fb2f4bc078c9a87b4a85bdca339a4019410c811777b480f6c357094eec5b483b

Resubmissions

04/08/2026, 00:58

260804-bbndzaej8t8

04/08/2026, 00:54

260804-a9c58aej7s8

Analysis

max time kernel
179s
max time network
182s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voicemod_Pro_setup.exe
Size 28.1MB
Sample260804-a9c58aej7s
SHA256 fb2f4bc078c9a87b4a85bdca339a4019410c811777b480f6c357094eec5b483b
MD5 2428f87e2be4c9c09b5a23edc039e21c
SHA1 5341e4328a7d884f597455a91007b78e9e6aa632
SHA512 f7ca263ad4d74d521263569f10fba8c365c73391c9a3186638bae280fe0a85d1d19d690057d529d0a8ed85899159ee1723472bee065a67a1563f06892ab77bec
SSDEEP 786432:nmw5oSyduo4PCO1P1GCjYbtmt+E6RTQa/Ik:nrqGKO1ovb2nWMa/h
TLSH
T19657330293B7E0EBDCD1FF3B1B7AA41C95D05CC842C7A1E0A5E34F98BF25B1A55061A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4948	SteupX.exe

Loads dropped DLL 2 IoCs

pid	Process
2164	Voicemod_Pro_setup.exe
2164	Voicemod_Pro_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SteupX.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_92445046\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_711494109\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_711494109\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_711494109\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_92445046\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_92445046\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Voicemod_Pro_setup.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SteupX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SteupX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SteupX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	SteupX.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2164	Voicemod_Pro_setup.exe
2164	Voicemod_Pro_setup.exe
912	msedgewebview2.exe
912	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3128	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4948	SteupX.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 4948	2164	Voicemod_Pro_setup.exe	90
PID 4948 wrote to memory of 3128	4948	SteupX.exe	91
PID 3128 wrote to memory of 4140	3128	msedgewebview2.exe	92
PID 3128 wrote to memory of 3664	3128	msedgewebview2.exe	93
PID 3128 wrote to memory of 3664	3128	msedgewebview2.exe	93
PID 3128 wrote to memory of 3664	3128	msedgewebview2.exe	93
PID 3128 wrote to memory of 3664	3128	msedgewebview2.exe	93
PID 3128 wrote to memory of 4988	3128	msedgewebview2.exe	94
PID 3128 wrote to memory of 4284	3128	msedgewebview2.exe	95
PID 3128 wrote to memory of 4284	3128	msedgewebview2.exe	95
PID 3128 wrote to memory of 4284	3128	msedgewebview2.exe	95
PID 3128 wrote to memory of 3340	3128	msedgewebview2.exe	96
PID 3128 wrote to memory of 3340	3128	msedgewebview2.exe	96
PID 3128 wrote to memory of 3340	3128	msedgewebview2.exe	96
PID 3128 wrote to memory of 3340	3128	msedgewebview2.exe	96
PID 3128 wrote to memory of 3340	3128	msedgewebview2.exe	96
PID 3128 wrote to memory of 2604	3128	msedgewebview2.exe	99
PID 3128 wrote to memory of 2604	3128	msedgewebview2.exe	99
PID 3128 wrote to memory of 2604	3128	msedgewebview2.exe	99
PID 3128 wrote to memory of 912	3128	msedgewebview2.exe	100
PID 3128 wrote to memory of 3852	3128	msedgewebview2.exe	101
PID 3128 wrote to memory of 3852	3128	msedgewebview2.exe	101
PID 3128 wrote to memory of 3852	3128	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\Voicemod_Pro_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Voicemod_Pro_setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\SteupX\SteupX.exe
  "C:\Users\Admin\AppData\Local\SteupX\SteupX.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4948.4968.10645294399410297386 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView /prefetch:4 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x9c,0x194,0x7ffd60cb5fd8,0x7ffd60cb5fe4,0x7ffd60cb5ff0
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1764,i,9166804148078038555,9598949424156414014,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2116 --field-trial-handle=1764,i,9166804148078038555,9598949424156414014,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2436 --field-trial-handle=1764,i,9166804148078038555,9598949424156414014,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3448 --field-trial-handle=1764,i,9166804148078038555,9598949424156414014,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744 /prefetch:1
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4336 --field-trial-handle=1764,i,9166804148078038555,9598949424156414014,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4396 --field-trial-handle=1764,i,9166804148078038555,9598949424156414014,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:912
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=1764,i,9166804148078038555,9598949424156414014,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SteupX.exe

Path C:\Users\Admin\AppData\Local\SteupX\SteupX.exe
Size 9.6MB
SHA256 6698bc6495e96b8a6654e96369d6ab54a64b3da5d7bfde56f164c10c2afca24d
MD5 7a64a333a55e69890cf627d4391df36d
SHA1 8e66eeaa6b472e8a0fb75bce7e1a67112021bd6c
SHA512 9eacc9b4d88bbd95bf318ebfec6518f1a460678da0769b9939a21ce461c328f7ebec0eb366a88bd77c7ca959d796a05a5df032369c6308f9b3981753db0752fd
SSDEEP 98304:17mM6rFGPKI/kC88D6BS0W/32wo+GPp+kc5AZP/wuBm6:1KbFK5x8hBhnh4AV/wuU6
TLSH
T19DA62920BB5A99ADC45AC47083464A726E3170CB0B35B9FF45D486792FBAAF41F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nssE0B4.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nssE0B4.tmp\nsis_tauri_utils.dll
Size 29KB
SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
MD5 c5bd51b72a0de24a183585da36a160c7
SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
TLSH
T139D23818FDC83EBAD6DF1172281C4A6E559FC8080754CEABD3B15E62D4A63722EE510F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 811eaf07579a08cab0a0d430bfb9e64d413cc309fdbea0b1471f9bb75f80e6c7
MD5 01035bc586d251384de21f8b5dbf72ed
SHA1 0414658d56a3e98e77894dd7206f17253ea38e4c
SHA512 6d27348671cb2e16733bc38c01cef0853cda23ae91fecfe9359fe130edd2a3c4c5fc8d78fa86d2624d84e36f7d5837d6cdb3cf8fe2cffaf2512f2e240e8d8fba
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cdcfefba1fe4b2b47e6a9d7f2064782dfe37d0f482325036fa77a7f4ba99e947
MD5 bd38ad7ab2df3afd7655b47dd5cc8ffc
SHA1 02d86c54cd1c79ddba4ad10da1a5dbaf664d9878
SHA512 635005b5b4cfa21bb5232ddc9b248d4e697a6b583e32cf362791a0cdecec21d6fd06444f9dcf9d33d36084a7e92424eeca3478893f7647e67955de986fdd980f
TLSH
T18BD024137301433CC01030330043F10C1500D50F43074140543FD51D1F344D53D73451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

769640bb-6418-4fa3-b01e-3fa9163ac759.tmp

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\769640bb-6418-4fa3-b01e-3fa9163ac759.tmp
Size 6KB
SHA256 7947b2e163a3b25e4ce03ac94cb491f342a207ac6bd95f8051ed3d884bc979a4
MD5 847c65081fd12168c8506e63036de063
SHA1 6bfd242b1c2ba3f6c61b60f1f6708a6912a9415d
SHA512 79f6e3967d2ca6d26147436c8bfdea4313ebc1fc5af151fa0f4b5becee2fb4a125853492b0c29a907d1cf282632e53a7c628fdf54fbec390ca66387f61c93679
SSDEEP 96:stZ7/dCDJ89Bb9JkSno5h16ZPYs7/x+6Mhmuecpjm41ejeFK+g028XM1C7K:stZDMDOXno+YsV+FNjpQjfeG6K
TLSH
T1BAD1B9025E24B97B8CC7E109BA35BB17D2F5603174D62E58E7F8562C05DA6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7466bb51e595023e5cff7c46557a9f87f81df6410b1609a8cfe34d03817113f8
MD5 d2c05eb7a72be3387819f35fc4d1d7af
SHA1 506163372a8ff1020159e2726837d53f8011618f
SHA512 e19d9929de0e309093c2be131ee037d916cf4c371f2fd661613e7bd4f1c8ac842b45751285b3a72820c5b5ab3665f73a4df68c1f36568af826d25351b4016f85
TLSH
T18EA002544185480BC150537410C101817735896513032F5545F1897AAB91747831E040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4642.TMP

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a4642.TMP
Size 48B
SHA256 4a468824f24ea0cc912ac560dea90fffd30d3a0f3501750302aacf405edf6b9e
MD5 ddce36ae8f6b9e7eff7a433869f7dde5
SHA1 48e3347be77795016c0ecd2f66e1ce52c7ecc595
SHA512 674f14449f907e78c14262e5edaa41c75e492984784284e5f2614f28585409523c3205c2667157154879d075e6e8f03634d6119f242eb617638c57ceb026aa28
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Network\Network Persistent State
Size 358B
SHA256 aba9a3b8fac3871161462b020b2c76c17fc31614ba1e3898112a8466bf565c0c
MD5 4270b882e761fd0cc25aa1af2aee1c4a
SHA1 8cc2c57c6cccb50b868ab081109ad796b507bd85
SHA512 e4b3c0449089548be725dd16742dc05512c96291785e26e5ebe254564553c398af2462dfded254a43241f9bdd4fcc673dc392b25e573e67fc5432b646e0579e6
TLSH
T103E0C066C2D06CBD8A4002FC26243927CB6E0806127C2DADC5E4BF9F5391478D11444F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b0953.TMP

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Network\Network Persistent State~RFe5b0953.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Preferences
Size 6KB
SHA256 52a053997ad82a34323be96ca1365231ac95d1ee5e1b5f9eadcfcfee8e1a857c
MD5 86c17eeb564ef5a897e978626d03c71e
SHA1 284ffd94c84ab60c72b1599f2fd69e7738d80acb
SHA512 eae64dd5320f93e899d0895746665c707235ba06d89b83f2956826bc183d077f4b679e069411fb411732a6fe96ed94e28ddde31fd5082cae52308b364f56a487
SSDEEP 96:stZ7/dCDJTG9Bb9JkSno5h16ZPYs7/x+6Mhmuecpjm41ejeFK+gY28XM1C7K:stZDMDAXno+YsV+FNjpQjf2G6K
TLSH
T198D1A8025E64B97B8CC7E108BA39BB17D2F5603265D62E58E7F8562C04DA6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State
Size 15KB
SHA256 de3f09cc1e1005898170cfc42c4420f254ae64d2b501dbbc7dd68bb20241c18a
MD5 b54fc5fa7ccaab3fc54619dfc9353e6e
SHA1 a35e74c8daa527164e6bfc02c4d8d67baee6493c
SHA512 70a25548c8d963680d0b602f96a111c1d34a7dbe65392e69fb4450ff5d9287f66e2712ffbce4df32df84268b4fd8d8a7461f3454e8db375c0cea7a8517575ab2
SSDEEP 384:y+aQikB+z/xvxjg/qhECNBS71QVHYd6x799zA:d/UxvxjgC+/EQ6x79FA
TLSH
T17872AE2B5AB97E23D9F7E5043949074BDEB894B291C27E744AED6F0D02C73D81302912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State
Size 2KB
SHA256 96810ae54c5220538cd6ac8bf8d48d271e2c5df885e920b4bc6b315879901260
MD5 14f4344ab87fb36151af58c402d2985d
SHA1 d72e999791a9df20d8540af5397dc2eceb774194
SHA512 39c9d66ce2e0efafc8cf4bbb58ea113cf19656fc8c331149a0b8e5f96afa9d46688894c67501cecdef12f879d4601a3858082b0646804287f6864c1f1cea5c6a
TLSH
T1A051A7737D64A637CAE1860479873F239E7540A5EA972F60EADD0B1C01C769C1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State
Size 3KB
SHA256 f0f0446f7b10671b0ccca55dd764cc99e5bf371a5ac37e2b14ad910e1a3ad014
MD5 0b229a3fc283b46508459030f55db1b8
SHA1 d31f29ce91db6658a4237534c10ae60c64c36fda
SHA512 6ab95f2f857f6fb1e375fb129a321d377b49c66bcb188ff0b66f89ccb580e78114dfa875f5bd232b262eea41204db7505754c2cc77eaf67b583f533bac853012
TLSH
T1B36174776D74A52B8EE2DA05B9863B16ABB54027E5C63FA5DAED0F0C01D738C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59f497.TMP

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State~RFe59f497.TMP
Size 1KB
SHA256 282c5e4a1614ab0e689f0ecb49b80bacf80e436c95772ff5cc1db0c77b5716f2
MD5 27e883f977ea86102ea97a081e434540
SHA1 23ec6c6b20768f4a43e8a52e5d55795cd6bf21d8
SHA512 bc17c0d45cbb399b503c1f02acb428d06e21a04fefff7dc71c1b8e4aa4a9c9d802439478314b8e5743097f15623f089e33f0a9d08562e542701cf3adc206de0a
TLSH
T18D2187B3AD745733EC84A34631877B576E70006B92824E40F7DF8B1C02D628DA627D32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/912-306-0x00000238CF520000-0x00000238CF521000-memory.dmp

Download

memory/912-296-0x00000238CF520000-0x00000238CF521000-memory.dmp

Download

memory/912-298-0x00000238CF520000-0x00000238CF521000-memory.dmp

Download

memory/912-304-0x00000238CF520000-0x00000238CF521000-memory.dmp

Download

memory/912-307-0x00000238CF520000-0x00000238CF521000-memory.dmp

Download

memory/912-305-0x00000238CF520000-0x00000238CF521000-memory.dmp

Download

memory/912-302-0x00000238CF520000-0x00000238CF521000-memory.dmp

Download

memory/912-303-0x00000238CF520000-0x00000238CF521000-memory.dmp

Download

memory/2604-276-0x00007FFD82700000-0x00007FFD82701000-memory.dmp

Download

memory/2604-277-0x00007FFD81B00000-0x00007FFD81B01000-memory.dmp

Download

memory/3340-127-0x00007FFD82E20000-0x00007FFD82E21000-memory.dmp

Download

memory/3664-63-0x00007FFD82E20000-0x00007FFD82E21000-memory.dmp

Download