0a58ca943872a8b198c42f2178943bd89a279a1139f1bbcbb0a3ede38aac3f1c

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AvatarLockpick_v3.0_win_full/AvatarLockpick.exe
Size 4.6MB
Sample260715-v84xrsdx21
SHA256 0a58ca943872a8b198c42f2178943bd89a279a1139f1bbcbb0a3ede38aac3f1c
MD5 01a4ee9f51c3445e23eb675a86dd2cd2
SHA1 b83b5142411864b402dfec5d4a19ee70ba4ed8a9
SHA512 c537633225940cc4c5ab809f7349ef2d350246f12b59b6233a4c7dc119b0dcb3d680507136e6b9b276fffb0851ba5e2250c43db5551e861d93714a3da2012b19
SSDEEP 49152:h9cdqeBBty0DAJa+qZ9cX/OsuF9LAKCk8tTEHE3YcviCaTpmvHQThB5W:Ikj1HQThB5W
TLSH
T1B6269D0273F8427AE5AFE374D4365646CBF1B8066760E7CF5640A1A96F33BD16E21322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4332	AvatarLockpick.exe
4332	AvatarLockpick.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AvatarLockpick.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1778109057\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1778109057\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1778109057\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_2049627417\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_2049627417\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4524_1277563131\LICENSE	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	msedgewebview2.exe
4796	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4524	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	AvatarLockpick.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4524	4332	AvatarLockpick.exe	87
PID 4524 wrote to memory of 5116	4524	msedgewebview2.exe	88
PID 4524 wrote to memory of 4384	4524	msedgewebview2.exe	89
PID 4524 wrote to memory of 4384	4524	msedgewebview2.exe	89
PID 4524 wrote to memory of 4384	4524	msedgewebview2.exe	89
PID 4524 wrote to memory of 4384	4524	msedgewebview2.exe	89
PID 4524 wrote to memory of 1416	4524	msedgewebview2.exe	90
PID 4524 wrote to memory of 5940	4524	msedgewebview2.exe	91
PID 4524 wrote to memory of 5940	4524	msedgewebview2.exe	91
PID 4524 wrote to memory of 5940	4524	msedgewebview2.exe	91
PID 4524 wrote to memory of 3612	4524	msedgewebview2.exe	92
PID 4524 wrote to memory of 3612	4524	msedgewebview2.exe	92
PID 4524 wrote to memory of 3612	4524	msedgewebview2.exe	92
PID 4524 wrote to memory of 3612	4524	msedgewebview2.exe	92
PID 4524 wrote to memory of 3612	4524	msedgewebview2.exe	92
PID 4524 wrote to memory of 2552	4524	msedgewebview2.exe	96
PID 4524 wrote to memory of 2552	4524	msedgewebview2.exe	96
PID 4524 wrote to memory of 2552	4524	msedgewebview2.exe	96
PID 4524 wrote to memory of 6024	4524	msedgewebview2.exe	97
PID 4524 wrote to memory of 6024	4524	msedgewebview2.exe	97
PID 4524 wrote to memory of 6024	4524	msedgewebview2.exe	97
PID 4524 wrote to memory of 4796	4524	msedgewebview2.exe	98
PID 4524 wrote to memory of 2768	4524	msedgewebview2.exe	99
PID 4524 wrote to memory of 2768	4524	msedgewebview2.exe	99
PID 4524 wrote to memory of 2768	4524	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\AvatarLockpick_v3.0_win_full\AvatarLockpick.exe
"C:\Users\Admin\AppData\Local\Temp\AvatarLockpick_v3.0_win_full\AvatarLockpick.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=AvatarLockpick.exe --webview-exe-version=3.0+5d7a4382832ed307348b988cf9576e7503756497 --user-data-dir="C:\Users\Admin\AppData\Local\Photino\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --allow-file-access-from-files --autoplay-policy=no-user-gesture-required --enable-features=MojoIpcz --enable-javascript-clipboard-access --enable-usermedia-screen-capturing --user-agent="Photino WebView" --mojo-named-platform-channel-pipe=4332.4972.9210743308771306377 /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Photino\EBWebView /prefetch:4 /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Photino\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb68285fd8,0x7ffb68285fe4,0x7ffb68285ff0
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\Photino\EBWebView" --webview-exe-name=AvatarLockpick.exe --webview-exe-version=3.0+5d7a4382832ed307348b988cf9576e7503756497 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,12604270319338907257,5961738450264487355,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\Photino\EBWebView" --webview-exe-name=AvatarLockpick.exe --webview-exe-version=3.0+5d7a4382832ed307348b988cf9576e7503756497 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1748,i,12604270319338907257,5961738450264487355,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\Photino\EBWebView" --webview-exe-name=AvatarLockpick.exe --webview-exe-version=3.0+5d7a4382832ed307348b988cf9576e7503756497 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1748,i,12604270319338907257,5961738450264487355,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\Photino\EBWebView" --webview-exe-name=AvatarLockpick.exe --webview-exe-version=3.0+5d7a4382832ed307348b988cf9576e7503756497 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3360 --field-trial-handle=1748,i,12604270319338907257,5961738450264487355,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5 /prefetch:1
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\Photino\EBWebView" --webview-exe-name=AvatarLockpick.exe --webview-exe-version=3.0+5d7a4382832ed307348b988cf9576e7503756497 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=1748,i,12604270319338907257,5961738450264487355,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\Photino\EBWebView" --webview-exe-name=AvatarLockpick.exe --webview-exe-version=3.0+5d7a4382832ed307348b988cf9576e7503756497 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=828 --field-trial-handle=1748,i,12604270319338907257,5961738450264487355,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\Photino\EBWebView" --webview-exe-name=AvatarLockpick.exe --webview-exe-version=3.0+5d7a4382832ed307348b988cf9576e7503756497 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=832 --field-trial-handle=1748,i,12604270319338907257,5961738450264487355,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\Photino\EBWebView" --webview-exe-name=AvatarLockpick.exe --webview-exe-version=3.0+5d7a4382832ed307348b988cf9576e7503756497 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1748,i,12604270319338907257,5961738450264487355,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1c2d1ba0b8713dd99e08ebbc2cad84fc49d79fa5
    3⤵
    PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8622a00a628d12e3d5028b451392d56bb0ebf4bb0ead3813c8cd8093f092ec19
MD5 1aa303b6c3e26f54641e78009e46c6cd
SHA1 9da2d7a7706c35806a36e4ec9e90a6d9b6ff79c8
SHA512 46d7d2f19c1ab199d5a8f771ea31e6651b9ddc6775c352b532d9702206c80235b2d182a6e0e466d0d211268adeb7770b6ac941551fd29933170f418e4f980460
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 aa995b9702d2e1de68409187e3d1f11caeb014c53abe2f8caa878ea55dff6418
MD5 253b34fa8bc5f426c9b8f2028d1de444
SHA1 2c2b85960c07a5bb2a8dcb799260064e5015ead7
SHA512 a48758a3c26aea49be21754a8e5e8ec072e4f1eb3bfcde8133bbadb43e271bede0f6490ae5e3cee07a47516bd676e0ccd05d2fbd2e4e08ccef2c29a7ee56151c
TLSH
T1E7D0122E3E510239C41021330212618C4400C10F404540815438C69D2B0449C1B024B1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

944790b7-ba66-4f24-9607-289c8be7b6ae.tmp

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Default\944790b7-ba66-4f24-9607-289c8be7b6ae.tmp
Size 5KB
SHA256 f60d2f9c1a024cf7ed8123267a2dcb91e9e6773be09380683b3e8fa9552a9159
MD5 e2b4d0f69b74a152aa0f4752f9b0ade7
SHA1 59c5aa797b3f79b229230e9028d0428a6e3370a1
SHA512 d79925faf387b437e4bd813ba03bceddf64c970e47f25d264d7754edaef59ce2d84da069ee4b0a3828071a11c832f497aaa3111d3bd4235c88c8105362cb8786
SSDEEP 96:stQcq/diLBCb96kto5h16Zdhs7/x+6MhmuecmjebK+gGl28XM1C7K:stQcSwHUoshsV+FijFqG6K
TLSH
T148C195025E68697B4CC6E119BA397B43E2F5603271D51E58FBF8472C09EB5DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Default\Network\Network Persistent State
Size 912B
SHA256 c3968c83131b2ac68e511d043f3184b7beeded96da175b04d74966d6db989918
MD5 e2229abb969462733b35a35ff532c966
SHA1 2d76d23d321c063fb8aa58685e4219e3d1b3e3fd
SHA512 4dc93a5a92b61ee98ac7ffe7b1fa12bc136192e428bb0d4b5541f0b7e2b95ce3121f82c595625c5a299c246867789dad09f219f225688aac2b880acac895230c
TLSH
T17E11C8B6E6D807BE855A02E41A357827CD2D140B42283C168EF6BB8F73E04B0D2102CF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a1454.TMP

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Default\Network\Network Persistent State~RFe5a1454.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

f0350fb5-3952-4d1a-beec-888dbbcbaa24.tmp

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Default\f0350fb5-3952-4d1a-beec-888dbbcbaa24.tmp
Size 6KB
SHA256 bef26e1e64aa7c7d2382ccba7d9d230bff31d751b376fb9e8561aed181937eb4
MD5 9ea8956e98855d9eb3e51bd2bb8b7cea
SHA1 6812a30d3bf2fdec7ba80de9ebb444f5fe832322
SHA512 1d1892ce6039db88ed5853468eba299a569e02a9bf1e442970ed17fe26e8d1ff968e75e9e237682256a5ef8b9797de9732dfdf656fb1ddd038ae5f8173f7a986
SSDEEP 96:stQcq/diLoGCb96kto5h16Zdhs7/x+6MhmuecmjebK+gKml28XM1C7K:stQcSwZUoshsV+FijFpG6K
TLSH
T173D195025E68697B4CC7E119BA397B43E2F5603261D11E58FBF8462C09EB5DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Local State
Size 15KB
SHA256 82cade9ecb08933aa1d9e03a0e08454ef1dfdb54611d049595e52858b8d0ea03
MD5 10139b531658e7837bdcd9f3c1920a13
SHA1 9b37c54bee0294db16fa7a013535fdffee801b76
SHA512 1ce21e1f71ce0b998161d8ddb3bed2c0dd3562bbbfbf0902c1bd075d3ccab933e5abf46a0590d4b3225e30d6e0e34c76f76bea5806f93fa5e63cb463b454ba39
SSDEEP 384:Hsrv+89zHqlDNP9oid6NBSvJFZWImHHF8H:Mrv+4UNbdDvCM
TLSH
T1E4729E33A578AA376EF38009B88A3A073F78509656D20FA4DA9C1FCD52DB5D82317D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Local State
Size 2KB
SHA256 0d46a11188f374708fb2c780ef482ab4da2cdc3f2aee9b765ecbb6fc18fc334a
MD5 4845cd1c3be6ede94feb8483228d0a58
SHA1 5fe1ad09454ffe36c184a2ecd12a56f82faf5611
SHA512 937027c5d727a195fa70a9e29bbc3b62110b25045d1f1dab67155a9acbaa1be897215ce89a8d62dda82ae1396af9ea83ad02968ed9fc19479be6b1f235d746d0
TLSH
T13951B63369545A3B9CE256047E4A3F539F7550A5AB521F10ABCC0B0C02CB64C2357C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Local State
Size 3KB
SHA256 a6ae4113c916caf0762080daa843db37219cfcb1cf97848eef895e880189aea5
MD5 cf3475a4e06acd363bd8ce3dd4dc9e7c
SHA1 6f0cac2d62558f95727326479cd0e05a82160f2f
SHA512 e13f7fc04a64da61116fbd249d19745752f7a12fdc2c5ba2b8194eb2fe6b65bc0af7dc97ab396d19f73455dfe1c1dd90d5c40ce66b9879258d41c60e85b3e3ae
TLSH
T1A571953B69A4993B5DE296047D863B47ABA55026AA913F94DBEC0F0C02C77882353C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58fedd.TMP

Path C:\Users\Admin\AppData\Local\Photino\EBWebView\Local State~RFe58fedd.TMP
Size 1KB
SHA256 21472e84a79f753f45544ec5f70fec069913472ec5aecc04d66e5871badcd109
MD5 717673709b4b2c9c6cc07109fadf6020
SHA1 3f083d1a933b0406b4046d34b3178d5bc284d1ae
SHA512 9a957a529ac287d2b6a211ce5405548df405a52d460a6c06b5e44e90fe8f264f9a7f73825bc94a96c4a48b8d72c35714dc4ec66bac8d7fca8d56dce04117e5c7
TLSH
T19331727699E44B367CD262063B427AC76F3110AA53510E04BBCD4B1D12D668C6A7BC32
MD5 SHA1 SHA512 TLSH

Submit Download

Photino.Native.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AvatarLockpick\0O0ZxZVwrOwP\Photino.Native.dll
Size 302KB
SHA256 cf0f1c43de9840e3bb022824faaa6780b6be1c62b91a6d5f9111c02bff5962c7
MD5 c026f0c300dddf5dab7dbe0b929488c2
SHA1 444142c8d8237782c64c43ee0d6b60ed008c7bc3
SHA512 ab61ba1d4aea5c79c6dd6cbea6e3cf04c70c369adcc0ae13f5ec15aeffe49dd8cded50749ed1f99463d911c7cb79bc8b435cc3b279f0492a36719e7883954352
SSDEEP 6144:KADaJM6TULnXHOhZLVMf74Zfn9mQLsfC1LPw+RMfC1VvKbb+bj585P/ZYgZkb0Qg:KAGlTAXHGeC9NLsfC1LPw+RMfC1VvKbl
TLSH
T14F644A46F7B40CA9E9BB913989538645E3B378674BA0C7DF2760431E6F237D0893A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AvatarLockpick\0O0ZxZVwrOwP\WebView2Loader.dll
Size 162KB
SHA256 462b36fd1be6ca9f7563466a89e57c41ef4a4def3e0a84fa885d203aea4a3aaf
MD5 c9a5d0f278d57d83a03404b8baeeac64
SHA1 39d44b999c1d89c36136804a373d4d427bc7d679
SHA512 97dfb08eae34624b7679a4bb07dee242b2a38324dc13b8aaec6de7f6fed477e9f9bc7474d4df9fbe907d1a460723db7177b7128a26edf5bd73d38d4d45722db6
SSDEEP 3072:fXAne8TlTRTSpL1ThTNTRyMDjRb/hy75HGRtVBviiZsZ5AalCPTxiEtJx9eg8Xjm:/yTlTRTUL1ThTNTRyeLq1GRtVBvPZsrw
TLSH
T184F36C5772E8007BE16A8274C5A34A11E777B4510B60ABEF03A447791F23BD4EE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2552-236-0x00007FFB8C130000-0x00007FFB8C131000-memory.dmp

Download

memory/2552-235-0x00007FFB8CC10000-0x00007FFB8CC11000-memory.dmp

Download

memory/3612-120-0x00007FFB8C4F0000-0x00007FFB8C4F1000-memory.dmp

Download

memory/4384-42-0x00007FFB8C4F0000-0x00007FFB8C4F1000-memory.dmp

Download

memory/4796-315-0x000001BA4AF30000-0x000001BA4AF31000-memory.dmp

Download

memory/4796-321-0x000001BA4AF30000-0x000001BA4AF31000-memory.dmp

Download

memory/4796-324-0x000001BA4AF30000-0x000001BA4AF31000-memory.dmp

Download

memory/4796-322-0x000001BA4AF30000-0x000001BA4AF31000-memory.dmp

Download

memory/4796-320-0x000001BA4AF30000-0x000001BA4AF31000-memory.dmp

Download

memory/4796-323-0x000001BA4AF30000-0x000001BA4AF31000-memory.dmp

Download

memory/4796-319-0x000001BA4AF30000-0x000001BA4AF31000-memory.dmp

Download

memory/4796-313-0x000001BA4AF30000-0x000001BA4AF31000-memory.dmp

Download