134766b4bda1fbb6d14d104fb5f2510a7e42b7160fad3b2787ba3b1e6fb3b685

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
audiobook-tagger-v2.exe
Size 17.4MB
Sample260806-blh71azgrg
SHA256 134766b4bda1fbb6d14d104fb5f2510a7e42b7160fad3b2787ba3b1e6fb3b685
MD5 41c07976466408e448cc4fdacd954f68
SHA1 440c2c2ccf3a97098283e9f8337320dc1f6691ed
SHA512 d397ab6cb9bf8fc150c5fc234fd416a184081a00e14a55ca10cb538ff86d58c9e5b1a0d4e684554119a411887a21064d48cedc938f1683f6541ca97cc3877c3a
SSDEEP 196608:cF5qwsmziwBh7Hu6NGunChKQ6crVgAlkmjMeqGvB:c9smziwBh7Hu6NG3hK9cGAlkmon
TLSH
T1AC0707257B5A99ACD09BC47483478A724A7130DB0B39B9FF44C592382F7ABF45F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiobook-tagger-v2.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4224	msedgewebview2.exe
4224	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3304	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4092	audiobook-tagger-v2.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3304	4092	audiobook-tagger-v2.exe	89
PID 3304 wrote to memory of 4084	3304	msedgewebview2.exe	90
PID 3304 wrote to memory of 5796	3304	msedgewebview2.exe	91
PID 3304 wrote to memory of 5796	3304	msedgewebview2.exe	91
PID 3304 wrote to memory of 5796	3304	msedgewebview2.exe	91
PID 3304 wrote to memory of 5796	3304	msedgewebview2.exe	91
PID 3304 wrote to memory of 5812	3304	msedgewebview2.exe	92
PID 3304 wrote to memory of 3300	3304	msedgewebview2.exe	93
PID 3304 wrote to memory of 3300	3304	msedgewebview2.exe	93
PID 3304 wrote to memory of 3300	3304	msedgewebview2.exe	93
PID 3304 wrote to memory of 3784	3304	msedgewebview2.exe	94
PID 3304 wrote to memory of 3784	3304	msedgewebview2.exe	94
PID 3304 wrote to memory of 3784	3304	msedgewebview2.exe	94
PID 3304 wrote to memory of 3784	3304	msedgewebview2.exe	94
PID 3304 wrote to memory of 3784	3304	msedgewebview2.exe	94
PID 4092 wrote to memory of 5580	4092	audiobook-tagger-v2.exe	95
PID 4092 wrote to memory of 1104	4092	audiobook-tagger-v2.exe	96
PID 4092 wrote to memory of 5172	4092	audiobook-tagger-v2.exe	97
PID 4092 wrote to memory of 500	4092	audiobook-tagger-v2.exe	101
PID 4092 wrote to memory of 2512	4092	audiobook-tagger-v2.exe	103
PID 4092 wrote to memory of 3772	4092	audiobook-tagger-v2.exe	105
PID 4092 wrote to memory of 3256	4092	audiobook-tagger-v2.exe	107
PID 4092 wrote to memory of 2012	4092	audiobook-tagger-v2.exe	109
PID 4092 wrote to memory of 4604	4092	audiobook-tagger-v2.exe	111
PID 4092 wrote to memory of 4200	4092	audiobook-tagger-v2.exe	113
PID 4092 wrote to memory of 5944	4092	audiobook-tagger-v2.exe	115
PID 4092 wrote to memory of 4064	4092	audiobook-tagger-v2.exe	118
PID 4092 wrote to memory of 4664	4092	audiobook-tagger-v2.exe	120
PID 4092 wrote to memory of 2700	4092	audiobook-tagger-v2.exe	122
PID 4092 wrote to memory of 3768	4092	audiobook-tagger-v2.exe	124
PID 4092 wrote to memory of 5056	4092	audiobook-tagger-v2.exe	126
PID 4092 wrote to memory of 4328	4092	audiobook-tagger-v2.exe	128
PID 4092 wrote to memory of 852	4092	audiobook-tagger-v2.exe	130
PID 4092 wrote to memory of 5384	4092	audiobook-tagger-v2.exe	134
PID 4092 wrote to memory of 4248	4092	audiobook-tagger-v2.exe	136
PID 4092 wrote to memory of 4060	4092	audiobook-tagger-v2.exe	138
PID 4092 wrote to memory of 2620	4092	audiobook-tagger-v2.exe	140
PID 4092 wrote to memory of 5048	4092	audiobook-tagger-v2.exe	142
PID 4092 wrote to memory of 3776	4092	audiobook-tagger-v2.exe	144
PID 4092 wrote to memory of 4352	4092	audiobook-tagger-v2.exe	146
PID 4092 wrote to memory of 3132	4092	audiobook-tagger-v2.exe	148
PID 4092 wrote to memory of 4524	4092	audiobook-tagger-v2.exe	150
PID 4092 wrote to memory of 5368	4092	audiobook-tagger-v2.exe	152
PID 4092 wrote to memory of 3224	4092	audiobook-tagger-v2.exe	154
PID 3304 wrote to memory of 4224	3304	msedgewebview2.exe	156
PID 4092 wrote to memory of 948	4092	audiobook-tagger-v2.exe	157
PID 4092 wrote to memory of 4528	4092	audiobook-tagger-v2.exe	159
PID 4092 wrote to memory of 3276	4092	audiobook-tagger-v2.exe	161
PID 4092 wrote to memory of 2772	4092	audiobook-tagger-v2.exe	163
PID 4092 wrote to memory of 1532	4092	audiobook-tagger-v2.exe	165
PID 4092 wrote to memory of 1368	4092	audiobook-tagger-v2.exe	167

C:\Users\Admin\AppData\Local\Temp\audiobook-tagger-v2.exe
"C:\Users\Admin\AppData\Local\Temp\audiobook-tagger-v2.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=audiobook-tagger-v2.exe --webview-exe-version=2.2.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4092.4728.11725844060328272220 /pfhostedapp:bea4fb6457b8a8c8239e55cb6a65fa4c762a39a7
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView /prefetch:4 /pfhostedapp:bea4fb6457b8a8c8239e55cb6a65fa4c762a39a7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbb08e5fd8,0x7ffbb08e5fe4,0x7ffbb08e5ff0
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView" --webview-exe-name=audiobook-tagger-v2.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,15259958245964289103,18387910701961158568,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bea4fb6457b8a8c8239e55cb6a65fa4c762a39a7
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView" --webview-exe-name=audiobook-tagger-v2.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=1764,i,15259958245964289103,18387910701961158568,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bea4fb6457b8a8c8239e55cb6a65fa4c762a39a7
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView" --webview-exe-name=audiobook-tagger-v2.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2524 --field-trial-handle=1764,i,15259958245964289103,18387910701961158568,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bea4fb6457b8a8c8239e55cb6a65fa4c762a39a7
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView" --webview-exe-name=audiobook-tagger-v2.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3440 --field-trial-handle=1764,i,15259958245964289103,18387910701961158568,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bea4fb6457b8a8c8239e55cb6a65fa4c762a39a7 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView" --webview-exe-name=audiobook-tagger-v2.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=820 --field-trial-handle=1764,i,15259958245964289103,18387910701961158568,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bea4fb6457b8a8c8239e55cb6a65fa4c762a39a7
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4224
- C:\Windows\system32\where.exe
  "where" whisper-cli
  2⤵
  PID:5580
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:1104
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:5172
- C:\Windows\system32\where.exe
  "where" whisper-cpp
  2⤵
  PID:500
- C:\Windows\system32\where.exe
  "where" whisper-cli.exe
  2⤵
  PID:2512
- C:\Windows\system32\where.exe
  "where" whisper-cpp.exe
  2⤵
  PID:3772
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:3256
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:2012
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4604
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4200
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:5944
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4064
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4664
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:2700
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:3768
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:5056
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4328
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:852
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:5384
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4248
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4060
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:2620
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:5048
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:3776
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4352
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:3132
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4524
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:5368
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:3224
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:948
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:4528
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:3276
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:2772
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:1532
- C:\Windows\system32\where.exe
  "where" ollama
  2⤵
  PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9a03aa68cc90ba965c3782472093b0c195a8c03b0577064075aec78e05d6e76b
MD5 27340718cc81a25b72594ac10795cc78
SHA1 04cc8a10c1700fd9016f3dbc93083e2f3160d82e
SHA512 c430091707b3e22c834e8265056ebecfe08f7a5b6e28e24fda6a29885689fa743ef26e68f8bf086a072b82390b574426aa73bb69799c55298d3b69957e01644a
TLSH
T12BD0241333114774CD1031730003714D4401C31F414F5010543CDD5D1F5C4D00F03443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 75b52c2faad4258628b8dc77589f4727248cc12eb71b5654ea63e6a1438db6ef
MD5 790536c17d15381ed766456ad8749ae2
SHA1 dd1bbb9112dee074332b6bfbe29471b4325841a7
SHA512 907c0560965438c9363e861ca4c5dc0a593173d9b270fa0c588e135ab613594220ae0da2f12aee3380bcc2e1a1c9571a6a5470ca24c1b6127975ff7a99fed429
TLSH
T1F8D0041053144540DF00317140104141C105455D015731300014544404D54410541005
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2d524ddc-d611-4477-8173-0f03cd23415e.tmp

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Default\2d524ddc-d611-4477-8173-0f03cd23415e.tmp
Size 6KB
SHA256 d61d3612f33bcf8954339907ab8554fae99b9a1fb32161c4f5370bc8d0582a19
MD5 191d7ad17c26b807df72375798dd9a32
SHA1 ff135cf5a25ac547df10fdc302ec36a31468f254
SHA512 d0139d36c264668d4d1e96a4212281ea013144925f6b7783a277beb9d0b8a13aff2bd116d37d09ed193369961813b0bb313e928e32e9256d8146ec39dc46beda
SSDEEP 96:stw/deSbXXb9gkao5h16Z0s1s7/x+6MhmuecJspw1ejeaK+gt+28XM1C7K:stkYZ9ons1sV+FdspwQjOD+G6K
TLSH
T1FDD194025E28797B4CC6E209BB39BA17E2F9617265D11E58FBF8462C04DA6DC3317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 9264a06448d30751b658fb4390d877e7998d7d1608bafd66689a581fd2417616
MD5 8d87e4d66193caa7abc1d06376b804e0
SHA1 bf2d6d60fbd4468370d91a90ac664943ba1198d9
SHA512 186a3a4fe06bdb8087e4f6d0f5a999bee777eb370e21580e40d28ee32b12f5f7302172e6b7a5cf5f03273e2052d0aa775a66eaedaca2f4879641a9ba6f40f55a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 ee24a4a58ece685053b730556e500341589d5fbe8055c6b30f2bdfe43c1f148a
MD5 ec50c3309ecfcbcbed833a0976050736
SHA1 193cfce633aa682d64d7f1093d90068c5dafa43d
SHA512 3ecf266b390104e6e2ce7d200220bd795a680465844bc0d0ae6772d351901ab3cfcea378d7275d141c40b82a4f65037952a0f26dceb4179bedb1564e5107139b
TLSH
T1F0C09220844E6067D704C67010CEB540743CF890506708EEC898A1B6911438016720C2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7a13.TMP

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Default\Network\Network Persistent State~RFe5a7a13.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Default\Preferences
Size 6KB
SHA256 f0cabff7f99cbceaad819ad1f454433327ead8e96bed486ac62f455236f6b542
MD5 ded4dd29b1d28ea6520705aa0cffbd8b
SHA1 16389c1f8548a9a6dfda0d8aff3ef2eecc80f291
SHA512 00022afcb5d7ffee1653ee8e689214cdd8e4963d9e5955e4ed388963a85cc7508a75b6e8f075f404eeb89fd465b655b4ae78d39ee067e5226142dd2c7f9f255a
SSDEEP 96:stw/deSKGXXb9gkao5h16Z0s1s7/x+6MhmuecJspw1ejeaK+ghc+28XM1C7K:stkYf9ons1sV+FdspwQjOk+G6K
TLSH
T122D194025E28797B4CC7E109BB29BA17E2F9617265D11E58F7FC462C04DA6DC2217D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Local State
Size 2KB
SHA256 38474ef587ff1a15167add6faf99981bbba2139518c4515bb183b50163e56d01
MD5 a961140a7cfd777f2abea0b2542d7fb8
SHA1 a77144918c9a17fc34af191fa37d37bc3eb8cea7
SHA512 09cbd0eb1e6dfc2c95317096432dc23929cd6ac7b32b0c328c2175e884a9bfe91e38b6f8fd42da860d2033cbf2555e20174e458a2c44a56f1d0a0eba28be74fc
TLSH
T132517473B818AB378BE29A14765A3E238A7591739E612F60A6ED0B1C01D764C3301C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Local State
Size 3KB
SHA256 bb19c21e8b0d9134df617b3b24cd1eb478f9e157fd8ecc86ab992dac7169d673
MD5 60fb09a0c03c08881fd9ab1a2817c74b
SHA1 8c47d2be49524dd3898f54dbde1cd93e1955c767
SHA512 9d59d60976c4add99e08fa3062b9d49e84d5f20f176f6607f3127e2cd392a97b2e72ee0863801de85fcaddc1533e1f2d2631a36b514b907d96703af3af14cc57
TLSH
T125618336A968AA374FE29E04B9863B16A7A55133E9953FA5D6EC0F1C01D738C2341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Local State
Size 15KB
SHA256 5e6f7064b59f6afebf3d7c2a05bf1c0793a9273762b7f01314511eb81ff0284d
MD5 aa86bcb9d7aa4674dae5f75ed425ff4e
SHA1 b0cb57957d52b8f2db74460768f213484ed2e696
SHA512 3709130cdebbe077b7f98a97709d6619bdd64a59bfe1e68b2503050c7f20d3b1661674fb1f443fc1c52959e9c1b92a22747cf123d9f18b4c4f38933ceafb101c
SSDEEP 384:O+aQikB+z/xvxjg/qhEaNBSAV6p2uxmdzD9zH:Z/UxvxjgC+sTkezDFH
TLSH
T1F4729E2B957D7E2396F7E9047A591B4FCBB894B391816A784AFD5F0C02973D82302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59522d.TMP

Path C:\Users\Admin\AppData\Local\com.audiobook.tagger.v2\EBWebView\Local State~RFe59522d.TMP
Size 1KB
SHA256 fa20c0ac06a917d520e178b8a493f2af2e7ec5919603018d4edf809fe03fec04
MD5 3e11421eaf2e4736d43eb0a3ed99346f
SHA1 1a0ee60971a11d127cedc94f6e8b111962218d7d
SHA512 7fd7ade5520da06dc7d5d1a2308647a7e5f32c6fb83fa7bf025b8612f2e7c06e8a13b0a8b2e359ea09722bcd4270a0d6c825dc9b2af7c4cf643c946348a634cb
TLSH
T1992165B2E86D6B33AFD66B5522567E5B1E70507386504B10B1DD473C02E218CB526C37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3784-92-0x00007FFBCF850000-0x00007FFBCF851000-memory.dmp

Download

memory/4224-265-0x000002192D3A0000-0x000002192D3A1000-memory.dmp

Download

memory/4224-259-0x000002192D3A0000-0x000002192D3A1000-memory.dmp

Download

memory/4224-263-0x000002192D3A0000-0x000002192D3A1000-memory.dmp

Download

memory/4224-267-0x000002192D3A0000-0x000002192D3A1000-memory.dmp

Download

memory/4224-266-0x000002192D3A0000-0x000002192D3A1000-memory.dmp

Download

memory/4224-257-0x000002192D3A0000-0x000002192D3A1000-memory.dmp

Download

memory/4224-268-0x000002192D3A0000-0x000002192D3A1000-memory.dmp

Download

memory/4224-264-0x000002192D3A0000-0x000002192D3A1000-memory.dmp

Download

memory/5796-24-0x00007FFBCF850000-0x00007FFBCF851000-memory.dmp

Download