f1ffd75a034f94d5feb4ab8d2a504501de5cb832ac0129661971b0e101aa0570

Analysis

max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shade.exe
Size 39.6MB
Sample260803-wevmnsdb88
SHA256 f1ffd75a034f94d5feb4ab8d2a504501de5cb832ac0129661971b0e101aa0570
MD5 a443abf332955cd8b79c45c02f1d23de
SHA1 003e67afcea78f85afb96f4fbde88cb11db37335
SHA512 9f1e0f49c674d371a36678ee1ea2f7547cd6661d8de3e26ea63c9661c4e6dd22ea334d7bc18d56b238bf247bf9cdd4753be29d88e4ac9cffec6d28c35d57d74a
SSDEEP 393216:vEy2tlFtCjL11ZlOaEwK/o16evL815tLqU8yI:vUtxCjL11ZlOaXK/o1Sv1jI
TLSH
T1CF974B11BA5B586CD19AC8B0834B8A635B2174DF0A35B9FF41C492343F7DBF46B2871A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Shade.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302532047834200"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	msedgewebview2.exe
1960	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4068	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4148	Shade.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4068	4148	Shade.exe	88
PID 4068 wrote to memory of 3268	4068	msedgewebview2.exe	89
PID 4068 wrote to memory of 2512	4068	msedgewebview2.exe	90
PID 4068 wrote to memory of 2512	4068	msedgewebview2.exe	90
PID 4068 wrote to memory of 2512	4068	msedgewebview2.exe	90
PID 4068 wrote to memory of 1736	4068	msedgewebview2.exe	91
PID 4068 wrote to memory of 2992	4068	msedgewebview2.exe	92
PID 4068 wrote to memory of 2992	4068	msedgewebview2.exe	92
PID 4068 wrote to memory of 2740	4068	msedgewebview2.exe	93
PID 4068 wrote to memory of 2740	4068	msedgewebview2.exe	93
PID 4068 wrote to memory of 2740	4068	msedgewebview2.exe	93
PID 4068 wrote to memory of 1960	4068	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\Shade.exe
"C:\Users\Admin\AppData\Local\Temp\Shade.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4148.3476.10616124809905022038
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffaf787b078,0x7ffaf787b084,0x7ffaf787b090
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,11853284926583272986,16312208482404560204,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,11853284926583272986,16312208482404560204,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:3
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,11853284926583272986,16312208482404560204,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,11853284926583272986,16312208482404560204,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4060,i,11853284926583272986,16312208482404560204,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9afe8b9ee20bcb4430956c11802539a1f5c743d265f99403f9f158472afa4564
MD5 54304817e7287a7910729f2474a6755a
SHA1 28373249b67524d52b0fa4e53be7e94c766e4f38
SHA512 0f898e22c04a35e93f8da2754b3d15581418489c8a44e805ea6e7e011cc981dc22c706bb4c46cb63e2a78b6dd9a8229d89a251adf3968e1727154d153a37b099
TLSH
T196D0125A36024574C01034730102B6480800C60F40058100582CD91D6A050902902492
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 313cf6ca46575beb82d6a19fd5becec194b6160dd0a3ccab599907ad2fc05f8f
MD5 487fa1854acd0bfd21304c573eeb680e
SHA1 ebd27a10a3f585aaf459ecfa58732fc50297b8b9
SHA512 3af00ce65f8627f32edb7b33abf48602f1d47259ff55b9fbe44ecedf4b6cd40e56acb7bf59f07434a46c499b7eeb8a497dcbd69fb207751d27b0d3286ad5ae02
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c235a21693322027a5b955895c219cd90f5aa39ab4f2defd1ae3ca597e396734
MD5 cea41c784d033a8bd1c9574363bc8b68
SHA1 179bdd218ae8d645cd3e5eea2a39c9ed98338336
SHA512 78cd293c447e3638638357062b38e991bb88796fd3ba6400f8a0a49a5997fb968f1db5f1be7f099b3ae05807f5393964e4628d9ce3cb9087fe02c7b593a0dfb2
TLSH
T199A002104254044BC355437026C5A152373088340F2F56E294E441759CD1341D54A500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d38d325073e78ffa433677113e52d62987a896eaa3a4c8c1efdc3d5c631e1a96
MD5 eb8b21c82dd6e78cb116e792a932b227
SHA1 f8c22827beab74e3848e04a8951a909ba6bd1cdb
SHA512 307d9d77a021d152a8a57220710919d965effc8a2c08aacf8c599f025240e03ff17ec30c2993a71ef1859594c04f51496a0ca28a4860d585043b36d975249ab3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5933d8.TMP

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\Network Persistent State~RFe5933d8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 9c445208f640ec09c974ef4436e6a0a8994753193938d73b48ba8366365c9438
MD5 10a5273a09bf74b4e374d202e4ac326b
SHA1 8f67b6f11b282622aec8bb5fba40b44388baa1d4
SHA512 f78a2780e897b903e2db40cb79f1bb8ca0e606fb365d7ca03308f0a24b333059eea89834221b7b5896bd6bde8fb5431c74c8ce8c07e389dbcede127904a90858
TLSH
T100C012A3407DA57660782A291984ED456E3AA1344155BDE8A693456990502B65203052
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe588efc.TMP

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\TransportSecurity~RFe588efc.TMP
Size 188B
SHA256 b42995712285cb16d3bdc32a9b1397c4dd38be86f59a03daa114a0242f0ee4a5
MD5 b137cd1c87e626a3d4854cbc4dca523e
SHA1 af0b424f5192856e744a236e237a9338f76c1bd0
SHA512 739022cf9f02dba44963c70b34cf9afdbca276635bd532070dccc061fb3f807622f9b248eb93d061ff75d77512749b1f0fe4f028ae03988fbc6a575c8c7cc162
TLSH
T1ACC022A20039A432203806271880AD446E3EB0354041FCE882824539E0201B6430B102
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Preferences
Size 6KB
SHA256 72964a06da1e8377838f814224a88fd58251f3b350b0bf1ca33a53ccc6414ef2
MD5 9c05c06b9c5eb36bf861eba989f232ee
SHA1 7ef1cbb522a9dc1091d70e9f8c16f8d29521b032
SHA512 983c896d8f65e9f7551f1f8441bb18c59ab23c4f3f0c8d908293d76e9498a5eb70560052e0d571b926c3c2b5a776160e96f9925deb9a90fa8fa94821b12e1cdf
SSDEEP 96:st505i++b2ob9GffqIZ8i0vhEVktcm/7qx+WVHMSm+uecJNt1idQjO+gpIpMOB:st50UbqffZ8pa0F/S+WiTNtwdbMpMC
TLSH
T19EE19602AE68697B4CC7E6197A35FB16E2F6106261D50E58ABFC861C04D66CD6207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe588d85.TMP

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Preferences~RFe588d85.TMP
Size 6KB
SHA256 693f13b459790e3a1820b59a9cf22d6cb09603218602b48e82ec5a79451225a8
MD5 5ff8c601f40de2ff1b56af9757884797
SHA1 329557ff8931890efc6a0b8196e2a99fe8794765
SHA512 4c85f8a4b3436ddd0c494fbc656abb46ebc98819423fe43e2d61d28e6095aaff128d5cb5ddbbbf15a27373acdc2c4559b687e3e00ceccb6b1679e2a7676c3c98
SSDEEP 96:st505i++b2ob9nffodZ8i0oEVktcm/7qx+WVHMSm+uecJNt1idQjO+gppMEB:st50UbjfGZ8pF0F/S+WiTNtwdbPpM8
TLSH
T12BD1B6029E68797B4CC7E21D7936FB16D2FA106261D50E58EBFD891C08DA6CD6207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State
Size 4KB
SHA256 28394bea9cdd355d2e4ffeb1fd6b596c2dbdc9f564b2af3ba508cfda85bb0cee
MD5 9135afd86e39b9e4b09a871dcda7722b
SHA1 d28f84bee1d5dca81d67f4c21c838bf7ac765d66
SHA512 2cdf13c39c0a041595d61b937634be4ce75c0efbad5d9b51ee9b78132ed676578bf1ddc406ea26f31318d2021968b664376b3ada250987db21bb73c2ab2d6216
SSDEEP 96:zuEbWNkCEzfgmouSf8Frh/cInURoDoto+5eL5D5BaZw6cRZTmTTlia:zhbWNbrmkgooDUhyfaZkuD
TLSH
T129918322A5B8AA374DF3D945B9463F1ABA654023D4D5AFA8D9EC0F0C01EB38C1342D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State
Size 16KB
SHA256 1bbab339be67bd0af6a8991d420077b09185605c08dbd497a078da14e311ee95
MD5 afdcd83d1ec7b1fdb322ecd52bc8af7d
SHA1 7ff811045716eab1b631fc6439fed1257899c7ca
SHA512 fb07a0e31e421472d0f58ec96ba0df14f8280f9e7c47fa86748374bc73ec1e85fcaf99de212e0b246f78039016827f8366c82870b29f4cbb1eb55c596b120af3
SSDEEP 384:zF+aQikB+z/xvxjg/qhERNbaepxU8vC9zh:0/UxvxjgC+uou8KFh
TLSH
T149729E3B95A83E2394F7FA0579090B5FDBB584B290C16FB849E95F0D069B3981342E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State
Size 1KB
SHA256 49e4eb7f25eba2a94529852992d772adb00f1c998a1499b01367438a67ccb1b5
MD5 16f2f6f1d9da205b21ee313f94a96d17
SHA1 b70720883b8d19ef90f907ad4e72769b1ffc24f1
SHA512 af5267d3e54e61c2f33b1ee12d061fe3aafc171f3f3e90f2089ad868d80e5db07cfc902fbfcc9eabdf5540f85a09bd6c5ab76ab7b940b4de23069ec513642ccc
TLSH
T11A316572A1D82B72ACC35645B213BA6F2E21407BD154CF5461DE8B1C01FB68DD62AD3E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State
Size 2KB
SHA256 f4e34906c6e72518b78da0bd3964dc6253c6b6027267e7d135f4370dd05031b2
MD5 cb9955f136c9a7a2338e7a51fbce4f73
SHA1 b273da72b751641832ddc29b7d735e52483d67a4
SHA512 4d6f968eb1d632b6372f69e1d2acdaa2a246f2ffac3f86a5afb5ad80027f5f6f65221eddb66f196628b75b70a6350f4ab9b2d02306b737d7edda567f1ee4b98d
TLSH
T1F251C732B8986B7789D38644B9077E27AE35406296916FA095DD1F1C00EF69C6306C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State
Size 3KB
SHA256 64e3e5f3539993ba5ceafb2a1c80e65be51274fb0576e6715b48fa4554394b56
MD5 b57ed84d210bf9ed6882cc728bfa27f3
SHA1 0239a0c0009b07310515436be580e4e759d26f9f
SHA512 5a49a6079b59ad2b671485d39b95ec6ffa046ed087cace7ff3eac888b2907830a35ad6330121acaeb6c394e3d152696d9cc667514689d057cde378f2c8782e0e
TLSH
T1CE71C836A4A8A9374DE39A00B8863B1AB6614133E5C57FA4D5ED0F1C01DB7CC1302C1F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe580c9d.TMP

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State~RFe580c9d.TMP
Size 1KB
SHA256 580433ae34492b0077db292d6fccc57c901f4630275db81440b0e0f707a01d97
MD5 5dbf621d1c574185bf93de05c58bf160
SHA1 cc2e916dc395bb4162f60443d58e09dc7ccefc43
SHA512 8f47fb5a6dad3d4036c9aff20b760fcb4c7aeafc03943abccee873f71c39ae8a5baa4d55158878d9f80ac1cf2e0e3b31f8695943db0c71b484efe41c10ef88b4
TLSH
T19E214072E0D82B72AC834645B213BA4F2E20417A91448F14A1DE8A1815ABA9DD62BD3E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1960-311-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/1960-315-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/1960-310-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/1960-312-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/1960-313-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/1960-303-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/1960-304-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/1960-305-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/1960-309-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/1960-314-0x00000263469B0000-0x00000263469B1000-memory.dmp

Download

memory/2512-200-0x0000023FB0180000-0x0000023FB0321000-memory.dmp

Download

memory/2512-25-0x00007FFB13020000-0x00007FFB13021000-memory.dmp

Download

memory/2740-136-0x00007FFB13020000-0x00007FFB13021000-memory.dmp

Download

memory/2992-55-0x00007FFB12F50000-0x00007FFB12F51000-memory.dmp

Download

memory/2992-54-0x00007FFB131D0000-0x00007FFB131D1000-memory.dmp

Download