721551b65afc79ef4bdf7f94e27ad3850e73cfefcfe510cb5e27dea2d3b11830

Analysis

user interaction
yes
max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KB.Android.Emulator_0.1.2_x64-setup.exe
Size 5.7MB
Sample260706-pxkrvsft4z
SHA256 721551b65afc79ef4bdf7f94e27ad3850e73cfefcfe510cb5e27dea2d3b11830
MD5 4273d239d57bb52d25304fe00d226914
SHA1 827e66cf6428407b6761c8ea231a73f0bf82de1c
SHA512 06d45118129feb86b549080c978df92fa28b23fe292f88b5b9e4dbb6bd6eaf8dae75fdda8008deb8b3c209124fe45fc3dc95c405c0cdc90d3d31cabbd3e99eff
SSDEEP 98304:tPI+KRPXHcc1knRucZFzEXGC2IApLrrgtPTftPp/alS7CN5+tu+:tPYRfccdKFWGC2Iu3mPjtPpiDzKu+
TLSH
T1565633373D50D8B6EBF690B8CCC29A8A872FEDF85784251EC7705D1C89E84634C8659B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1600	kb-android-emulator.exe
2964	fullscreen_daemon.exe

Loads dropped DLL 7 IoCs

pid	Process
4748	KB.Android.Emulator_0.1.2_x64-setup.exe
4748	KB.Android.Emulator_0.1.2_x64-setup.exe
4748	KB.Android.Emulator_0.1.2_x64-setup.exe
4748	KB.Android.Emulator_0.1.2_x64-setup.exe
4748	KB.Android.Emulator_0.1.2_x64-setup.exe
4748	KB.Android.Emulator_0.1.2_x64-setup.exe
4748	KB.Android.Emulator_0.1.2_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kb-android-emulator.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_409679429\Part-FR	msedgewebview2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5220	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KB.Android.Emulator_0.1.2_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4580	taskkill.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4748	KB.Android.Emulator_0.1.2_x64-setup.exe
4748	KB.Android.Emulator_0.1.2_x64-setup.exe
5220	powershell.exe
5220	powershell.exe
5220	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5392	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	4748	KB.Android.Emulator_0.1.2_x64-setup.exe
Token: SeImpersonatePrivilege	4748	KB.Android.Emulator_0.1.2_x64-setup.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	5220	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1600	kb-android-emulator.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 5392	1600	kb-android-emulator.exe	91
PID 5392 wrote to memory of 2504	5392	msedgewebview2.exe	92
PID 5392 wrote to memory of 752	5392	msedgewebview2.exe	94
PID 5392 wrote to memory of 752	5392	msedgewebview2.exe	94
PID 5392 wrote to memory of 752	5392	msedgewebview2.exe	94
PID 5392 wrote to memory of 752	5392	msedgewebview2.exe	94
PID 5392 wrote to memory of 2676	5392	msedgewebview2.exe	95
PID 5392 wrote to memory of 3688	5392	msedgewebview2.exe	96
PID 5392 wrote to memory of 3688	5392	msedgewebview2.exe	96
PID 5392 wrote to memory of 3688	5392	msedgewebview2.exe	96
PID 5392 wrote to memory of 4324	5392	msedgewebview2.exe	97
PID 5392 wrote to memory of 4324	5392	msedgewebview2.exe	97
PID 5392 wrote to memory of 4324	5392	msedgewebview2.exe	97
PID 5392 wrote to memory of 4324	5392	msedgewebview2.exe	97
PID 5392 wrote to memory of 4324	5392	msedgewebview2.exe	97
PID 1600 wrote to memory of 4580	1600	kb-android-emulator.exe	98
PID 1600 wrote to memory of 2964	1600	kb-android-emulator.exe	101
PID 1600 wrote to memory of 5220	1600	kb-android-emulator.exe	103
PID 5392 wrote to memory of 3784	5392	msedgewebview2.exe	107
PID 5392 wrote to memory of 3784	5392	msedgewebview2.exe	107
PID 5392 wrote to memory of 3784	5392	msedgewebview2.exe	107

C:\Users\Admin\AppData\Local\Temp\KB.Android.Emulator_0.1.2_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\KB.Android.Emulator_0.1.2_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748
- C:\Users\Admin\AppData\Local\KB Android Emulator\kb-android-emulator.exe
  "C:\Users\Admin\AppData\Local\KB Android Emulator\kb-android-emulator.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=kb-android-emulator.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1600.5516.1903256602868117828 /pfhostedapp:c0f413f801754270901a77969cf062e8fa0d9b1b
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView /prefetch:4 /pfhostedapp:c0f413f801754270901a77969cf062e8fa0d9b1b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffebb735fd8,0x7ffebb735fe4,0x7ffebb735ff0
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView" --webview-exe-name=kb-android-emulator.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1764,i,13072735242446965021,15140816862067804903,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:c0f413f801754270901a77969cf062e8fa0d9b1b
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView" --webview-exe-name=kb-android-emulator.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1764,i,13072735242446965021,15140816862067804903,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:c0f413f801754270901a77969cf062e8fa0d9b1b
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView" --webview-exe-name=kb-android-emulator.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2408 --field-trial-handle=1764,i,13072735242446965021,15140816862067804903,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c0f413f801754270901a77969cf062e8fa0d9b1b
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView" --webview-exe-name=kb-android-emulator.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3212 --field-trial-handle=1764,i,13072735242446965021,15140816862067804903,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c0f413f801754270901a77969cf062e8fa0d9b1b /prefetch:1
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView" --webview-exe-name=kb-android-emulator.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2160 --field-trial-handle=1764,i,13072735242446965021,15140816862067804903,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c0f413f801754270901a77969cf062e8fa0d9b1b
      4⤵
      PID:3784
- - C:\Windows\system32\taskkill.exe
    "taskkill" /F /IM fullscreen_daemon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- - C:\Users\Admin\AppData\Roaming\com.kb.androidemulator\fullscreen_daemon.exe
    "C:\Users\Admin\AppData\Roaming\com.kb.androidemulator\fullscreen_daemon.exe"
    3⤵
    - Executes dropped EXE
    PID:2964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "Expand-Archive -LiteralPath 'C:\Users\Admin\AppData\Local\KB Android Emulator\android-sdk\jdk\jdk.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\KB Android Emulator\android-sdk\jdk' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

java.exe

Path C:\Users\Admin\AppData\Local\KB Android Emulator\android-sdk\jdk\jdk-21.0.4+7\bin\java.exe
Size 45KB
SHA256 3b14783c431c5abe073c84a1573908844e4f406b556ca5706dc129ff74069350
MD5 051399a73d2ed44fe041b8506e5c89fd
SHA1 2dd7a059ba19291e7c84792442d2e6d083cb85a9
SHA512 ada4d12cd3871740f4bb946c3beddf942602b30b0612f09380c971a6d1e471aaa7db783616b128cd4c7c9ae954ca38fbe8aae9faed58646568643291121da31f
SSDEEP 768:GUmjFxM5R2TyJ5R3s8D/bkt5Ruz3Vb3Hw5Rn5iRBEsqER:GNvM5RdJ5R3sozkt5RA3Hw5R5iDQER
TLSH
T1E8235D876E183C81F06F84F188A7796645B4BD132BD163FABDD6B20E4C31391A81769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\KB Android Emulator\android-sdk\jdk\jdk-21.0.4+7\legal\java.desktop\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\KB Android Emulator\android-sdk\jdk\jdk-21.0.4+7\legal\java.desktop\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\KB Android Emulator\android-sdk\jdk\jdk-21.0.4+7\legal\java.desktop\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

kb-android-emulator.exe

Path C:\Users\Admin\AppData\Local\KB Android Emulator\kb-android-emulator.exe
Size 19.7MB
SHA256 ca322e53008372d17ae739031ae8759208fc72d905c1e7fa749cad642d56a4a1
MD5 284ba29230a5d9ae70218e812f1107ce
SHA1 4aeb294f345e26cb4a8ae94832d58deea437eeae
SHA512 a5a84e98cca31e60cd5ecf27fc4eff496358e56fdd83d823289fedcd862e9a4ed10d37811838b462e924a37abc3d4c9f667459c722f9ba0b1e56493d9619ee28
SSDEEP 196608:eprpYYPWiuWFI3sBjnrtJUW3/c0zvLF7dNEKRNQD74QC:mYYPWiuWFI3sBjnr4ejzzXNHNWjC
TLSH
T1392708257A5B996CD04AC47483478A720A3130DB1B39B9FF549892383F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD9E2.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD9E2.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyD9E2.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 718a3d37fa7aa1348207f37426935296db9fce5c651db41de439ff2a4707d9fe
MD5 6b05d1e09cbd5a4aebcbb29dd8698737
SHA1 fce10df05b0992e19327dc6d71d8bc5b6931428b
SHA512 b2815fc9af13a69fe81fd15ae3a58a0b86a9b3330cf186bf2b0e0878b5522a2624d5b33b15fef68f160de7d783eb165631d6d8f4548bc777b6d455b247eeacca
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9ec583af518160f55ad23397f6a8fedbba3f0ab4e3de1d5c3ef96b4354f32e40
MD5 dafb69ab785b9af9085067b0063aa14e
SHA1 7aec7295afdc5350069bb9338bdb8033fa775c35
SHA512 5816ec84b6e8b3318fb499938020ba3a25a41a301303924af749f625a2b7d254afc9e54484dc7e52eb26f0127171b8061c82bf3bac60affb5e55197fc9e5bad7
TLSH
T173D0121672024778D02021734042610D0500C10F410D40015C2D951F2A880A00D12455
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

58961c1a-133d-4580-a368-bd5327a68acc.tmp

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Default\58961c1a-133d-4580-a368-bd5327a68acc.tmp
Size 6KB
SHA256 41ee08623334d8d1bdbea1506b6fa512c0d8904de0399d3508b3d6765c0f2aab
MD5 0ed64705b2e54909cd986d023a2568c3
SHA1 a43fccbf961c237f1854057af42e645fc58d9bdd
SHA512 54c61c2475a211b99b9b3cf2783704dac328605eec2d92d597ba49c4874eb213fc8fc15224508348883a59a5732b397293961efeb8e079ecaab9720e94cf3917
SSDEEP 96:st+/dIKIUHb9Hkpo5h16Z0us7/x+6MhmuecJ5R1eje0K+gO28XM1C7K:stGqwyonusV+Fd5RQj4IG6K
TLSH
T11AD1A6066E24797B8CC6E109BA397B17E2F5603271D21E58E7F8862C05DB6CC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 fc608b51ef65c971f62c25a612adb3956dd5a2dc446970df87e028fb2a1a3ddc
MD5 68d5a3c476f606e3c11e26f01a11b6c6
SHA1 00ec6000594fdf001767f306697ec6897de8aa5d
SHA512 49012a4f54443855e2d26b26f58af17ee927b24bdb8606f160abd9bef7f2fcca99ed63dc3b84efdd1d697d95d0235f53907c2f9605dcab4880a33a38e8526536
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e168aa89fcd52e97b6ab39c38a5e78382364c6457688e5dd808fed7d3a500cb5
MD5 2569329d856f95b7445041efcdb8cb07
SHA1 e4908a45344b438534977db23e57dec64b533165
SHA512 f5f60614ee1959f34123a2c5f6682751f4ec07d795c2ba135817c088fbaffb55aeaa9fcc22003818ba9806888b9749e45bf562660edc2c37866a9eb610840a4f
TLSH
T104A0025A4A990043C55103B250E2C1D2363288A44683C77144A0167C8C643C09641010
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 d05c8933339a7e0147a6c88621146ee75825ac1e32c99b2fe91421b4d2920cab
MD5 9115725d700bfb0928581d7ed9e88c33
SHA1 6161e665d0c208e7e67608579be0cf50b0cc8f36
SHA512 7c71910e2e29469f8efdafc236995661a20728c0227e7838b4a49f5bce850509b46ad8abd3648a12a421b15122867ae81e1fc82701e59b8f06626745dff00571
TLSH
T1E5016BA2C2E4C67E8A4127E427347827CD2E091992282D2ACDE9EBDA57E1075E11060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a90e7.TMP

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Default\Network\Network Persistent State~RFe5a90e7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Local State
Size 15KB
SHA256 2d83a6dc0257b7ea4dcf5f261380bc8d5c2b425cb16ba4e943bf4a5a7ad8b1b3
MD5 b64fa775a67bed791a02e52526a68d58
SHA1 c1d94c6fcfc9d5942c3f9c1b593d3ad8e047f393
SHA512 94a4f88938686b6e80b285b7972d84fef43fee19baf115b7041d2ce2b6bc121afe4ad415b863a412d810743046db2f2be8e34187e6ea89e192d58ef50af6450e
SSDEEP 384:8srv+89zHqlDNP9oid6NBSahcUZQQORbGNk:nrv+4UNbd4qlbGNk
TLSH
T1B6728D73E47CB63799F3D505B48A6E077F7860AA96C30BA0E5985B8D02DB0C92317D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Local State
Size 2KB
SHA256 4aecbf72f1e0addb86d1244c00d411b0a7886ec8736a45bf2080dbc778f535ac
MD5 4d80a13096d7229b4cfb6699492a5769
SHA1 4efba6200a4c629c73f19b5c4e3635ddbf0e8387
SHA512 01f80e72b40c77ae5b89832ce6161efda09400d998bbba7bd0fecb48833a82dc014d7545ba1a5c8c812531ab2d47907b1417463c89eddca05def7dd1183617b2
TLSH
T169516173A858B732C9E2C6093A467E57DF369169AB932F61AADC0B1C01C765C2347C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Local State
Size 3KB
SHA256 01fdf5825533b7d757a5b499e6f3492d78b708182afaa1844dbae1c4b1c84fa9
MD5 a592316183bdd5e9bcd27a56ea459a0e
SHA1 beccec9915c3c1bd76b720e2476d3fe03036b33f
SHA512 45b3760d8ef4eef9e7e30b58d965199da268b443ec0b37c357cc455e30dcc34cad00abcc13f2d5ead7a38062dcd3f81196c74293fd7d5d1d060951fc2d9bedcc
TLSH
T13871657B5868E63789E3DA0579863F16ABA55126EAD23FA5D5EC0F0C01C72981343C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59795c.TMP

Path C:\Users\Admin\AppData\Local\com.kb.androidemulator\EBWebView\Local State~RFe59795c.TMP
Size 1KB
SHA256 81d700cc561c3cd8687fba12f4d7188b279ebd37655e98ff04560e63398ac6c7
MD5 6f6c0e1e8f76239cdfb389911820500a
SHA1 2cc4be9706c46abcf5a48698d8ce9d60ce2d9df9
SHA512 23f4e4b0e7b52ca64c3d9e18ca82cdce62ac06bb7826bd33b40d5eaf40f6a2d56081e78eeee76135ff1fe27f45165263784de79cf52a8f3442c059d781393999
TLSH
T1E83152B2D49CB732ECD6D20A3682BE97AF31507E97924F0175CC4A1D02DB19C952B933
MD5 SHA1 SHA512 TLSH

Submit Download

fullscreen_daemon.exe

Path C:\Users\Admin\AppData\Roaming\com.kb.androidemulator\fullscreen_daemon.exe
Size 232KB
SHA256 bb86b73e95bc9986ca81ed96eb339e6b030d93b959f7e7db7262dc7a42863cfe
MD5 b76099a8feb8872ebd4be6e5e4e231fa
SHA1 d3a792e33c9e097cef10c31c1690a366e13d38bd
SHA512 854f47c1426daf314173b835f7e0dabba77aab834123fc9e5397337cf1302109cdf690f286e6bfb2a2ae6b57ef808dfd120abe8b4081ec4a9b64ddd06d092f08
SSDEEP 3072:BF9SZ1/G52Y4Df1QtHsoGpRX/jQcVzMqLu1wDA0V/+VUYp0yFpP6wsZB6uQ6qlCu:BF9w1+52j5QaDWqLcwDmVxpzvZx6eC
TLSH
T1CF348E1672950CFCE967C03D82558652A533B8990B32DEFF0364423DAF67AE65E3CB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-118-0x00007FFEDD240000-0x00007FFEDD241000-memory.dmp

Download

memory/3784-1294-0x00007FFEDDCA0000-0x00007FFEDDCA1000-memory.dmp

Download

memory/3784-1295-0x00007FFEDD240000-0x00007FFEDD241000-memory.dmp

Download

memory/4324-155-0x00007FFEDD240000-0x00007FFEDD241000-memory.dmp

Download

memory/5220-278-0x0000028423D50000-0x0000028423D6E000-memory.dmp

Download

memory/5220-282-0x0000028423D50000-0x0000028423D5A000-memory.dmp

Download

memory/5220-281-0x0000028423E30000-0x0000028423E42000-memory.dmp

Download

memory/5220-280-0x0000028423E30000-0x0000028423E3A000-memory.dmp

Download

memory/5220-279-0x0000028423D70000-0x0000028423E22000-memory.dmp

Download

memory/5220-275-0x0000028423C80000-0x0000028423CA2000-memory.dmp

Download