dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
Size 10.6MB
Sample260730-w95fcsep7w
SHA256 dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056
MD5 87e03580176ebacba89b18e74a6f0c48
SHA1 a4371df6d7171b8fbb19427bd2019fac2d122e0d
SHA512 b9667d4363e22c2962c5891d380d4ce6683b27d002a788fac436295de92f56ad74fbdb524d56f4ba3e7b5f3eed8f9c1ee075dd94933234122218c9ab95c688b8
SSDEEP 196608:4uny3sP1qZap2/xWxfNm/94RRTOPcTzRIaxQ9SUWCj:Dy3stqZ62gxfw4RRqPcHRIp9Pxj
TLSH
T166B6028468D092BCC4858678E64919FDF0D9788D4DF9953BFFCA88127A31D44C8FAB72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1749985626\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1695880941\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1695880941\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1695880941\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1965981903\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1965981903\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1749985626\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1749985626\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1749985626\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1965981903\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1965981903\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1965981903\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1749985626\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4712_1749985626\_metadata\verified_contents.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4712	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 4712	3396	dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe	89
PID 4712 wrote to memory of 3376	4712	msedgewebview2.exe	90
PID 4712 wrote to memory of 1972	4712	msedgewebview2.exe	91
PID 4712 wrote to memory of 1972	4712	msedgewebview2.exe	91
PID 4712 wrote to memory of 1972	4712	msedgewebview2.exe	91
PID 4712 wrote to memory of 1972	4712	msedgewebview2.exe	91
PID 4712 wrote to memory of 4640	4712	msedgewebview2.exe	92
PID 4712 wrote to memory of 3208	4712	msedgewebview2.exe	93
PID 4712 wrote to memory of 3208	4712	msedgewebview2.exe	93
PID 4712 wrote to memory of 3208	4712	msedgewebview2.exe	93
PID 4712 wrote to memory of 1416	4712	msedgewebview2.exe	94
PID 4712 wrote to memory of 1416	4712	msedgewebview2.exe	94
PID 4712 wrote to memory of 1416	4712	msedgewebview2.exe	94
PID 4712 wrote to memory of 1416	4712	msedgewebview2.exe	94
PID 4712 wrote to memory of 1416	4712	msedgewebview2.exe	94
PID 4712 wrote to memory of 1652	4712	msedgewebview2.exe	98
PID 4712 wrote to memory of 1652	4712	msedgewebview2.exe	98
PID 4712 wrote to memory of 1652	4712	msedgewebview2.exe	98
PID 4712 wrote to memory of 4360	4712	msedgewebview2.exe	99
PID 4712 wrote to memory of 4360	4712	msedgewebview2.exe	99
PID 4712 wrote to memory of 4360	4712	msedgewebview2.exe	99
PID 4712 wrote to memory of 4768	4712	msedgewebview2.exe	100
PID 4712 wrote to memory of 5252	4712	msedgewebview2.exe	101
PID 4712 wrote to memory of 5252	4712	msedgewebview2.exe	101
PID 4712 wrote to memory of 5252	4712	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe
"C:\Users\Admin\AppData\Local\Temp\dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3396.4804.1709548079942259800 /pfhostedapp:915900b9703d8b46439582793158b6160b978404
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\EBWebView /prefetch:4 /pfhostedapp:915900b9703d8b46439582793158b6160b978404 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffab4d45fd8,0x7ffab4d45fe4,0x7ffab4d45ff0
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1404,i,12984264135163792329,7020145775914960662,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:915900b9703d8b46439582793158b6160b978404
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=1404,i,12984264135163792329,7020145775914960662,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:915900b9703d8b46439582793158b6160b978404
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2332 --field-trial-handle=1404,i,12984264135163792329,7020145775914960662,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:915900b9703d8b46439582793158b6160b978404
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1404,i,12984264135163792329,7020145775914960662,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:915900b9703d8b46439582793158b6160b978404 /prefetch:1
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2072 --field-trial-handle=1404,i,12984264135163792329,7020145775914960662,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:915900b9703d8b46439582793158b6160b978404
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=1404,i,12984264135163792329,7020145775914960662,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:915900b9703d8b46439582793158b6160b978404
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4648 --field-trial-handle=1404,i,12984264135163792329,7020145775914960662,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:915900b9703d8b46439582793158b6160b978404
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\EBWebView" --webview-exe-name=dfae416e5e904de4287e723bc9d57cac90218fdce56202a3207326498b999056.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4508 --field-trial-handle=1404,i,12984264135163792329,7020145775914960662,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:915900b9703d8b46439582793158b6160b978404
    3⤵
    PID:5252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3369461c4743ee3adc8ec6775e3835954986e99aec41fe7669e12369ae2f8833
MD5 4ddd72d340175bd399bdb8682a80c2e7
SHA1 a48fb5b2135cb7be3f77e306b1f3048b562eeb2d
SHA512 9937812b026de7b9f1b3b7edf728af6868a5ad334c692d1f89db946991c2e2321f49e4fd8d4f179cbd5c9c43f8e656338fb19133d66ffef494c347fad45aa3ab
TLSH
T184D0121372224234C0202077601261081401E20FC04F4009A829855E1A450500D22453
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d641d6cdc796822e2b968eaa7109d409d712b6707d1f38bb289b8ea15c9c179c
MD5 11a3f0c5903d344260b969528c2f4954
SHA1 7e43aaa1d077010886e18204800f2c8ff7412e79
SHA512 0c62ac9a05e9b12edf6cf06637585637cabfa34fba42ab292498a7e12ddcb437cdd821959ae124a55f64a9f246cddc482fe05fb8b2c5cc98f1a1fe940801a0c6
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0335cd7c-361a-4e53-b937-16563e515420.tmp

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Network\0335cd7c-361a-4e53-b937-16563e515420.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a26e2.TMP

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Network\Network Persistent State~RFe5a26e2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 aa7fe1ffc51295039add2a05337a7aac3b0e3b6f714a3deb2d1c441fa1844467
MD5 3052fd9dc0c974e158a2a672c4d58287
SHA1 01d44ae1a829f455c6dbaa8f16aa597aec0ab081
SHA512 e621c50a62d247710278dc5b8abc10d4384fa7d331a86604934a0ec9a4cb14342f3e20b8201fb21f9c03b1b7034b94da063df0f030b39c2180b1d21e46b80002
TLSH
T1FAF024A3517AE52B202C193B1E80BC19DE36F030D195ACF8CD56896C70C16A71A12832
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe599001.TMP

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Network\TransportSecurity~RFe599001.TMP
Size 356B
SHA256 6ae7eed6d803f9602377fe631bf9f58dbf8d2b7a708eaf2353f60ec97d7e35ca
MD5 66c80c1bb37a4bcec2b9d224ab8882a0
SHA1 00bb75c59aace26d79aa0bdfb7ad0605b0ffb62e
SHA512 3b382a5be73176b1fcf79e8bdc4760af2c1649190c82e75939d509f3d99a6ea3002e0d5b0305adef715734419b7de82b4af53deb6d1c9fcf7131942fe44f9f50
TLSH
T134E020E3407AF57B142C197E0D80BD19DE39F13091955CF8D5434C6C70C16A75A13C72
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Preferences
Size 5KB
SHA256 c137d1d469479e0b61621ba9ad594032cc0dbb87e9c4a7d64e174d094ee43383
MD5 787cb0a2609df5d42080de727c4f1f35
SHA1 1f57530a5aa088914289956792b06ec533da81c9
SHA512 c23cf777c34bc42861ec4e6b1b4a09c584edee1984f863129d7038c09257eb33381d2c4adccbcc56a0538b4960919cd5058630770648bb0fd1fd30ac22ada9db
SSDEEP 96:stu/dToojrb9YkSo5h16ZZs7/x+6MhmuecmjeTK+g128XM1C7K:st2RsLo+sV+FijRbG6K
TLSH
T16EC1A6065E28687B4CC7E109BA35BA43E2FA603275D51D58EBF8472C08EB6DC6317D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Preferences
Size 5KB
SHA256 26e25e3218483071888f74f57fea591ed03b573ac0e96b91c4fa2e6c8231b756
MD5 d631aabcde18ac1b6afbca4a4f9dfc0e
SHA1 5fcfcfc46caff982be8cea757aad8a5202887bda
SHA512 ba57ac448027fc57d97793fe871ba241fd5df3c8913fee1030add89c0252b7690190db4cf1e18e229a0773bef4bd852995330183454c313021b4dbf82286e1e9
SSDEEP 96:stu/dTofGjrb9YkSo5h16ZZs7/x+6MhmuecmjeTK+go28XM1C7K:st2RyLo+sV+FijR2G6K
TLSH
T1EDC1A7065E28687B4CC7E109BA25BA43E2FA603275951E58E7F8471C08EB6DC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe599428.TMP

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Preferences~RFe599428.TMP
Size 5KB
SHA256 faddb7614e595a468913eb4cb376a3d9be06c57c75452789a96cc3aa6ae4591e
MD5 ae901e84d0c922eee7e54f0b52483699
SHA1 3c9eaf7f956bc9f6ac230896b1b79d293f256353
SHA512 e913427f167d23b7afeb7bd03f13c7bfcd3336f01cae04e9be6d31cef0a52ac2b54160fa1a0f2e105b5e125cd1ac5ab8079909e640e0166622823e379d53fc64
SSDEEP 96:ru/dToojrb9Ykcdo616ZZs7/x+6MhmuecmjeTK+gm28XM1C7K:r2RsVojsV+FijRAG6K
TLSH
T178C196065E28687B4CC7E109BA357A43D2FA643175D52D58E7F8872C08EB5DC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State
Size 2KB
SHA256 be0801aebfd667b0b4f296a9f790afbccf7960373e686f5a984ae99413206c8b
MD5 9e1333aefc3d88064dd542bd898e9e1e
SHA1 544b114ce915a5b665ba7943dccea2f044a0aed4
SHA512 e9ceaf92abca9cc6f43ce528ccb2a8040ebffd607227f2ca1c454d6719428053893935c3a5b69c645f8ac57467526f402332819eed8eb93233a9178d4e5860f5
TLSH
T13D518833A5255B778AF34648785A7F638E765095EB821F6096DC0F1C05D726C1352C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State
Size 3KB
SHA256 29fd271a4bb153ffb3f9771d440eaee5f8a1aa419ed3273442c3ba61cc0b31f3
MD5 5be1ac0dabcd171ed6b843b959d9a0e2
SHA1 4893c28f9857ec22bac44464f91dc160ed47389f
SHA512 cb62318da4651ea594ec15301151466ae79fade5fb66a81a9888df0719045510e6cadb73892f277adb77ad07992ea89e1d3952b11feba76497234d8c0c84a2bc
TLSH
T1F861A73BA5709A374EF38A04B8863B12AAA64063E5C53F64D6EC0F0C05D739C1352C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State
Size 3KB
SHA256 deba274ebc5dcdb645799a900253b71c4f3511595e8899a99d6635aa6c6096a0
MD5 05a3b9e87dfcfe47e8235da4fc9d5b6d
SHA1 ab49e3f01f19c1f1e11505064100d9d333fab876
SHA512 996303823a55db2fefc1e513ede951853d1bf0f66cccbfdc9f4a4329598c23a50fab6153ac8354b6afc2a0a1b6d9b925f8d84d683c681fc50d0c3969883483bd
TLSH
T13D717537A574AA374EF39509B8863F13AAA55063E5C57FA4D5EC0F0D05A729C0342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State
Size 3KB
SHA256 6bea481bc984f4c1c4257a3186c1ab7073ec9fb775e22d36b5b1daf4898b7cd2
MD5 b3c3fe189eb8fe96a2cf1aeb7c556157
SHA1 c8ee8685fa06f021bb36e3acc61eb44efd86d154
SHA512 4fbf859ad1398b36a4c9263acdea6872839889bd17ed618fdef70a963551edc840c7ba29af3767f00b82fd1d2bc14f87a797a07eb592724cb070ba6a043e4a5d
TLSH
T18C817537A574AA374EF3950978463F12A6A64063E5C52FA4D5EC0F0D05A729C0352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State
Size 15KB
SHA256 a41a2b1fd095ff4a7e08d1afe07982f4eb434163dcb73c2f584b4997e2f5faaa
MD5 c29c0f4846dbb001c7dc25d5bd4f6915
SHA1 d6b931569a1d4bc07148a0f45ddc9dbecaa42c06
SHA512 1dc0f3fc038b2e3cfcad3daabfec637880d8c6a55a6cf81ec907e4ca88ed5edd43f93a260fe826d99fe4c5c0f4ab806df96516b7234f4db0a73f82eec8b27275
SSDEEP 384:V+aQikB+z/xvxjg/qhEgNBSzu0fSKzisdvZ9zT:g/UxvxjgC+ru+fzisvFT
TLSH
T10572AF3B54393E2395F3E6057D5D179BDBB988B2E1C26E744AED5F0D0A872E80342C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59119a.TMP

Path C:\Users\Admin\AppData\Local\Temp\EBWebView\Local State~RFe59119a.TMP
Size 1KB
SHA256 f80ccedde974f9b08862303ab69f6feb69bf704cddfac5c2a191dc1479e79c80
MD5 604e2c33d92efefc0cecbc0d189533c2
SHA1 470efcb9fe9b0429814524222a9a642c0f9e4a80
SHA512 8437cbe6e86d99fe606c6d29aa6e7de8e6185860d33f9e4a138d4f46f7863f345d7f65ee88b3e95c51bdae850d7d8c4971f8f3737d7215113be723588613003c
TLSH
T1032162B7D2715F33ADA2225E30A67B931E6250ABD2814F0061DC0B1D0AB72ACC376C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1416-55-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download

memory/1652-255-0x00007FFAD57C0000-0x00007FFAD57C1000-memory.dmp

Download

memory/1652-254-0x00007FFAD6B80000-0x00007FFAD6B81000-memory.dmp

Download

memory/1972-30-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download

memory/3396-1-0x00007FF605560000-0x00007FF6066D5000-memory.dmp

Download

memory/4768-302-0x000002906AD30000-0x000002906AD31000-memory.dmp

Download

memory/4768-308-0x000002906AD30000-0x000002906AD31000-memory.dmp

Download

memory/4768-313-0x000002906AD30000-0x000002906AD31000-memory.dmp

Download

memory/4768-312-0x000002906AD30000-0x000002906AD31000-memory.dmp

Download

memory/4768-311-0x000002906AD30000-0x000002906AD31000-memory.dmp

Download

memory/4768-310-0x000002906AD30000-0x000002906AD31000-memory.dmp

Download

memory/4768-309-0x000002906AD30000-0x000002906AD31000-memory.dmp

Download

memory/4768-304-0x000002906AD30000-0x000002906AD31000-memory.dmp

Download