Overview

overview

7

Static

static

3

WFToolsAE_...er.exe

windows10-2004-x64

7

WFToolsAE_...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    52s
  • max time network
    45s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/07/2026, 19:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WFToolsAE_Installer.exe
  • Size 10.9MB
  • Sample260705-xpf3pse17x
  • SHA256 9f00911fd5122fe6966768688e9faf16b741f6d3d307f076cb9a4cf8c18973ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Loads dropped DLL 23 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WFToolsAE_Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\WFToolsAE_Installer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Users\Admin\AppData\Local\Temp\WFToolsAE_Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\WFToolsAE_Installer.exe"
      2⤵
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3348
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:3948
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WFToolsAE_Installer.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --disable-features=ElasticOverscroll --mojo-named-platform-channel-pipe=3348.1320.10358346186941965367
          3⤵
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:4548
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x158,0x15c,0x160,0x134,0x168,0x7ffb7e2db078,0x7ffb7e2db084,0x7ffb7e2db090
            4⤵
              PID:468
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView" --webview-exe-name=WFToolsAE_Installer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1704,i,1077916908039016377,17811420682622019110,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
              4⤵
                PID:1128
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView" --webview-exe-name=WFToolsAE_Installer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1912,i,1077916908039016377,17811420682622019110,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
                4⤵
                  PID:4396
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView" --webview-exe-name=WFToolsAE_Installer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2376,i,1077916908039016377,17811420682622019110,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:8
                  4⤵
                    PID:2444
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView" --webview-exe-name=WFToolsAE_Installer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,1077916908039016377,17811420682622019110,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
                    4⤵
                      PID:3656

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    VCRUNTIME140.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\VCRUNTIME140.dll
                    • Size 106KB
                    • SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _asyncio.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_asyncio.pyd
                    • Size 62KB
                    • SHA256 45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _bz2.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_bz2.pyd
                    • Size 81KB
                    • SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _cffi_backend.cp310-win_amd64.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_cffi_backend.cp310-win_amd64.pyd
                    • Size 175KB
                    • SHA256 c379126647af2cbfb592d6a921f6218da59b886e2a56e9b82f8159aced6f1100
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ctypes.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_ctypes.pyd
                    • Size 119KB
                    • SHA256 e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _decimal.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_decimal.pyd
                    • Size 242KB
                    • SHA256 4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _elementtree.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_elementtree.pyd
                    • Size 124KB
                    • SHA256 d90414e40fb283ed4633924613dac671580bf7db926da37346aa230380860933
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _hashlib.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_hashlib.pyd
                    • Size 60KB
                    • SHA256 cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _lzma.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_lzma.pyd
                    • Size 153KB
                    • SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _multiprocessing.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_multiprocessing.pyd
                    • Size 32KB
                    • SHA256 af84076b03a0eadec2b75d01f06bb3765b35d6f0639fb7c14378736d64e1acaa
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _overlapped.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_overlapped.pyd
                    • Size 47KB
                    • SHA256 f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _queue.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_queue.pyd
                    • Size 29KB
                    • SHA256 007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _socket.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_socket.pyd
                    • Size 75KB
                    • SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ssl.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_ssl.pyd
                    • Size 155KB
                    • SHA256 e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _uuid.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\_uuid.pyd
                    • Size 23KB
                    • SHA256 8b3d4767057c18c1c496e138d4843f25e5c98ddfc6a8d1b0ed46fd938ede5bb6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    base_library.zip
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\base_library.zip
                    • Size 859KB
                    • SHA256 b601e9efe856f3d4dddade0b44fa34051cc67d86642aa5c47bb9d170a3c37ef7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ClrLoader.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\clr_loader\ffi\dlls\amd64\ClrLoader.dll
                    • Size 10KB
                    • SHA256 07f62bcb1b70320f221ffb2cfc5ce6133815195f3e7cdb8d833222506188c2ac
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    installer.css
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\installer.css
                    • Size 14KB
                    • SHA256 1942880155b6b3d9ed6def9078872a9f0a0ad8cae8bc72fa6051bfafe5f1c2bf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    installer.html
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\installer.html
                    • Size 8KB
                    • SHA256 603d140227a954622eea83c696cd469f7d4d05586056251ba8dca39343837800
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    installer.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\installer.js
                    • Size 9KB
                    • SHA256 63f405aeebfa87134df0c1c24c48043ceb2890c072a368ecc701235d51597d00
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libcrypto-1_1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\libcrypto-1_1.dll
                    • Size 3.3MB
                    • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libffi-7.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\libffi-7.dll
                    • Size 32KB
                    • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libssl-1_1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\libssl-1_1.dll
                    • Size 686KB
                    • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pyexpat.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\pyexpat.pyd
                    • Size 193KB
                    • SHA256 56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python310.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\python310.dll
                    • Size 4.3MB
                    • SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Python.Runtime.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\pythonnet\runtime\Python.Runtime.dll
                    • Size 435KB
                    • SHA256 648e6b415be8f45018af71f377aa3a97772799b353ac3a5e8612a99313de4907
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    select.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\select.pyd
                    • Size 28KB
                    • SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    unicodedata.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\unicodedata.pyd
                    • Size 1.1MB
                    • SHA256 4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    api.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\webview\js\api.js
                    • Size 8KB
                    • SHA256 cb68b8bed427fa356aea26376e497552f55d91329c093c026a65230d074e2b27
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    customize.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\webview\js\customize.js
                    • Size 4KB
                    • SHA256 ed14d0b594266dfe3834cc8565b44a8157420432aeef4f733ab505bd6ed89b8a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    finish.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\webview\js\finish.js
                    • Size 357B
                    • SHA256 751443083dd1d2b2ef4142692f25bc4f6e04f8de4d82c455c73473700f00c8cb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    polyfill.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\webview\js\lib\polyfill.js
                    • Size 26KB
                    • SHA256 481a08f5337a770acf49b38c2f58dd0c95f92bf9dbd92bf82b596836ea343ab5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    state.js
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\webview\js\state.js
                    • Size 1KB
                    • SHA256 68ee87ec01563cbcab77a57704a32f19b47436c9d5e254bfba9675a51c132075
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Microsoft.Web.WebView2.Core.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\webview\lib\Microsoft.Web.WebView2.Core.dll
                    • Size 634KB
                    • SHA256 8219a3135436c147f8eb02fb831e99596103eebc18b6d7b794ca93f4c67018a2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Microsoft.Web.WebView2.WinForms.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\webview\lib\Microsoft.Web.WebView2.WinForms.dll
                    • Size 38KB
                    • SHA256 c48f8d729dc531288d2c53a6241effe7922ed1b947850b2442008a945c098c48
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WebView2Loader.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI42922\webview\lib\runtimes\win-x64\native\WebView2Loader.dll
                    • Size 158KB
                    • SHA256 eb5335edeaa6f2122c044e82aab2351dc8c9b4e0fe5e578c71922fb61be285e7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 81de63dc124e28865171ef66c461ceecbc81c9724bcca255b3d7b74ce700e60d
                    • MD5 SHA1 SHA512
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 55d4f112c610c576b2ff108b78d3cd0d0e0a4a40122896785b927ea5fe864923
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    throttle_store.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Crashpad\throttle_store.dat
                    • Size 20B
                    • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                    • MD5 SHA1 SHA512
                    Submit Download

                    data_0
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Cache\Cache_Data\data_0
                    • Size 8KB
                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_1
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Cache\Cache_Data\data_1
                    • Size 264KB
                    • SHA256 c7a9f0081228100edb17438ee7dba766ee0182d1ec861c29f3629c39e0227dc3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data_2
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Cache\Cache_Data\data_2
                    • Size 8KB
                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    data_3
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Cache\Cache_Data\data_3
                    • Size 8KB
                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    MANIFEST-000001
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Extension Rules\MANIFEST-000001
                    • Size 41B
                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                    • MD5 SHA1 SHA512
                    Submit Download

                    Network Persistent State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Network\Network Persistent State
                    • Size 111B
                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Network Persistent State~RFe58f94f.TMP
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Network\Network Persistent State~RFe58f94f.TMP
                    • Size 59B
                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    SCT Auditing Pending Reports
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Network\SCT Auditing Pending Reports
                    • Size 2B
                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                    • MD5 SHA1 SHA512
                    Submit Download

                    Preferences
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Preferences
                    • Size 6KB
                    • SHA256 b2f982df47ab14aad416e50e2e79a0e36c092c4ee2c222f9f096c9bb8e82d057
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Preferences~RFe58f940.TMP
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Preferences~RFe58f940.TMP
                    • Size 5KB
                    • SHA256 4339b99709b17a99969c629908875ccacad4bdfe1fa5d54d4fcc7cc09bb4fd1a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CURRENT
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Default\Sync Data\LevelDB\CURRENT
                    • Size 16B
                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                    • MD5 SHA1 SHA512
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Local State
                    • Size 1KB
                    • SHA256 77071ced9d3a84cffa6636b01353d0bdc66d4790260724d054e11497a4b567ac
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Local State
                    • Size 2KB
                    • SHA256 34ecc689f594ac2ffd8797abfcf918536d5f838ece7c78968420e915ffdb3d98
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Local State
                    • Size 3KB
                    • SHA256 5a28997fc08f5af0afb7be929e5067ff682884c00c3503c2d7c862a033a8dcdd
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Local State
                    • Size 16KB
                    • SHA256 4df2a3eadd0f678b0e019b8ef81c6be94d318730d1c07602b77d58801c2b7917
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Local State
                    • Size 16KB
                    • SHA256 ec388bc06ced7253ee5b3a6d5aba2c6403743b13c1c53834bcb0db21609401ed
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State~RFe585d6d.TMP
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp29bbzua8\EBWebView\Local State~RFe585d6d.TMP
                    • Size 1KB
                    • SHA256 750903ea306171dd3a803b1447c3f580fc3e94982275da262c3811fcb83efb51
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    4x_NMKD-Superscale-Artisoftject_210000_G.param
                    • Path C:\Users\Admin\AppData\Roaming\Adobe\CEP\extensions\WFToolsAE\assets\realesrgan\models\4x_NMKD-Superscale-Artisoftject_210000_G.param
                    • Size 162KB
                    • SHA256 6b34402c8c156b5b9f2b14347d65ee03391492b07f5237bf3173596b56be4e46
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    realesr-animevideov3-x4.bin
                    • Path C:\Users\Admin\AppData\Roaming\Adobe\CEP\extensions\WFToolsAE\assets\realesrgan\models\realesr-animevideov3-x4.bin
                    • Size 1.2MB
                    • SHA256 548a36f9c3f4ab8da56cd3b13badf23968bee207b396dad14d04b830e5f2ab2d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vcomp140d.dll
                    • Path C:\Users\Admin\AppData\Roaming\Adobe\CEP\extensions\WFToolsAE\assets\rife\vcomp140d.dll
                    • Size 202KB
                    • SHA256 34980f5a28002967d4f2659b10a417b1b9a242e240195947c89195083d146c53
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    theme.json
                    • Path C:\Users\Admin\AppData\Roaming\Adobe\CEP\extensions\WFToolsAE\styles\WF_Glossy\theme.json
                    • Size 2B
                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                    • MD5 SHA1 SHA512
                    Submit Download

                    memory/1128-251-0x00007FFB9E150000-0x00007FFB9E151000-memory.dmp
                    Download

                    memory/2444-303-0x00007FFB9EC10000-0x00007FFB9EC11000-memory.dmp
                    Download

                    memory/2444-308-0x00007FFB9F4B0000-0x00007FFB9F4B1000-memory.dmp
                    Download

                    memory/3348-216-0x0000028472140000-0x000002847214E000-memory.dmp
                    Download

                    memory/3348-389-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-222-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-221-0x00000284734D0000-0x00000284734D8000-memory.dmp
                    Download

                    memory/3348-201-0x00000284720E0000-0x0000028472154000-memory.dmp
                    Download

                    memory/3348-219-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-218-0x0000028473620000-0x0000028473720000-memory.dmp
                    Download

                    memory/3348-198-0x0000028472040000-0x000002847204A000-memory.dmp
                    Download

                    memory/3348-217-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-199-0x00007FFB8FCF0000-0x00007FFB8FCFA000-memory.dmp
                    Download

                    memory/3348-369-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-370-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-381-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-387-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-388-0x0000028473620000-0x0000028473720000-memory.dmp
                    Download

                    memory/3348-225-0x0000028473620000-0x0000028473720000-memory.dmp
                    Download

                    memory/3348-390-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-392-0x0000028473620000-0x0000028473720000-memory.dmp
                    Download

                    memory/3348-195-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-214-0x0000028473570000-0x0000028473612000-memory.dmp
                    Download

                    memory/3348-212-0x0000028472140000-0x0000028472148000-memory.dmp
                    Download

                    memory/3348-211-0x0000028472140000-0x0000028472148000-memory.dmp
                    Download

                    memory/3348-210-0x0000028472140000-0x0000028472148000-memory.dmp
                    Download

                    memory/3348-209-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-208-0x0000028473970000-0x0000028473F14000-memory.dmp
                    Download

                    memory/3348-207-0x0000028473390000-0x00000284733B2000-memory.dmp
                    Download

                    memory/3348-206-0x0000028472190000-0x00000284721A0000-memory.dmp
                    Download

                    memory/3348-205-0x0000028472150000-0x0000028472158000-memory.dmp
                    Download

                    memory/3348-204-0x0000028472130000-0x0000028472138000-memory.dmp
                    Download

                    memory/3348-203-0x0000028472100000-0x0000028472108000-memory.dmp
                    Download

                    memory/3348-202-0x0000028472110000-0x000002847212A000-memory.dmp
                    Download

                    memory/3656-357-0x00007FFB9E150000-0x00007FFB9E151000-memory.dmp
                    Download