory.dmp

Download

memory/1980-344-0x0000018C32650000-0x0000018C32651000-memory.dmp

Download

memory/1980-345-0x0000018C32650000-0x0000018C32651000-memory.dmp

Download

memory/2652-97-0x00007FFA016E0000-0x00007FFA016E1000-memory.dmp

Download

memory/5064-184-0x00007FF7F7C00000-0x00007FF7F804F000-memory.dmp

Download

memory/5064-0-0x00007FF7F7C00000-0x00007FF7F804F000-memory.dmp

Download

memory/5064-203-0x00007FF7F7C00000-0x00007FF7F804F000-memory.dmp

Download

memory/5144-27-0x00007FFA016E0000-0x00007FFA016E1000-memory.dmp

Download