b3833e3c0b6f83bcf36a52f28bad04199d0b0d79cc2a19bdf8fa3c925714ec26

Analysis

user interaction
yes
max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VantUpdater.exe
Size 13.0MB
Sample260719-d7m47ady2w
SHA256 b3833e3c0b6f83bcf36a52f28bad04199d0b0d79cc2a19bdf8fa3c925714ec26
MD5 a947fae5c2006aada2f07bd151de46ca
SHA1 59ccd9991b55f9e462c1f91639ac8307a85e8370
SHA512 f54e995fc4fd9f6bff7dfe03d43d092d1410278fdf951f4367565672bb6f0db2ab7911ba0db65029e1d71fe09806cfa0a5615f1a70279e6a556089071bc8f9ff
SSDEEP 98304:w7TLWaCLZ3I06iSTw9x9esCbsmR5LlXOlawFlr6KBkO+bxcQpSSpUjqQSQAx:wflCLZ3rSTw/9eHx+Qpnx
TLSH
T1C6D6E5217B5A99ACC15AC4B4834B4A724A7170CB0B35B9FF449496383F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VantUpdater.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3468	tasklist.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3544_1098304151\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3544_1098304151\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3544_986266770\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3544_986266770\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3544_986266770\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3544_1098304151\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2268	msedgewebview2.exe
2268	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3544	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3468	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4956	VantUpdater.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3544	4956	VantUpdater.exe	89
PID 3544 wrote to memory of 4504	3544	msedgewebview2.exe	90
PID 3544 wrote to memory of 2724	3544	msedgewebview2.exe	91
PID 3544 wrote to memory of 2724	3544	msedgewebview2.exe	91
PID 3544 wrote to memory of 2724	3544	msedgewebview2.exe	91
PID 3544 wrote to memory of 2724	3544	msedgewebview2.exe	91
PID 3544 wrote to memory of 3960	3544	msedgewebview2.exe	92
PID 3544 wrote to memory of 3712	3544	msedgewebview2.exe	93
PID 3544 wrote to memory of 3712	3544	msedgewebview2.exe	93
PID 3544 wrote to memory of 3712	3544	msedgewebview2.exe	93
PID 3544 wrote to memory of 2500	3544	msedgewebview2.exe	94
PID 3544 wrote to memory of 2500	3544	msedgewebview2.exe	94
PID 3544 wrote to memory of 2500	3544	msedgewebview2.exe	94
PID 3544 wrote to memory of 2500	3544	msedgewebview2.exe	94
PID 3544 wrote to memory of 2500	3544	msedgewebview2.exe	94
PID 4956 wrote to memory of 3468	4956	VantUpdater.exe	96
PID 3544 wrote to memory of 1008	3544	msedgewebview2.exe	101
PID 3544 wrote to memory of 1008	3544	msedgewebview2.exe	101
PID 3544 wrote to memory of 1008	3544	msedgewebview2.exe	101
PID 3544 wrote to memory of 2300	3544	msedgewebview2.exe	102
PID 3544 wrote to memory of 2300	3544	msedgewebview2.exe	102
PID 3544 wrote to memory of 2300	3544	msedgewebview2.exe	102
PID 3544 wrote to memory of 2268	3544	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\VantUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\VantUpdater.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VantUpdater.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4956.4976.17485317151926084250 /pfhostedapp:7ee4120ba41f4daf79770757435bc4e0e8ad7240
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView /prefetch:4 /pfhostedapp:7ee4120ba41f4daf79770757435bc4e0e8ad7240 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x140,0x194,0x7fffadba5fd8,0x7fffadba5fe4,0x7fffadba5ff0
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView" --webview-exe-name=VantUpdater.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,13800357363118443472,14958335858061331919,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7ee4120ba41f4daf79770757435bc4e0e8ad7240
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView" --webview-exe-name=VantUpdater.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1740,i,13800357363118443472,14958335858061331919,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7ee4120ba41f4daf79770757435bc4e0e8ad7240
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView" --webview-exe-name=VantUpdater.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2392 --field-trial-handle=1740,i,13800357363118443472,14958335858061331919,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ee4120ba41f4daf79770757435bc4e0e8ad7240
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView" --webview-exe-name=VantUpdater.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3360 --field-trial-handle=1740,i,13800357363118443472,14958335858061331919,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7ee4120ba41f4daf79770757435bc4e0e8ad7240 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView" --webview-exe-name=VantUpdater.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=1740,i,13800357363118443472,14958335858061331919,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ee4120ba41f4daf79770757435bc4e0e8ad7240
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView" --webview-exe-name=VantUpdater.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=1740,i,13800357363118443472,14958335858061331919,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ee4120ba41f4daf79770757435bc4e0e8ad7240
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView" --webview-exe-name=VantUpdater.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4356 --field-trial-handle=1740,i,13800357363118443472,14958335858061331919,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ee4120ba41f4daf79770757435bc4e0e8ad7240
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2268
- C:\Windows\system32\tasklist.exe
  "tasklist" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47499dba-659f-498c-b1cb-96b01bf57a95.tmp

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\47499dba-659f-498c-b1cb-96b01bf57a95.tmp
Size 16KB
SHA256 bf0aaa710021bf0991ab9e03b5c3e18294d2690b6df7546cd5548df0ffd67040
MD5 0e01e8bdbb4f0bd8b39aa4072bbe8b39
SHA1 0294dc7b33e62c59ffc54d5a502151726b81cecf
SHA512 651daaad101cf9d23799a0c5c38910a169b622be8e1f73bff666c1e94d3f2f9aa449f4bde791b39037ca0f1ae58ed997e79f840905d044ff31529b24ec7f2c51
SSDEEP 384:Ssrv+89zHqlDNP9oidWNBSo77DwF8o32INp:drv+4UNbdm/no3/Np
TLSH
T1D9727D32D968D737ADF3858AB4467A4BABB4619752C60AD0D9D91F4C82CB8DE2307D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 76c1a07ac6fe64832bc53039bb1949d0457bc35420863cc8a95532690673caa9
MD5 bcd80268733e3d8da845bfb99d491d0f
SHA1 fbba6d4452a5acd43ace24172d60841fea9bc102
SHA512 88f27563ec189876a83dd5e1ffa85d6610b2ad5a76dcb981128f41b95d1a978b39a1d28dcf4f833986c0cf03fe154c5e6509f91506771380e29d8546327ddb82
TLSH
T1F5D01213375A9134C01021330053B5480440C20B44454001D83C856E1E080610903441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 48c2878e48dafecf29a071c1e3bf99f000c62e422c8a6bb1e1d0efc540763cb4
MD5 2c9652086455735eff0299d289de7268
SHA1 7e1b5c6cbff85d84e46b9d77d80f163e3286e810
SHA512 0a89b3fdde253c3bb529c1eebe07f7c7c8da40d2f6af80497be03e7138c8f03eca7f7e05cd724c1d9b8b6cf7a3cb1a388442574a2d00705d189e0cf0e734bf50
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7f87302a267ef23e2b80227525b0407952556658c8e64e2d90b7ab42de943d4e
MD5 ed5d4735a56ef36a0ae69d48797b0e6f
SHA1 9f0af5f193681b514527ead93d73caf30d76a5f3
SHA512 b5dcb3d677002f009170f4379d9090d0769d247ea637329bdabca48dec5458f16980a2ad03950ee7e6274cdf7b9a2295ab3ed0e562fe926ddd9c629b5e205fa5
TLSH
T1CBA0027095C5C206D680037012FD124033304C7006F35B0765D400F6C955740BA45112
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598ef8.TMP

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe598ef8.TMP
Size 48B
SHA256 4209120b6fab1277e4e1076ed66e16e649374c23df7d055a4c77fbf29bde5d51
MD5 098544b68ad31d5b0d133e61b92dece3
SHA1 ddefdb2f68f65d457d1346c0c8c502ff74bd0883
SHA512 f2957a39c98b31923087abf662ff2f1854a61cf849f14e9b2b946703432657be8d623a802d044e4be1122037a281ae93c4f48ad16780b92bd9e1b952f280842c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 5307aa267b7446de3c6c7ed81f735848118edf04f77efec5b218b13b815730a6
MD5 d2a68c1a244131163373db573ba02576
SHA1 05b739496a04460443f4b2a6623d945b3e0c64e7
SHA512 a3f348dc485d2e5b6f6fa25c2eb018bb4e1bb8ea4aa0118939ccd02043a855be4d8e4ac21fae5059f0c252f44114051fc3cd1347cac0b5b799bd0ace927f8148
TLSH
T197018EA2C3D4C67E8A4166E427347813CD2F051992283D27CDE9EFDA67E2471D21050F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a5219.TMP

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Default\Network\Network Persistent State~RFe5a5219.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Default\Preferences
Size 6KB
SHA256 90c4e647bde88ec80dfa8742c742750973a58c4c1d0f4a75a204b5fffe44256f
MD5 c953a26116d631a0560ae12f066adf97
SHA1 2e19b53ba87886a95977e21736f96bc5e9d5815d
SHA512 5c13c2e147f5262d1c59692df4bb7c105fcb5e123e139c4bae0a255f7b7e1b362164f35482ffa4dc314345ab54ac2fe5bc823a4cf63bafcb81b8a3668fff334d
SSDEEP 96:st6/dCshG7Gb9k3ik+Wo5h16Z0Us7/x+6MhmuecJIcMFNjeCK+gOjUI8XM1C7K:stiId9iyonUsV+FdIc2jeNg6K
TLSH
T10DD1A6026E24697B4CC7E519BA39BB53E2F9607275951E48EBFC461C08EB6DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba92dc47-1ef0-4187-acf7-14213efff41c.tmp

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Default\ba92dc47-1ef0-4187-acf7-14213efff41c.tmp
Size 6KB
SHA256 453e2099eb4abd2223e9a7b60adb08d414b39e87211ae28f4d9387bbd9410a05
MD5 6d943fbd2009883b6b0b7673ccf2383f
SHA1 6fe322fbb24e5f6da712755a8cf18c7506af24e9
SHA512 73a31531861e9a43dc1683ab48d6e78eeeb7e86ec4999ea9671530e6a912b60ac702499d4ac1278e8636e518a9a2e01da0b18ca2b8c5bd0f1455760be00df53c
SSDEEP 96:st6/dCs67Gb9k3ikpo5h16Z0Us7/x+6MhmuecJKG1ejeCK+gOk28XM1C7K:stiIT9i+onUsV+FdKGQje7G6K
TLSH
T157D194025E28697B4CC7E119BA297A57E2F9603275D51E58E7F8461C08EA6CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Local State
Size 2KB
SHA256 3a4119b27cbc68894b6f6cae6b0bcd3c5968b1553698de2069491db9a05c373f
MD5 de31817763eb7fa84f7eb23a4950acad
SHA1 4a7fd44a94f20d0ee7ab1e2c09f19090194ae96b
SHA512 42f72b17349bce7bf510d550b08f2c29cacc9bc4543272b492932bfe62aecb9dc4aae6847593c344353d6dcd6ef461411a0a09e0d0b186a4e28f93e79a7f0a4f
TLSH
T178519573685466369AE35A4979457BA3CE35607BAB922F10D6DD070C01DB45C1307C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Local State
Size 3KB
SHA256 a8902cf073f56cf8bc7e126e8c42394a2c1da929bd19f9858c1ebfef4d080768
MD5 34e3bf51c42715fef52f278423308405
SHA1 98f5df89bae7c626779be67e8036394bd597cccd
SHA512 e57cca62a827e88c72c07b07e83a484b3d5231d9ba46c913c83c281e7057e41affb4d418c2589ebbd86a75dbccba7db283298f1b9a1079e5f672dae2dd2709fe
TLSH
T16971967759A4A93B8EE39A05B8853B56EBA5503BEAC53F55D6EC0F0C01DB2981343C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Local State
Size 15KB
SHA256 e211682a14bfab05dc77a8a635a2c86b5312b1f1a65efd7355bbf0ff5b36e35a
MD5 a96962e2dfa949aaf73e90e4fd284d7d
SHA1 55d0c49c8a1a79daee9533dd219e2f3a11a45720
SHA512 e329c4dff6e5e8e3658c67c33076d1dacc421002ebaa1aa3ddd8298dbb24c81becbd94b681f4481a2bc96399da2ad7c5961b408d7e843fc89eb44cea73e54a6a
SSDEEP 384:Dsrv+89zHqlDNP9oid6NBSo77DwPo32INp:4rv+4UNbdS/Oo3/Np
TLSH
T14072AF33E57CA7379DB38449B44A7E077F7860AB92C21BA0DA995B4D82DB4D92307D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Local State
Size 17KB
SHA256 af8563176436341c0b9326e17c80dffddc345dff50e5410a254c5e6b6b282a61
MD5 695d7b60caeca97d7f862b4223c298c8
SHA1 4414265ceb6518c147cd5d3efe6423489b77a192
SHA512 9d3fa2be581fb3a9fbc511ac9df042b3d5fbb9a848d6a9a63d0c90faa51f2a2fcb5d0f061ccff4770db2b8e4cb5f4b21f179936cb0aeefe31608a8b8d83dcd14
SSDEEP 384:+srv+89zHqlDNP9oidh3Nlo+kEDwF4moyx32INp:prv+4UNbdhkgOoyx3/Np
TLSH
T1D0828D32E868D737ECF3858AB046BA4BABB4519752C60AD0D9D91F4C82CB4DE2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe593d2e.TMP

Path C:\Users\Admin\AppData\Local\com.vant.updater\EBWebView\Local State~RFe593d2e.TMP
Size 1KB
SHA256 8c73c517efc94bbbf3460166b52bc423f39f8f76144f94c69b6044fae677e1fe
MD5 42e49f56ae623a8b3bdc61f303fefedd
SHA1 98ea6f53bc3dbabbb543ee5f1810c86d6b842cf0
SHA512 a1e116da16fae301ad005cdf3c34c16fdf8af57dbe191baf288e10b38a94a222ca49b9083349660f62c7d4e23312723cc069ae7e76df033e6568a2d12df9d24c
TLSH
T17F3162B399D45B36EDDA65467105BBCB9E20507B87820F00A2ED070D02EF45CAA2BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1008-262-0x00007FFFCEB80000-0x00007FFFCEB81000-memory.dmp

Download

memory/1008-261-0x00007FFFCEB70000-0x00007FFFCEB71000-memory.dmp

Download

memory/2268-321-0x0000013AF1050000-0x0000013AF1051000-memory.dmp

Download

memory/2268-312-0x0000013AF1050000-0x0000013AF1051000-memory.dmp

Download

memory/2268-316-0x0000013AF1050000-0x0000013AF1051000-memory.dmp

Download

memory/2268-320-0x0000013AF1050000-0x0000013AF1051000-memory.dmp

Download

memory/2268-318-0x0000013AF1050000-0x0000013AF1051000-memory.dmp

Download

memory/2268-317-0x0000013AF1050000-0x0000013AF1051000-memory.dmp

Download

memory/2268-319-0x0000013AF1050000-0x0000013AF1051000-memory.dmp

Download

memory/2268-310-0x0000013AF1050000-0x0000013AF1051000-memory.dmp

Download

memory/2500-78-0x00007FFFCFC50000-0x00007FFFCFC51000-memory.dmp

Download

memory/2724-26-0x00007FFFCFC50000-0x00007FFFCFC51000-memory.dmp

Download