3e7e1a903414b010e9dfa97229bc2e5237378f564dd93e276fd8821a68b5493d

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app.exe
Size 6.8MB
Sample260706-1da9vsbx7t
SHA256 3e7e1a903414b010e9dfa97229bc2e5237378f564dd93e276fd8821a68b5493d
MD5 df0107f0fd956a7cf97a4280ace64857
SHA1 04aaa29809ad81af8ce9324f7b25ea320d6c1cf0
SHA512 6d38d5ada097d3b300435bd9f1d4972c7dc9e85e8097e22a5e65692c4649da7fcf394dca2217e74f74bfc2d1f7e581ce0a92b91acd94141228f842a4fe7212d3
SSDEEP 98304:jUPspzfoZn0P2lzJtvWbghIGCK1hViuqGPk3uYGPKuZSKIS43bxroJHx1wN:APSzfeEbgGGhViuql+YGCufIV3tOx2N
TLSH
T1F766D003F6A190ECC06EC5B5C31AA633E732B899493476AF57E81B212F5AF506F1D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	app.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	msedgewebview2.exe
2768	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5984	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5612	app.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 5984	5612	app.exe	87
PID 5984 wrote to memory of 2148	5984	msedgewebview2.exe	88
PID 5984 wrote to memory of 5400	5984	msedgewebview2.exe	89
PID 5984 wrote to memory of 5400	5984	msedgewebview2.exe	89
PID 5984 wrote to memory of 5400	5984	msedgewebview2.exe	89
PID 5984 wrote to memory of 5400	5984	msedgewebview2.exe	89
PID 5984 wrote to memory of 5872	5984	msedgewebview2.exe	90
PID 5984 wrote to memory of 4440	5984	msedgewebview2.exe	91
PID 5984 wrote to memory of 4440	5984	msedgewebview2.exe	91
PID 5984 wrote to memory of 4440	5984	msedgewebview2.exe	91
PID 5984 wrote to memory of 1900	5984	msedgewebview2.exe	92
PID 5984 wrote to memory of 1900	5984	msedgewebview2.exe	92
PID 5984 wrote to memory of 1900	5984	msedgewebview2.exe	92
PID 5984 wrote to memory of 1900	5984	msedgewebview2.exe	92
PID 5984 wrote to memory of 1900	5984	msedgewebview2.exe	92
PID 5984 wrote to memory of 2768	5984	msedgewebview2.exe	95

C:\Users\Admin\AppData\Local\Temp\app.exe
"C:\Users\Admin\AppData\Local\Temp\app.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=app.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5612.2152.14195190560484649999 /pfhostedapp:63e9b95843389ae9e7aa38f2cb55c5cf7e03f252
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView /prefetch:4 /pfhostedapp:63e9b95843389ae9e7aa38f2cb55c5cf7e03f252 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x50,0x168,0x18c,0x108,0x194,0x7fff00005fd8,0x7fff00005fe4,0x7fff00005ff0
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView" --webview-exe-name=app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,10073890505793554580,1435941241677153876,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:63e9b95843389ae9e7aa38f2cb55c5cf7e03f252
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView" --webview-exe-name=app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2080 --field-trial-handle=1756,i,10073890505793554580,1435941241677153876,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:63e9b95843389ae9e7aa38f2cb55c5cf7e03f252
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView" --webview-exe-name=app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1756,i,10073890505793554580,1435941241677153876,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:63e9b95843389ae9e7aa38f2cb55c5cf7e03f252
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView" --webview-exe-name=app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3380 --field-trial-handle=1756,i,10073890505793554580,1435941241677153876,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:63e9b95843389ae9e7aa38f2cb55c5cf7e03f252 /prefetch:1
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView" --webview-exe-name=app.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3992 --field-trial-handle=1756,i,10073890505793554580,1435941241677153876,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:63e9b95843389ae9e7aa38f2cb55c5cf7e03f252
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8d44c5f9bcd41ce8dc79f6d4cfc58d2b60cbfe8ec3f74e4b5ac195261073233c
MD5 41ace2f3b8850fcf68dbe1ab6a0243c7
SHA1 9f2d2daab0bcbcbd94e747d2090e237561998804
SHA512 7ed0552a13cebe480b133c05bf2398b443723ffbddd59aafb3fa2de9ce122a6dbeb1214860db4191f3a300ceea48e80bd2be9acc67b83e934fc5ad04d3fe45da
TLSH
T15ED0241777430D35C01430331713F50D0D01C15F51C54101543CC53D1F440500F03451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1f6b0095e7ae066aaf4a4e2ac00fb59f83218b4bfb8d9e6dd025f68d8973167b
MD5 389100180fc633194da811fe52b1dbc7
SHA1 8a72f4c74210d7a6c59426c4611de14b81fb21c7
SHA512 369b5324f4589dcc741363489775d2c30ea9bb8480aba873c81f40ddddd273f1fe8040639a761bb3025ed893745cd94b1b183ab17cd45cb36e759b85ea7218a7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 96343ce5d297f5daf1bb60468de1eacd57c1db872348d89c574614ac20b58cf8
MD5 3c51278cc6184060e837a3039fe7723e
SHA1 42bdf9d21f657d974caa56a9351b987b808bc197
SHA512 23bb58e379c7141bca6e230ee13b22263027db09ff605ae9e5f2b905f2cf2e59725b0741a861b8b9b8384513edf47c101ad04a933a911d005d2c3fede951e69b
TLSH
T1A9E0A9532B4B49CCE3C242FCB0FC99A1B6F600D954870ED6829800B4B695BC0820947D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592b1d.TMP

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe592b1d.TMP
Size 48B
SHA256 41261be731d3c59a5a4bcbcca5899cf75fa9cdab9cf0b3a1e3cc3479d96cab04
MD5 e0757d3904a227c63a1a0c8390ac5b3c
SHA1 9e0832444a1301c028ac36685fc6587e5e5b3bf6
SHA512 8e6795ebca909a5dd3ab4a81f05c0ad6ba5ff391601a6d9f99a5d573041136e4067ba51a2aceba370f7adf0baced7859703e318a08dcc2ad6f0a83a5da6fb529
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Default\Network\Network Persistent State
Size 235B
SHA256 a5c1ce4668f24190907cb72603d0d345d50b1cbd2517fbb626319e116e0e54c7
MD5 18190e1523a0aeef11ca176a044f6555
SHA1 89ae5c8b2801f967c697bcad0f34bc29b64ed0d8
SHA512 d6f6aabd2b31fdf912620bc068445b28fcbf3ee519ef1af1733c18fc47a1a9848c80a2c4bdde1e5989514020199b3acf7eedbcffe38b68559c5614c932326801
TLSH
T117D097A2827098FE478083E01A247807CA7E0003531C8EBACAB8B7764AA20B8E020807
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f090.TMP

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Default\Network\Network Persistent State~RFe59f090.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Default\Preferences
Size 6KB
SHA256 133dc5f34f37f78274a9ad064313f2846622edb5703d6b09492b0b635f0504db
MD5 9a701f20efc58b77d2904c017c3d0830
SHA1 b6a1c1d6ed54e8b14cd7fe0e30e09421ca85c100
SHA512 09088883e261fbc5bf4edb0a49d58ab514c6df5f1d242ca01501b7f2443134563a63db8cafdfa968139a36abb8cc5f106f56cf5b5bb4d28b55c11cfd73c9ac49
SSDEEP 96:stO/dpnBGEb92kuo5h16Z0Is7/x+6MhmuecJO01ejeTK+gWbB28XM1C7K:stWrQBonIsV+FdO0Qj1EbBG6K
TLSH
T105D1A5025E24A97B4CCBE619BA397B17E3F5607265E51E48EBF8461C05DBACC330790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fb9db805-9473-40a4-963b-8c9090487055.tmp

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Default\fb9db805-9473-40a4-963b-8c9090487055.tmp
Size 6KB
SHA256 bdb4b681dc9221911b2e87757053ae7b6a9d42e2b354b8c824a359ee2d9a5eb9
MD5 6f4a7737fdc932331b93b8445e1d03d6
SHA1 3d68cc456e661e6c46ee0cdc35fb42d278e13fa8
SHA512 a1826ea115cc07089363bb69f8d3e3f5991fa158addcc822aef53c49b0c8dedb1a5cc7d9e50b8d101bc7e19f2325ad0ed3954b83d965a9007c0ec933b26654d0
SSDEEP 96:stO/dpnaEb92kuo5h16Z0Is7/x+6MhmuecJO01ejeTK+gWG028XM1C7K:stWrmBonIsV+FdO0Qj1EG0G6K
TLSH
T191D1A6025E24A97B4CCBE519BA357B07E3F5607265D51E58E7F8461C05DBACC330790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Local State
Size 15KB
SHA256 9d36c2a6b3d1588fbcdcaa73315d71175542e997c8f06d431d95d0c8aa509a6a
MD5 795e2c158eb64e28dff849e1fc332ed9
SHA1 3c13241d95832e9c507e80468f1025a5821b9905
SHA512 a5e0c21ed24791a03a4f46f7ee5754ee559d8c5e8a9612ec42e3923ef8b596b992f2d50f8da7c5f5f4663faa1869f254a6ec3ed03def1855b4970f81aa01bf88
SSDEEP 384:Xsrv+89zHqlDNP9oid6NBS99J3RS7sOQ6NA:crv+4UNbdv912RNA
TLSH
T17C729E33A938A6379DF3D548B4866A0B7FB860A666C21BA0D4D51B8D42DF0C92317E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Local State
Size 2KB
SHA256 e5949fb04bd5d7a2b61163c82610720ca681d67946740c522ea4a86a9138817b
MD5 0cffd2e1a31dd84a5f2f24abc9badd09
SHA1 5b2f00dc00c9b5b85287102331126475b9e5f99e
SHA512 5e0e3daf31f5757aa47d0865b101136c2fd249d4bf308f23133fa623bbd474c698458b89ae404cb7d52b55443e7303de8563a461c25ccb88a61227fa7dc9be31
TLSH
T1805182736D10AA3B98F38A4979567F67DB759071ABA22F90AADD0B0C01DB51D1307C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Local State
Size 3KB
SHA256 7b98a71ff643b5b3d32f149e72383a20701a2a14b3f89787b23634128c03f0e4
MD5 b5c3c7026c83d8ca5d29c7d48365e29d
SHA1 ae235a20837a8852f34777a604a7cb97bcb80257
SHA512 024ad54ca2f5f5dd288c6059d965a3a4421d2eb7b654cbd611d4011e9bd444501cb99e26fdf79f80dc8dd141aa0d5ad98d83d68a3b289047db0bb3c021d0765e
TLSH
T1C77182776960A93B4DF3CE45B9922B1AE7A55036EAD27FA4E5EC0F0C02D72981343C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58d8a8.TMP

Path C:\Users\Admin\AppData\Local\com.madlion.fgg\EBWebView\Local State~RFe58d8a8.TMP
Size 1KB
SHA256 1280be9b7a795422d3ff5333071333ac76dad75840b9e96650b9d76605313e10
MD5 3225f2a2571ad8f08071aead33ebce13
SHA1 606442409b313267fb63d7cf773311969e639129
SHA512 8225ecc7aec5a3a28ccebc50d8c478d84638f036e6a2178a09ec79d4a1dce405c057e205636ef1b118793231234ae247655f9be6d50dfff8ff191e29cb643f03
TLSH
T1553196B399506733ACE69E863152BF8BAF21503A63A14F40B1DE471802DB04D572BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1900-96-0x00007FFF21DA0000-0x00007FFF21DA1000-memory.dmp

Download

memory/2768-273-0x000002A985E90000-0x000002A985E91000-memory.dmp

Download

memory/2768-275-0x000002A985E90000-0x000002A985E91000-memory.dmp

Download

memory/2768-281-0x000002A985E90000-0x000002A985E91000-memory.dmp

Download

memory/2768-284-0x000002A985E90000-0x000002A985E91000-memory.dmp

Download

memory/2768-283-0x000002A985E90000-0x000002A985E91000-memory.dmp

Download

memory/2768-279-0x000002A985E90000-0x000002A985E91000-memory.dmp

Download

memory/2768-282-0x000002A985E90000-0x000002A985E91000-memory.dmp

Download

memory/2768-280-0x000002A985E90000-0x000002A985E91000-memory.dmp

Download

memory/5400-207-0x000001A6AFD70000-0x000001A6AFEC9000-memory.dmp

Download

memory/5400-26-0x00007FFF21DA0000-0x00007FFF21DA1000-memory.dmp

Download