6698bc6495e96b8a6654e96369d6ab54a64b3da5d7bfde56f164c10c2afca24d

Resubmissions

04/08/2026, 00:58

260804-bbndzaej8t8

04/08/2026, 00:54

260804-a9c58aej7s8

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteupX.exe
Size 9.6MB
Sample260804-a9c58aej7s
SHA256 6698bc6495e96b8a6654e96369d6ab54a64b3da5d7bfde56f164c10c2afca24d
MD5 7a64a333a55e69890cf627d4391df36d
SHA1 8e66eeaa6b472e8a0fb75bce7e1a67112021bd6c
SHA512 9eacc9b4d88bbd95bf318ebfec6518f1a460678da0769b9939a21ce461c328f7ebec0eb366a88bd77c7ca959d796a05a5df032369c6308f9b3981753db0752fd
SSDEEP 98304:17mM6rFGPKI/kC88D6BS0W/32wo+GPp+kc5AZP/wuBm6:1KbFK5x8hBhnh4AV/wuU6
TLSH
T19DA62920BB5A99ADC45AC47083464A726E3170CB0B35B9FF45D486792FBAAF41F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SteupX.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_455124327\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_455124327\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_455124327\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_819641371\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_72734274\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_819641371\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_455124327\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_72734274\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_72734274\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_1463380903\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1380_819641371\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SteupX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SteupX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	SteupX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SteupX.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2836	msedgewebview2.exe
2836	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1380	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5160	SteupX.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5160 wrote to memory of 1380	5160	SteupX.exe	89
PID 1380 wrote to memory of 2248	1380	msedgewebview2.exe	90
PID 1380 wrote to memory of 1992	1380	msedgewebview2.exe	91
PID 1380 wrote to memory of 1992	1380	msedgewebview2.exe	91
PID 1380 wrote to memory of 1992	1380	msedgewebview2.exe	91
PID 1380 wrote to memory of 1992	1380	msedgewebview2.exe	91
PID 1380 wrote to memory of 2804	1380	msedgewebview2.exe	92
PID 1380 wrote to memory of 4264	1380	msedgewebview2.exe	93
PID 1380 wrote to memory of 4264	1380	msedgewebview2.exe	93
PID 1380 wrote to memory of 4264	1380	msedgewebview2.exe	93
PID 1380 wrote to memory of 2796	1380	msedgewebview2.exe	94
PID 1380 wrote to memory of 2796	1380	msedgewebview2.exe	94
PID 1380 wrote to memory of 2796	1380	msedgewebview2.exe	94
PID 1380 wrote to memory of 2796	1380	msedgewebview2.exe	94
PID 1380 wrote to memory of 2796	1380	msedgewebview2.exe	94
PID 1380 wrote to memory of 2356	1380	msedgewebview2.exe	98
PID 1380 wrote to memory of 2356	1380	msedgewebview2.exe	98
PID 1380 wrote to memory of 2356	1380	msedgewebview2.exe	98
PID 1380 wrote to memory of 4052	1380	msedgewebview2.exe	99
PID 1380 wrote to memory of 4052	1380	msedgewebview2.exe	99
PID 1380 wrote to memory of 4052	1380	msedgewebview2.exe	99
PID 1380 wrote to memory of 5852	1380	msedgewebview2.exe	100
PID 1380 wrote to memory of 5852	1380	msedgewebview2.exe	100
PID 1380 wrote to memory of 5852	1380	msedgewebview2.exe	100
PID 1380 wrote to memory of 2836	1380	msedgewebview2.exe	101
PID 1380 wrote to memory of 4344	1380	msedgewebview2.exe	102
PID 1380 wrote to memory of 4344	1380	msedgewebview2.exe	102
PID 1380 wrote to memory of 4344	1380	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\SteupX.exe
"C:\Users\Admin\AppData\Local\Temp\SteupX.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5160
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5160.2188.5515033713712413197 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView /prefetch:4 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff903dc5fd8,0x7ff903dc5fe4,0x7ff903dc5ff0
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1744,i,3673756977291032751,1631280106582112601,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2112 --field-trial-handle=1744,i,3673756977291032751,1631280106582112601,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2404 --field-trial-handle=1744,i,3673756977291032751,1631280106582112601,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3416 --field-trial-handle=1744,i,3673756977291032751,1631280106582112601,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2024 --field-trial-handle=1744,i,3673756977291032751,1631280106582112601,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4324 --field-trial-handle=1744,i,3673756977291032751,1631280106582112601,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4428 --field-trial-handle=1744,i,3673756977291032751,1631280106582112601,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2032 --field-trial-handle=1744,i,3673756977291032751,1631280106582112601,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=1744,i,3673756977291032751,1631280106582112601,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a6225addc37fd13fe3c14ba4939309e6c09c9ac8a6da02d5fac94565fcb13883
MD5 1d67906ea9aa675aa7ea1beba1082c04
SHA1 94d2ae0638d903b3e6541b8cf13155dd5ea7e1fe
SHA512 1de127bf2505280a856682f87cfeae4f0b308ee2738d718b350c0a5ce84745d24dc7c942d4a9d691c7e1c851ede8996cbb59a64e77a749d43b57113cac14aa8c
TLSH
T14AD01212B2020574C8142A731523761C0840D61F400540006829C51D3B040681A06491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5005b4a234474e8422eb20adcd2aa2162de51092d72b6e4e61549eea943715e3
MD5 f9a75d170d385f8e9e93916fe0051b11
SHA1 84ad775db932f239faa34570a627ffc66629052e
SHA512 d493e369894bcf7079084c18abd64ac9144400fcedcef2d1c0dfaceee03ef481551f9a1e81f4d5fe5305eaba0e586acd927c0236105fbf627bfe518ed3ead6d2
TLSH
T1F8D00410D1050441CD0C1F71153557340550DD1C040105001411C004354101D1145054
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

20aaee21-12a9-479b-9d35-8650914ae160.tmp

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\20aaee21-12a9-479b-9d35-8650914ae160.tmp
Size 6KB
SHA256 5501ec9f81217ea3e325a5ef29397c951dbd70e1a68737304c457c8ba3e49f90
MD5 2b09b8f9454f8fbbab979f628edfb0c0
SHA1 31fb99692ab6dd31ecb8d5fc8388e33d53b05b66
SHA512 e82d57cabccd9c0e8346ab17659381c5025fad0f0cd7f28e7d2209c2ad34c3e88ad99b2f8217c2c4e15f7cf84372610d14a23c45a56218d4bd20ff54c145c396
SSDEEP 96:st9/dCjCXsMb9akEo5h16ZPZs7/x+6MhmuecpeIlI1eje1K+g6MqSj28XM1C7K:stBMKkfo+ZsV+FN1lIQjn4bSjG6K
TLSH
T1BED1B7026E24797B8CC7E109BB39BA27E2F5603271D52D58E7F8862C04DA6DD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 10c25551742b1c40a3843fed0e79e4751fb80a9e7392f4bd02debc4b941e2014
MD5 5e5062f8f209f5369cde98c7b7db3b57
SHA1 b8b68d27868332741839b64cf7764df3a9249714
SHA512 45591c4e007f25fec552f18962781e2c092adc0c0d8f9651db113baa9f16866d1d59199900e46951bfd97d0a888149eff02f1e230d04d9df294e2f1aa52c69f7
TLSH
T10CA0026506C09C8BD102D77310C5018376718C5603034742C1924679C9A4352D395120
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5985a1.TMP

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5985a1.TMP
Size 48B
SHA256 e430af836f390a6e5d02f780ee6ff4f80814011385feed9059bbe8fb7d2b7d7a
MD5 d1f539aea9bcddbef51ad92bb8c2e015
SHA1 ee15f51593e5d24ebd855975d0158aa3f0f8e7ef
SHA512 175d385d11ab2cdb46964bababb7ed1f14c121d49a2e7cd2b76b95f6e9f3ca63a9ddff244c1453b71c67fc78deed9128cfba69cddb7f80ce58cccff41f9f524d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Network\Network Persistent State
Size 358B
SHA256 c039af672e62e09591a76dc91d269bc829c515844535af68ecfbbc2a5627d3e2
MD5 02822f71c91bcc4d015525f2eddb0284
SHA1 7061b6634ba049fa0541cedc526cea2d3d13a916
SHA512 11471259804f28603f5029a3751cb078a22563693ab3f791b1891f949ac36b02d4a840a928e50c3a6c8867385090e0c155bb34ef77aa2f9ca9dbfffd30adf1e4
TLSH
T16AE0C067C3E05CBD8A4002FC26243827CB6E080A027C2D69D5E4BB9F4391478D11440F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Preferences
Size 6KB
SHA256 24b5673bef58f4b988a1a37431d09b2892777268635b7a1a9a6042596fc50b74
MD5 fb7f1c07318e37556138f4a7d1e733ac
SHA1 01ccd801e5c07099addd5e808f7d2a72ef0d66b0
SHA512 328006a9ad59375ddd1542636b52158232b1031330a47629d0b57cbb73f04962e03493f2d194c9b56e16cc4ba73e0cd1bbae1357ab58bc77a2be8772e68a869e
SSDEEP 96:st9/dCj5GXsMb9akEo5h16ZPZs7/x+6MhmuecpeIlI1eje1K+g6Mqoj28XM1C7K:stBMkkfo+ZsV+FN1lIQjn4bojG6K
TLSH
T1F2D1B6025E24797B8CC7E119BA39BA23E2F5A03261D52E58E7F8492C04DA6DD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State
Size 2KB
SHA256 be9e17582ba7d51dfbcb9f5f5a8f46c340e1b5cf848fcf093c32081cc2655789
MD5 46183f61de33ef59d3007de499064021
SHA1 0795a681411d00c7ad22aedd1e392e7b191804e1
SHA512 7607b1bee056fd0fdea91f29ba16b8fd4146e8e4ee4631dba0a2edfb88aaa0c9aab69a0190807bbb41a2baee56ca0e32270c307d17073d928941f3bc0ad7f586
TLSH
T1015195736C246F37DDB246057D863B33CE7590A69A662F219AEC1B2C02DA54D1302D3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State
Size 3KB
SHA256 5e37a9c8a5f7aed866a2e89c5a18acc9e5b3e86b9f20e8ca950c3ce762df5828
MD5 abc4672789b13ecdfd5c45d35ddf3164
SHA1 9a5c699245df1450adb4d41925d348436f4f9b00
SHA512 bb6f467a857f2dbc0dd3e0e851786b35b663dcb90f102e7f26b78eb08196f84b9ccd52eed57cdbd15c6b9370b716df19b2de01910f3d874e0d0fc6f5418d3195
TLSH
T1C661B5766D74A93B8DF28A057CC63726ABA48027E5953F61C6EC0F2C02DB28C1342D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State
Size 15KB
SHA256 bd57573bf45184e4e78f8cccd7b5f429bf929e4e06fbee82a60b4d0269b17534
MD5 7d2eada28baf259273e6bfada9d9cad5
SHA1 a9dda9521056418b21529c23cc0d220479149eb3
SHA512 32082c0186a3ca3f6edd62d041b2067887dcf662dd1c3d5fd82e46cac3d64945604d465826585d37fa472f030c67246ca81671085c1086d216e08ac23b8c6d1f
SSDEEP 384:Z+aQikB+z/xvxjg/qhEwNBSRi8Qaho2d6E769zd:E/UxvxjgC+ZQ0oO6E76Fd
TLSH
T16672AF2B99B97E27E9F7E5047D49075FCBB894A291827D784AED5F0D03C72980302917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5932de.TMP

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State~RFe5932de.TMP
Size 1KB
SHA256 e5a9a831e237c3196f7c335ae797ab0caecc135945fdfa1244322736abccb624
MD5 c7fef83a50ff9dce20405edffa9e0c7b
SHA1 549633e513c7368732fcfee2005de3de2639f968
SHA512 c415e199becc849ef7e7ce48169a947590602998d60d7479842d27da410925de62d841bc4ab3adee95492c183aa8568c57e6117b68abe04c62a6f016136f4a0a
TLSH
T1F32135F2DDB41F33ACA1121635C2773B5E3090ABD3514E10A6ED4B39439618D9626E37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1992-19-0x00007FF9255D0000-0x00007FF9255D1000-memory.dmp

Download

memory/2356-249-0x00007FF925CC0000-0x00007FF925CC1000-memory.dmp

Download

memory/2356-250-0x00007FF924790000-0x00007FF924791000-memory.dmp

Download

memory/2796-92-0x00007FF9255D0000-0x00007FF9255D1000-memory.dmp

Download

memory/2836-350-0x00000178E7E20000-0x00000178E7E21000-memory.dmp

Download

memory/2836-355-0x00000178E7E20000-0x00000178E7E21000-memory.dmp

Download

memory/2836-358-0x00000178E7E20000-0x00000178E7E21000-memory.dmp

Download

memory/2836-359-0x00000178E7E20000-0x00000178E7E21000-memory.dmp

Download

memory/2836-357-0x00000178E7E20000-0x00000178E7E21000-memory.dmp

Download

memory/2836-356-0x00000178E7E20000-0x00000178E7E21000-memory.dmp

Download

memory/2836-354-0x00000178E7E20000-0x00000178E7E21000-memory.dmp

Download

memory/2836-348-0x00000178E7E20000-0x00000178E7E21000-memory.dmp

Download