f1ffd75a034f94d5feb4ab8d2a504501de5cb832ac0129661971b0e101aa0570

Analysis

max time kernel
151s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shade.exe
Size 39.6MB
Sample260803-wevmnsdb88
SHA256 f1ffd75a034f94d5feb4ab8d2a504501de5cb832ac0129661971b0e101aa0570
MD5 a443abf332955cd8b79c45c02f1d23de
SHA1 003e67afcea78f85afb96f4fbde88cb11db37335
SHA512 9f1e0f49c674d371a36678ee1ea2f7547cd6661d8de3e26ea63c9661c4e6dd22ea334d7bc18d56b238bf247bf9cdd4753be29d88e4ac9cffec6d28c35d57d74a
SSDEEP 393216:vEy2tlFtCjL11ZlOaEwK/o16evL815tLqU8yI:vUtxCjL11ZlOaXK/o1Sv1jI
TLSH
T1CF974B11BA5B586CD19AC8B0834B8A635B2174DF0A35B9FF41C492343F7DBF46B2871A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Shade.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_137431670\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_137431670\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_536541879\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_536541879\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_536541879\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_536541879\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_536541879\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_1557987711\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5460_137431670\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3128	msedgewebview2.exe
3128	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5460	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	Shade.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 5460	2320	Shade.exe	89
PID 5460 wrote to memory of 2428	5460	msedgewebview2.exe	90
PID 5460 wrote to memory of 3296	5460	msedgewebview2.exe	91
PID 5460 wrote to memory of 3296	5460	msedgewebview2.exe	91
PID 5460 wrote to memory of 3296	5460	msedgewebview2.exe	91
PID 5460 wrote to memory of 3296	5460	msedgewebview2.exe	91
PID 5460 wrote to memory of 3172	5460	msedgewebview2.exe	92
PID 5460 wrote to memory of 4668	5460	msedgewebview2.exe	93
PID 5460 wrote to memory of 4668	5460	msedgewebview2.exe	93
PID 5460 wrote to memory of 4668	5460	msedgewebview2.exe	93
PID 5460 wrote to memory of 5380	5460	msedgewebview2.exe	94
PID 5460 wrote to memory of 5380	5460	msedgewebview2.exe	94
PID 5460 wrote to memory of 5380	5460	msedgewebview2.exe	94
PID 5460 wrote to memory of 5380	5460	msedgewebview2.exe	94
PID 5460 wrote to memory of 5380	5460	msedgewebview2.exe	94
PID 5460 wrote to memory of 2468	5460	msedgewebview2.exe	98
PID 5460 wrote to memory of 2468	5460	msedgewebview2.exe	98
PID 5460 wrote to memory of 2468	5460	msedgewebview2.exe	98
PID 5460 wrote to memory of 4112	5460	msedgewebview2.exe	99
PID 5460 wrote to memory of 4112	5460	msedgewebview2.exe	99
PID 5460 wrote to memory of 4112	5460	msedgewebview2.exe	99
PID 5460 wrote to memory of 3128	5460	msedgewebview2.exe	100
PID 5460 wrote to memory of 2728	5460	msedgewebview2.exe	101
PID 5460 wrote to memory of 2728	5460	msedgewebview2.exe	101
PID 5460 wrote to memory of 2728	5460	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\Shade.exe
"C:\Users\Admin\AppData\Local\Temp\Shade.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2320.780.4109285807781607262 /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView /prefetch:4 /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcedff5fd8,0x7ffcedff5fe4,0x7ffcedff5ff0
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,9042082162724546611,10608830499837024611,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2028 --field-trial-handle=1756,i,9042082162724546611,10608830499837024611,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1756,i,9042082162724546611,10608830499837024611,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3448 --field-trial-handle=1756,i,9042082162724546611,10608830499837024611,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=1756,i,9042082162724546611,10608830499837024611,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4580 --field-trial-handle=1756,i,9042082162724546611,10608830499837024611,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4584 --field-trial-handle=1756,i,9042082162724546611,10608830499837024611,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView" --webview-exe-name=Shade.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=1756,i,9042082162724546611,10608830499837024611,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ab0ea44c9013728ee30293c07e52cfc2a6da7957
    3⤵
    PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8be4156423b160985b5f1251f5ad7ca72863848fad12f6b4be56589257717aeb
MD5 d38c8e1b2c7b9edc286089ebcb362bdf
SHA1 8daa702805a9aa28cc2dcdf070fb9702ab8bbcfb
SHA512 d818a96648bea13c810827873ca01510fb0da6cc02d12bdbf181db2d9949258f0539f7f12370b630ee7b801d4c2997008c209dd8e5c85f9cc5e7546d23ef3d6f
TLSH
T151D0241377014174C01034730413774F0C00D10F40454040743CD51F3F040F04F07447
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 34e207e55035dbeb1ac4093fa87144139b1b0d58d810a0b0bf94c75e48c2109e
MD5 a28b354f8aa0b6a839172de43f6e215e
SHA1 f0290a12c28935a26420bcd4685c4b462b94e9bc
SHA512 f9828ffe75f8242a7c2b11981c14f4d13b1ebe7cb8c0da1c72a73f4d61ca79c5a595feccb5496a188a87d034884b4f501ba921287db8827cd7c830e9043eac24
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 37a4bc6e3ea60ac8c8a4420927cf330c982509cdd13d9130cbc3cb9069541072
MD5 54766f58468baad40ab03c630f44a26c
SHA1 0bbcc290297e575e1d2c811712dae68273fade91
SHA512 eb94609aa93d73a0410f408cd8a72134f3908b430e6e15cc6d162eff7ddeeb3fcbc7dd1dcd4de20c81a78a10d316d36d002394ed202ac0c496da04dce28ced77
TLSH
T1ECA0027059410447C1A1537066C581D033704878462B165144E52A6FDED4B919119508
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2982.TMP

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a2982.TMP
Size 48B
SHA256 d6f69520ab0348e15a9b51d409dbaefe298bdd4827c9e6d83edd14392d8ca08f
MD5 16ebd972eebc4233c5f9381f595bfde1
SHA1 2a70646d324c676ab12317993b8a4bcc0f12ea41
SHA512 1207b2fb0a398204103b9e1724755e9945a5e185b95446ce276429cc66d71f5472d32ba59fdfe6397692d467dbcc08e2c555b99e1edc47878935f7022208a638
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\Network Persistent State
Size 238B
SHA256 3a984152f56639262684ec2a65b582620ebbeb7df0cfbb804d71f221deb99dec
MD5 1622076891508cc87d79647883de8e03
SHA1 4e9cfe9e9c4e7b23d1f6bac53243da49ba15d1ca
SHA512 c3942375f04586dfcdeab5af50217f076b1309b80e8e6845ee6e941a99aa05bb6e35833dad309d406f44dcdbc856ed1a67842ed05a81e3236d033c7076428655
TLSH
T1B9D097A2427098FE8B4093A01A287903CA7E0002931C8E7ACAB9B7758AA20B9D024807
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aae62.TMP

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\Network Persistent State~RFe5aae62.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 f5501830bf3b0bac7a7cf1aa41a202fb714b4ffb956636c41b6a3fa14bc83441
MD5 4bd33c88992bd4b1265101bc0ced6fee
SHA1 50317474a52d3e29f9272f2c7e188ec28adb33f0
SHA512 49ed2f0f53393a71dec37fdd46201c96182624a894905e304cad38bc7b7893cb9c198c7271d6f288eb84a807ec0145c5d121d0339378c3c91fc19b4e5b6d05bc
TLSH
T1E4E0206341BBA46F507959551C95BD1ABA39E4350041BCF8D757852DD0511EB8213056
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a036c.TMP

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Network\TransportSecurity~RFe5a036c.TMP
Size 188B
SHA256 d7c15d3b8d690159a437fe0b555260867a61760ea606529fb641d59207a75995
MD5 43aac24fcb7eba196e3fb5eda18b5900
SHA1 b4f6599b23a7fc86cf88b5e7e1d7d75addbc4504
SHA512 13f368447634106e4d4b9c07ec7542c24c7582f3bfb51b4dde0d1bcf4afc57f4a15e67b7500838d4a37632654c2618a100002d1637d451401cbe13fbb60af5de
TLSH
T1B1C012A3407AA976607806661985BE466F76A138414299E8D6934569E0501AE5207112
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Preferences
Size 6KB
SHA256 7eafccb98c1657f123b086421380fc7b2b8877d4f81fc37bbe73b3624a75cf8e
MD5 78e1cdf982389dd649d69beab665daeb
SHA1 bb9f961f0a49afd55dd803b7e4cab4400e8558d4
SHA512 e0c6d91385f67515c5620eea8e2dac7ec3f2067ff5e0d11e08d8fbc966f4e2606ee725d3964dd98dfab31fb79c4366d4a01c74d34a86285fcf613c0f974bed8f
SSDEEP 96:stE/dM++mKIb9rk+3o5h16Z0sXs7/x+6MhmuecJscYB1eje6K+gi0s28XM1C7K:stIObEDonQsV+FdF6QjeeG6K
TLSH
T1AAD1B8015E28797B4CC6E219BA75BA1BE2F9503274D51E54E7F8892C04DB6CC6307D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Preferences
Size 6KB
SHA256 8463625e6b0ecd82baa898d8ec507275d7ab7895a5df41c271867d3a37ef20a7
MD5 39424cc72dde1d94be94e22ade455e9e
SHA1 fad157b8fb0aef318f03803503b9ef15a4c9d648
SHA512 7ab2d207aafda93d46042424814cb399d54f56b50c60faeafb0e5f587430190fa5201fb0ed2066458de059e335ca0b5b176be4469bb8c7b6e832e28384b7a236
SSDEEP 96:stE/dM++mRGIb9rk+3o5h16Z0sXs7/x+6MhmuecJscYB1eje6K+gi/d28XM1C7K:stIObyDonQsV+FdF6QjeyG6K
TLSH
T1C2D1B6025E28787B4CC7E219BA39BA1BE2F9503274D51E58E7F8992C04DB6CC6207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a0272.TMP

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Preferences~RFe5a0272.TMP
Size 5KB
SHA256 ead8fb51a2507bc114d6d99ef8ad04b0b27a039bfb3329122ff79e4e1509de28
MD5 906831a852f3e9a3ffbf3e57810ed32f
SHA1 d0fbb9d9c5a493b62c3579ff4b4f90361d1aa43f
SHA512 6afd31358003c9232b32f3c5eedb6f7baa88ae8974d0e79053f0390e407ccab328bc7593544ad1fa8c4825de48ec497a86bdf853cdb381c425d7b878adf63f1f
SSDEEP 96:rE/dM++mKIb9rkNdo616Z0sXs7/x+6MhmuecJscYB1eje6K+gij28XM1C7K:rIObEeo6QsV+FdF6QjeWG6K
TLSH
T14EC1C7025E28797B4CC6E119BA39BA1BD2F9503174D52E68E7F8992C04DA6CC6307D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State
Size 2KB
SHA256 be4548d67a37e33ad3783e69c2af9348e08164cb9be44697345eb8dad2141f71
MD5 60bebdd5185a051f6d6d8ce518e3e3cd
SHA1 a16b9e36d33e2e817ac0b9a8d9fff11f8c5770d0
SHA512 dbfc7047b6e66e764504c9823d61393ff15aae1baf9a5efd4f010dc54b8a9b77be2210e12d18d6c0c760c7a7fd35dc568989c7ce6a088c0b6f7b2ff0c43cfcc4
TLSH
T1A7517433A828AA3789F24B14790A7E2BDE7550A2BA613F209ADD1B0C41DA15D5352D3E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State
Size 3KB
SHA256 00f92b556dc59659c936dd8dfba78ac128e6396e58da4721dfc1318b35480750
MD5 86340f7001c13cf2d031296d17fdd45b
SHA1 a963d2767a6a9870a5d0e956b7291030ba90d47f
SHA512 bcde846600331f19a2db7a59aa0be24683dab009c2e4bbd6959f3a3522997ee271f50f378993be0aaff92652b68370c7e51eaa77b7d7a4714e4243340e9bde2c
TLSH
T1376187376978E5378DF39A0079463B1AAAA55063F5953F65C6EC0F0C01DB28C1352D2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State
Size 3KB
SHA256 ee7886f78f5a24e75c4caf05bce5605271c9cc0628ecd27872a5a1bced3d85c2
MD5 1646c31d337bdc5edf9c567fd100f171
SHA1 308f9e5cdb7aac837c29537a5850398a7251d770
SHA512 fdbd061e7d58212a4477d865534e88dd6857d205d3f4e724ed111c908b9056a4734a73f95f349002fb65670577d2d58f53558321dd191d44807c82dacb677078
TLSH
T118819322A978B9374DF2DA0479467F1BBAA54063E4953FA9C6EC0F0C41DB28D0342D2F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State
Size 15KB
SHA256 f10718c453fd151bcb0b8c74de5e3b219a4d30a5c2638460bf7f846afd7dd523
MD5 40baf3ec9d471213643c7f9318a5b67e
SHA1 126d2beacea7f2a401fcb3e2f39e53b8c7059dce
SHA512 c4ec14355a84ce7516cef25f06f405347c3e04e00f2014d7e8d1efca2be2017f1ae21c26de1bc2614aedddee6a1d7e07830af1fb24bf5df1d7ab50caff72b575
SSDEEP 384:E0+aQikB+z/xvxjg/qhEwNBSucIbHhN3AVdpBn9zM:K/UxvxjgC+mca73U1FM
TLSH
T10D729E27A47D7E2795F3FA04795D5B8FCBB884B2A0C13E784AAD5F0D06C72981342D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5985ff.TMP

Path C:\Users\Admin\AppData\Local\io.github.shade.app\EBWebView\Local State~RFe5985ff.TMP
Size 1KB
SHA256 12f179fb71b275f2c73525ffaad74210fc0462c1b1e948f58aa3593db0480af4
MD5 4e012a6674159f48463c1e9e0bd43ee9
SHA1 57b1750c4a7256dd5a6afdcba2e66d54fe545678
SHA512 eea6bdc6c79f2ec77219de95da937acef671b4faa625f65b3f212adf6f37a18654cb363f528fb021fcdd38e3f780b4cfa08c1d25c067f8c08ecdaba132fc5303
TLSH
T15F216572E078AB339CD15751360ABD5F6D2110B791102F0427DE8B1C51EA18DD266D39
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2468-248-0x00007FFD0E0F0000-0x00007FFD0E0F1000-memory.dmp

Download

memory/2468-247-0x00007FFD0F870000-0x00007FFD0F871000-memory.dmp

Download

memory/3128-325-0x0000020084600000-0x0000020084601000-memory.dmp

Download

memory/3128-323-0x0000020084600000-0x0000020084601000-memory.dmp

Download

memory/3128-333-0x0000020084600000-0x0000020084601000-memory.dmp

Download

memory/3128-334-0x0000020084600000-0x0000020084601000-memory.dmp

Download

memory/3128-332-0x0000020084600000-0x0000020084601000-memory.dmp

Download

memory/3128-331-0x0000020084600000-0x0000020084601000-memory.dmp

Download

memory/3128-330-0x0000020084600000-0x0000020084601000-memory.dmp

Download

memory/3128-329-0x0000020084600000-0x0000020084601000-memory.dmp

Download

memory/3296-173-0x00000274E8290000-0x00000274E8338000-memory.dmp

Download

memory/3296-24-0x00007FFD0F5F0000-0x00007FFD0F5F1000-memory.dmp

Download

memory/5380-102-0x00007FFD0F5F0000-0x00007FFD0F5F1000-memory.dmp

Download