Overview

overview

8

Static

static

3

Kiddions Menu.zip

windows10-2004-x64

1

Kiddions Menu.zip

windows11-ltsc_2024-x64

8

Kiddions Menu.exe

windows10-2004-x64

7

Kiddions Menu.exe

windows11-ltsc_2024-x64

8

app.pyc

windows10-2004-x64

3

app.pyc

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    111s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 17:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Kiddions Menu.exe
  • Size 11.9MB
  • Sample260705-vvlt2aas2m
  • SHA256 b1dc4fc92e47dac11d29bd780401d48029c1ee2042f95e1ae559520fbfc44e9f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 22 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Kiddions Menu.exe
    "C:\Users\Admin\AppData\Local\Temp\Kiddions Menu.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Users\Admin\AppData\Local\Temp\Kiddions Menu.exe
      "C:\Users\Admin\AppData\Local\Temp\Kiddions Menu.exe"
      2⤵
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5340
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Kiddions Menu.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5340.6036.5656873506916747895 /pfhostedapp:e7705cbc39ad436a29c978489f91432d562ffe8e
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:2408
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView /prefetch:4 /pfhostedapp:e7705cbc39ad436a29c978489f91432d562ffe8e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x180,0x184,0x188,0x15c,0x190,0x7ff8dce35fd8,0x7ff8dce35fe4,0x7ff8dce35ff0
          4⤵
            PID:2036
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1736,i,14579897255053195380,2613343968263311922,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:e7705cbc39ad436a29c978489f91432d562ffe8e
            4⤵
              PID:4132
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2000 --field-trial-handle=1736,i,14579897255053195380,2613343968263311922,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:e7705cbc39ad436a29c978489f91432d562ffe8e
              4⤵
                PID:5264
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1736,i,14579897255053195380,2613343968263311922,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:e7705cbc39ad436a29c978489f91432d562ffe8e
                4⤵
                  PID:5432
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3496 --field-trial-handle=1736,i,14579897255053195380,2613343968263311922,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:e7705cbc39ad436a29c978489f91432d562ffe8e /prefetch:1
                  4⤵
                    PID:4924
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView" --webview-exe-name="Kiddions Menu.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2188 --field-trial-handle=1736,i,14579897255053195380,2613343968263311922,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:e7705cbc39ad436a29c978489f91432d562ffe8e
                    4⤵
                      PID:6056
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:4252
                • C:\Windows\explorer.exe
                  explorer.exe /LOADSAVEDWINDOWS
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:4400
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:2208
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:2204

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 595B
                    • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    VCRUNTIME140.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\VCRUNTIME140.dll
                    • Size 117KB
                    • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VCRUNTIME140_1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\VCRUNTIME140_1.dll
                    • Size 48KB
                    • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _bz2.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_bz2.pyd
                    • Size 83KB
                    • SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _cffi_backend.cp313-win_amd64.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_cffi_backend.cp313-win_amd64.pyd
                    • Size 175KB
                    • SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ctypes.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_ctypes.pyd
                    • Size 129KB
                    • SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _hashlib.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_hashlib.pyd
                    • Size 68KB
                    • SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _lzma.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_lzma.pyd
                    • Size 156KB
                    • SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _queue.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_queue.pyd
                    • Size 33KB
                    • SHA256 08050f94efe7bdd9d7cbe85b1196de391cac1b30f4a4918610cb174ae529a5db
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _socket.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_socket.pyd
                    • Size 84KB
                    • SHA256 c63e8e6a369cbe86e57c9823fb48bc5d4e7bb18455b9b001986b4768c49007da
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ssl.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_ssl.pyd
                    • Size 177KB
                    • SHA256 11572f6eb63e43cdc2908812506ffcdab21be2be5931f1e38d856c15f5a79e6c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _uuid.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_uuid.pyd
                    • Size 27KB
                    • SHA256 6a3e6d89e71a803609e6e765a592011427a5b6e7a4766bbca7790b601bb66dbe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _wmi.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\_wmi.pyd
                    • Size 39KB
                    • SHA256 a7cc096244a497219269a3ee1cf2526a2b613d73fa566749f8f2408f5f4117d4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    base_library.zip
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\base_library.zip
                    • Size 1.3MB
                    • SHA256 b452ad810fabb6ea013518126355ccb14278df9f30ddd664069ce789eb1059c1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ClrLoader.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\clr_loader\ffi\dlls\amd64\ClrLoader.dll
                    • Size 8KB
                    • SHA256 9eb57d53c8e0a75fa59abfff0eee2b06cef24f0135162afe62f7c0e63b16d9ed
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    logo.png
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\images\logo.png
                    • Size 4KB
                    • SHA256 7ab10960ff48c2635d4919f2fbb14f5598b24856b002c99592f525cc2e0d2407
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    index.html
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\index.html
                    • Size 44KB
                    • SHA256 a48fa952deb44a04cbb3a36f560b96f6e63ba1e71e7452d03f9f0ccf1ba53ac2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libcrypto-3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\libcrypto-3.dll
                    • Size 5.0MB
                    • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libffi-8.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\libffi-8.dll
                    • Size 38KB
                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libssl-3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\libssl-3.dll
                    • Size 776KB
                    • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python313.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\python313.dll
                    • Size 5.8MB
                    • SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Python.Runtime.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\pythonnet\runtime\Python.Runtime.dll
                    • Size 439KB
                    • SHA256 d204ad74dc18cd07320c8e665bd32ec6549b555ce97e61e4d3cf88437a64988e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    select.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\select.pyd
                    • Size 32KB
                    • SHA256 d1e486de9653640be7c3a9bed04aa716b29ea76a69e1de758dd9fa708f2c9d38
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Lorem ipsum.txt
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                    • Size 1KB
                    • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    unicodedata.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\unicodedata.pyd
                    • Size 695KB
                    • SHA256 e7d0375a7064b1c8916cca7cabf7e3df559fc8463dfdf831f403e95c79499121
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    api.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\webview\js\api.js
                    • Size 8KB
                    • SHA256 aa34d014d852b2d73adba87c3af1682f1d068d523ce0da493e5342e400108fe0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    customize.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\webview\js\customize.js
                    • Size 3KB
                    • SHA256 22c58840705c50a68093e7e888a70391422abaa8f0be87de6f456d223119ac40
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    finish.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\webview\js\finish.js
                    • Size 359B
                    • SHA256 ed6005a2786af24d1afe31d9ee7b69a19c3670e77089c93d60725663618da0cb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    dom_json.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\webview\js\lib\dom_json.js
                    • Size 25KB
                    • SHA256 fc85de45fa702ef22853bacdf534ebf373659745d3cd2e15efda042c55423052
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    polyfill.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\webview\js\lib\polyfill.js
                    • Size 25KB
                    • SHA256 18c35ba9b4c29652269fdc40124907772ca6aa54549a3f6ec20280729fdbfbc9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Microsoft.Web.WebView2.Core.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\webview\lib\Microsoft.Web.WebView2.Core.dll
                    • Size 589KB
                    • SHA256 cb8c852fcc4ef55d630b64d171dc11538bb25258041ed22cf31735982a2e09e3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Microsoft.Web.WebView2.WinForms.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\webview\lib\Microsoft.Web.WebView2.WinForms.dll
                    • Size 38KB
                    • SHA256 e62056bee28ab094071144b47371009a6fbc162f9aea184719f2e86ed515f7f8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WebView2Loader.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI11722\webview\lib\runtimes\win-x64\native\WebView2Loader.dll
                    • Size 162KB
                    • SHA256 271b57e3ec03c436a15d80cafeb9fd1618a43793233d8b05c9446f8de0a51be4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 39f3fd0d284be97252f8e5b9c2800d8cd77b59392a5859436aceb2150cc1e109
                    • MD5 SHA1 SHA512
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 13e60a020ca303ca96fcc5f9b53c9d71740429ccee12b898163799b83a3092da
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    throttle_store.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Crashpad\throttle_store.dat
                    • Size 20B
                    • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                    • MD5 SHA1 SHA512
                    Submit Download

                    0f953b59-83f5-4805-9797-48cc3ad660fd.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Default\0f953b59-83f5-4805-9797-48cc3ad660fd.tmp
                    • Size 4KB
                    • SHA256 28ffe1a73a4816137fc6b97816af527e1ffa3aa49083fe35a23c12d7ce8369e6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Network Persistent State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Default\Network\Network Persistent State
                    • Size 111B
                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Network Persistent State~RFe5a5c4a.TMP
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Default\Network\Network Persistent State~RFe5a5c4a.TMP
                    • Size 59B
                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    SCT Auditing Pending Reports
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Default\Network\SCT Auditing Pending Reports
                    • Size 2B
                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                    • MD5 SHA1 SHA512
                    Submit Download

                    Preferences
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Default\Preferences
                    • Size 5KB
                    • SHA256 cef846f20ca98a136760233ff4e40eca5966a9e34a4515853e0fd134876031e8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    000001.dbtmp
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
                    • Size 16B
                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                    • MD5 SHA1 SHA512
                    Submit Download

                    MANIFEST-000001
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
                    • Size 41B
                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                    • MD5 SHA1 SHA512
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Local State
                    • Size 2KB
                    • SHA256 e8c69d48ba185e5ec1e6bdb58b05a2c032ff22b165473c9aa730e94eac71fd26
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Local State
                    • Size 15KB
                    • SHA256 b0d28505c38e830a191182b2c87e51d000b6bf74d51eee70e780f00d55ae93a3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Local State
                    • Size 3KB
                    • SHA256 abf8aa72c6bf6c6c229d196a683e33ed003939f332b4ab75901ace505f30d932
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State~RFe5933c8.TMP
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpx8em7kl7\EBWebView\Local State~RFe5933c8.TMP
                    • Size 1KB
                    • SHA256 6e66b38f245e78b0513c86fbd188a1cf5a91830676be75c44b6bfc4e0de5a4a0
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/2208-368-0x0000016781A30000-0x0000016781A50000-memory.dmp
                    Download

                    memory/2208-339-0x00000167801E0000-0x00000167802E0000-memory.dmp
                    Download

                    memory/2208-384-0x0000016794420000-0x0000016794440000-memory.dmp
                    Download

                    memory/2208-370-0x0000016794500000-0x0000016794520000-memory.dmp
                    Download

                    memory/2208-369-0x0000016781E30000-0x0000016781F30000-memory.dmp
                    Download

                    memory/4132-296-0x000001C6B0000000-0x000001C6B00D6000-memory.dmp
                    Download

                    memory/4132-155-0x00007FF907950000-0x00007FF907951000-memory.dmp
                    Download

                    memory/4400-492-0x000000000EA70000-0x000000000EBDC000-memory.dmp
                    Download

                    memory/4400-491-0x000000000E0E0000-0x000000000E173000-memory.dmp
                    Download

                    memory/4924-297-0x0000027F5C690000-0x0000027F5C766000-memory.dmp
                    Download

                    memory/4924-223-0x00007FF907950000-0x00007FF907951000-memory.dmp
                    Download

                    memory/5340-102-0x00007FF8F90C0000-0x00007FF8F90CA000-memory.dmp
                    Download

                    memory/5340-111-0x000001C3FB910000-0x000001C3FB932000-memory.dmp
                    Download

                    memory/5340-127-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-126-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-125-0x000001C3FCEE0000-0x000001C3FCEE8000-memory.dmp
                    Download

                    memory/5340-115-0x000001C3FB8C0000-0x000001C3FB8C8000-memory.dmp
                    Download

                    memory/5340-123-0x000001C3FB840000-0x000001C3FB84E000-memory.dmp
                    Download

                    memory/5340-121-0x000001C3FCF70000-0x000001C3FD008000-memory.dmp
                    Download

                    memory/5340-117-0x000001C3FB840000-0x000001C3FB848000-memory.dmp
                    Download

                    memory/5340-118-0x000001C3FB840000-0x000001C3FB848000-memory.dmp
                    Download

                    memory/5340-119-0x000001C3FB840000-0x000001C3FB848000-memory.dmp
                    Download

                    memory/5340-282-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-283-0x000001C3FB900000-0x000001C3FB910000-memory.dmp
                    Download

                    memory/5340-116-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-114-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-113-0x000001C3FD390000-0x000001C3FD94A000-memory.dmp
                    Download

                    memory/5340-112-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-135-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-110-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-109-0x000001C3FB5C0000-0x000001C3FB5C8000-memory.dmp
                    Download

                    memory/5340-108-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-107-0x000001C3FB5B0000-0x000001C3FB5B8000-memory.dmp
                    Download

                    memory/5340-106-0x000001C3FB860000-0x000001C3FB87A000-memory.dmp
                    Download

                    memory/5340-105-0x000001C3FC130000-0x000001C3FC1A4000-memory.dmp
                    Download

                    memory/5340-104-0x00007FF8E5DD0000-0x00007FF8E6774000-memory.dmp
                    Download

                    memory/5340-100-0x000001C3FB900000-0x000001C3FB910000-memory.dmp
                    Download

                    memory/5340-101-0x00007FF8E5F5F000-0x00007FF8E5F60000-memory.dmp
                    Download

                    memory/5340-99-0x000001C3FB560000-0x000001C3FB56A000-memory.dmp
                    Download

                    memory/6056-557-0x0000026343710000-0x0000026343711000-memory.dmp
                    Download

                    memory/6056-566-0x0000026343710000-0x0000026343711000-memory.dmp
                    Download

                    memory/6056-568-0x0000026343710000-0x0000026343711000-memory.dmp
                    Download

                    memory/6056-567-0x0000026343710000-0x0000026343711000-memory.dmp
                    Download

                    memory/6056-565-0x0000026343710000-0x0000026343711000-memory.dmp
                    Download

                    memory/6056-563-0x0000026343710000-0x0000026343711000-memory.dmp
                    Download

                    memory/6056-564-0x0000026343710000-0x0000026343711000-memory.dmp
                    Download

                    memory/6056-559-0x0000026343710000-0x0000026343711000-memory.dmp
                    Download