fb2f4bc078c9a87b4a85bdca339a4019410c811777b480f6c357094eec5b483b

Resubmissions

04/08/2026, 00:58

260804-bbndzaej8t8

04/08/2026, 00:54

260804-a9c58aej7s8

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voicemod_Pro_setup.exe
Size 28.1MB
Sample260804-bbndzaej8t
SHA256 fb2f4bc078c9a87b4a85bdca339a4019410c811777b480f6c357094eec5b483b
MD5 2428f87e2be4c9c09b5a23edc039e21c
SHA1 5341e4328a7d884f597455a91007b78e9e6aa632
SHA512 f7ca263ad4d74d521263569f10fba8c365c73391c9a3186638bae280fe0a85d1d19d690057d529d0a8ed85899159ee1723472bee065a67a1563f06892ab77bec
SSDEEP 786432:nmw5oSyduo4PCO1P1GCjYbtmt+E6RTQa/Ik:nrqGKO1ovb2nWMa/h
TLSH
T19657330293B7E0EBDCD1FF3B1B7AA41C95D05CC842C7A1E0A5E34F98BF25B1A55061A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5908	SteupX.exe

Loads dropped DLL 2 IoCs

pid	Process
5736	Voicemod_Pro_setup.exe
5736	Voicemod_Pro_setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SteupX.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1270299598\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1270299598\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1270299598\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1270299598\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1270299598\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1270299598\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_916795893\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_916795893\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_916795893\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_916795893\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_916795893\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Voicemod_Pro_setup.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SteupX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SteupX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	SteupX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SteupX.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5736	Voicemod_Pro_setup.exe
5736	Voicemod_Pro_setup.exe
5572	msedgewebview2.exe
5572	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
248	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5908	SteupX.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5736 wrote to memory of 5908	5736	Voicemod_Pro_setup.exe	89
PID 5908 wrote to memory of 248	5908	SteupX.exe	90
PID 248 wrote to memory of 5904	248	msedgewebview2.exe	91
PID 248 wrote to memory of 1980	248	msedgewebview2.exe	92
PID 248 wrote to memory of 1980	248	msedgewebview2.exe	92
PID 248 wrote to memory of 1980	248	msedgewebview2.exe	92
PID 248 wrote to memory of 1980	248	msedgewebview2.exe	92
PID 248 wrote to memory of 3184	248	msedgewebview2.exe	93
PID 248 wrote to memory of 4856	248	msedgewebview2.exe	94
PID 248 wrote to memory of 4856	248	msedgewebview2.exe	94
PID 248 wrote to memory of 4856	248	msedgewebview2.exe	94
PID 248 wrote to memory of 6120	248	msedgewebview2.exe	95
PID 248 wrote to memory of 6120	248	msedgewebview2.exe	95
PID 248 wrote to memory of 6120	248	msedgewebview2.exe	95
PID 248 wrote to memory of 6120	248	msedgewebview2.exe	95
PID 248 wrote to memory of 6120	248	msedgewebview2.exe	95
PID 248 wrote to memory of 5776	248	msedgewebview2.exe	99
PID 248 wrote to memory of 5776	248	msedgewebview2.exe	99
PID 248 wrote to memory of 5776	248	msedgewebview2.exe	99
PID 248 wrote to memory of 5572	248	msedgewebview2.exe	100
PID 248 wrote to memory of 3108	248	msedgewebview2.exe	101
PID 248 wrote to memory of 3108	248	msedgewebview2.exe	101
PID 248 wrote to memory of 3108	248	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\Voicemod_Pro_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Voicemod_Pro_setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Users\Admin\AppData\Local\SteupX\SteupX.exe
  "C:\Users\Admin\AppData\Local\SteupX\SteupX.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5908.240.16540232449912871228 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView /prefetch:4 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x140,0x194,0x7ffe2aba5fd8,0x7ffe2aba5fe4,0x7ffe2aba5ff0
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1848 --field-trial-handle=1868,i,5105697151797669618,5872348980407712161,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1984 --field-trial-handle=1868,i,5105697151797669618,5872348980407712161,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1868,i,5105697151797669618,5872348980407712161,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3468 --field-trial-handle=1868,i,5105697151797669618,5872348980407712161,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=820 --field-trial-handle=1868,i,5105697151797669618,5872348980407712161,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4424 --field-trial-handle=1868,i,5105697151797669618,5872348980407712161,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView" --webview-exe-name=SteupX.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=1868,i,5105697151797669618,5872348980407712161,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6990462dabad1bb125e032def195bfd38c5d3744
      4⤵
      PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SteupX.exe

Path C:\Users\Admin\AppData\Local\SteupX\SteupX.exe
Size 9.6MB
SHA256 6698bc6495e96b8a6654e96369d6ab54a64b3da5d7bfde56f164c10c2afca24d
MD5 7a64a333a55e69890cf627d4391df36d
SHA1 8e66eeaa6b472e8a0fb75bce7e1a67112021bd6c
SHA512 9eacc9b4d88bbd95bf318ebfec6518f1a460678da0769b9939a21ce461c328f7ebec0eb366a88bd77c7ca959d796a05a5df032369c6308f9b3981753db0752fd
SSDEEP 98304:17mM6rFGPKI/kC88D6BS0W/32wo+GPp+kc5AZP/wuBm6:1KbFK5x8hBhnh4AV/wuU6
TLSH
T19DA62920BB5A99ADC45AC47083464A726E3170CB0B35B9FF45D486792FBAAF41F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw4658.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw4658.tmp\nsis_tauri_utils.dll
Size 29KB
SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
MD5 c5bd51b72a0de24a183585da36a160c7
SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
TLSH
T139D23818FDC83EBAD6DF1172281C4A6E559FC8080754CEABD3B15E62D4A63722EE510F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d4abcc06ddb3618a76cec625c2ccd53959ab02db8ef95b378b2d078f32cee2a9
MD5 4c8fb9afb042168a33263c8e9f60e412
SHA1 8d761eb636ea41a3dd56eb59269f9a4d84016545
SHA512 75631b394664cf2aa344e00ac4875bf4788bdcc59a6980046512e8447d4ea25b25664ef7a351c6ecc95530d8a5d9f682b6a3eae424f8b4a87a07110428925e4d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f5596a12feffe2a701793c100d342ad734cb539f7120eff2d6b57c6a98bdbc8c
MD5 9fef6c8725ae61ed1b8a1093e1b4f041
SHA1 909cb91e5c9369c08892602ed01e1b8058e68cf3
SHA512 3764df28a6c192baf3790c5001803b9b399f4e24e64a08be593ece52d4abedb245071fd086f835535e2cd23fa387df142a0f1bcfe71bd7283e88683eceeaefdb
TLSH
T1EFD0241F37110574C45030330103F50C04C1C10F4007C030543CD51D5F040744D03443
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8a76e9e377cf987597a4b757800026d3b620cf0dbdf01cd74b951e8a98043a52
MD5 b38554a67d7bc8245768da81c1f70115
SHA1 bb8bcab21212b8d526a6e8536be354f9dd5927a9
SHA512 93f2eded748a876a692a10f96836834c15f34f19414de190e83ae216b535d72ca54463a9b2ce868db97cc33bdb45e8464ee833d7617cbed93c2d5b47e4d81976
TLSH
T141A002A022952867D140837466C652C1723488510243575585D14C74C9553D29327444
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59acff.TMP

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59acff.TMP
Size 48B
SHA256 fbb5d7526062f9191214dc5167a10e2968ce504196adc6cf38ae758d9d3f4541
MD5 00bfb6af57dcf70077818b8a4c5f149d
SHA1 9042df52fc09fa09f102fd0dd6e7d1ca6c913c7a
SHA512 2fbad0d4dd9f805aa33efe9e54e3d38edb8e8add1c1589f588e6156cb20c4f9bf21b0747e1ab6c81daff2b0329554117ad0fa4f953e943784a6b5a482c97c9bf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Network\Network Persistent State
Size 358B
SHA256 7c77a3cef0c4a256e1c2f715bd75abe547d303014ef2cd23cf2a40d71f9ad51f
MD5 792217d557af0592fe0dc2b74aae5b49
SHA1 1605d2184695750aeac99857ad4cf725671c791e
SHA512 75cc134bac58f124c369fa1602711cd14ae4828a566ff6099aaa894e12102b32b48428bcf8b6dc8e02e6db2f429e1792d763c512635881eb1875ccb1faea1c5a
TLSH
T1C7E0C0A6C2E45CFD4A4003FC26243817CBBF0806427C2DAAC5E4BB9B4391078D11440B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Preferences
Size 6KB
SHA256 96be67afd748dd3016522470d6c688ff2f65236babb51eb1054d58c580bab090
MD5 9ee38678a9ccc6c48d0b24de71c85fd2
SHA1 691546b0ab02d71b5ba9028add866fab095850a8
SHA512 b64ff3c5364533e60fb80139ff58e1a6729d383e9d7562cf08d2e94d6bc53dca6983a1d12114032d057701dd17c2dcc96cf21b4d673d25d2037fdb001462e65f
SSDEEP 96:stc/dCFvGrb9bkVo5h16ZPos7/x+6MhmuecpZ+1ejecK+gs28XM1C7K:stQM6Go+osV+FNZ+QjkuG6K
TLSH
T138D1C8066E647C7B4CCBE118BA297B17E2F5603265D11E68E7FC5A2C04DB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dc958f45-b0a6-4a96-992c-33a24495428e.tmp

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\dc958f45-b0a6-4a96-992c-33a24495428e.tmp
Size 6KB
SHA256 314179c7b7f582be3472edaff74f6c170504836be04ddea1ee0999bfaa6ed8a7
MD5 25d9694c208f86a0b6a2265eabd04e56
SHA1 a7838c08f1ace7ae3f0e152604b347c50d82172b
SHA512 82b20e498cc3e2a47f5a550fe44e3a27f3424b9461a91c4e3f8a1aee74ba458cec03c295760543b439c596a378eb8217207cc18111b05d665ff116cc4d8ce3c0
SSDEEP 96:stc/dCFYrb9bkVo5h16ZPos7/x+6MhmuecpZ+1ejecK+gR28XM1C7K:stQM4Go+osV+FNZ+Qjk7G6K
TLSH
T1FED1B7066E6479BB4CCBE108BA29BA07E2F5603265D11E68E7F8562C04DB6DC6307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Default\shared_proto_db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State
Size 15KB
SHA256 077bf917fde01704b62857e5de364e538d1c101ccb314d2bf7149bb363350623
MD5 f28ee7222d241929d72bd4afb1c16312
SHA1 bcbdd7686d7c7c6ed38a09087d93c731e36fea64
SHA512 c4aa877391cba27faeec0b598edda13feb9872b2eb05b22a0f526a2549309e092ecb04bf400696860c03541ee11f02113fe6b56d9466909d677e7194b18d0fc3
SSDEEP 384:D+aQikB+z/xvxjg/qhEwNBSO7b16Gd6rWZ9zP:i/UxvxjgC+IM+6r+FP
TLSH
T15F72AF2B95B97E23D5F7E604794E0B5FCBB894B291822E784EED6F0D07C33880346916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State
Size 2KB
SHA256 4c2dcc17e592bccdec5c2f65f239ee979b6cfced45ecd8fff07c6bb5bc939ac7
MD5 d540a8fa52b0b8b1e5282fb3bd519c65
SHA1 e7384a6fe3578fed18953601fd51dc5b955e150a
SHA512 cbf9b69cef9ceb1e2b1e509eb0c73acb3b5038ecf6cb7bc85a9ab4c55bba9e42020f81fa600b3128197102f849ccfb17d15f934a4ac55f3fe97392f69d57a0af
TLSH
T1385195327D646B37CAE68704758B3E3BDE785065AB622F20EADC1B1801D754C1345D36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State
Size 3KB
SHA256 0ee3d3783575674b24875ae38e5873ab7c595d3ec1ca4cc130ce8dc34c8605b4
MD5 b4f625497247105e6e80f0e1e8ef74ec
SHA1 aea58e72cb094b4eca2122bbcf5245cdcd2c3480
SHA512 83e185de783bb42740cf7cc40c1790a93caca76d9ce558387386b67bfcef2b05774324acadef10f9b4a99795d8ecdff5c969b33b53c013b7a528e6f35484c6fa
TLSH
T1E861B8367D74AA378EE6DB0474C63B1ABBA45027EA913F64DAEC1F1C01D728C1341D26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595b84.TMP

Path C:\Users\Admin\AppData\Local\com.Setup.app\EBWebView\Local State~RFe595b84.TMP
Size 1KB
SHA256 626d659de3669c10f74133b7511cf8568f12357309db69c8a172a517fb484bf8
MD5 60fcc386138e2ccec88c8906576ce346
SHA1 8724f136522fafe21442a81725e5af4ba4be532b
SHA512 2dab46ffe1d7369aaefb7c7ddaa5b536f08f54f155b9bbff5a136980ae16606579b80c20e5a05567b222f95b9feda457326e3f9907958420bdb09ee8feaa4d4f
TLSH
T1D82165B1F9B86B33DD95630631977D7FAF20106A97110F10B6DD4B2902D354C971DA35
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1980-224-0x0000024402F90000-0x0000024402FBA000-memory.dmp

Download

memory/1980-51-0x00007FFE4CA40000-0x00007FFE4CA41000-memory.dmp

Download

memory/5572-318-0x0000021E9FCD0000-0x0000021E9FCD1000-memory.dmp

Download

memory/5572-316-0x0000021E9FCD0000-0x0000021E9FCD1000-memory.dmp

Download

memory/5572-324-0x0000021E9FCD0000-0x0000021E9FCD1000-memory.dmp

Download

memory/5572-327-0x0000021E9FCD0000-0x0000021E9FCD1000-memory.dmp

Download

memory/5572-326-0x0000021E9FCD0000-0x0000021E9FCD1000-memory.dmp

Download

memory/5572-325-0x0000021E9FCD0000-0x0000021E9FCD1000-memory.dmp

Download

memory/5572-323-0x0000021E9FCD0000-0x0000021E9FCD1000-memory.dmp

Download

memory/5572-322-0x0000021E9FCD0000-0x0000021E9FCD1000-memory.dmp

Download

memory/5776-285-0x00007FFE4D3E0000-0x00007FFE4D3E1000-memory.dmp

Download

memory/5776-286-0x00007FFE4CA70000-0x00007FFE4CA71000-memory.dmp

Download

memory/6120-125-0x00007FFE4CA40000-0x00007FFE4CA41000-memory.dmp

Download