a55a573d367ccd368833c6fb4d28f0ac9443b87f412ffa76a72bd0b7f723b0ba

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 12.5MB
Sample260806-daa4csxtb1
SHA256 a55a573d367ccd368833c6fb4d28f0ac9443b87f412ffa76a72bd0b7f723b0ba
MD5 f63544294d7694f5a3c75484fe72081a
SHA1 0e11e379eabcb92cfc6e62071a66206d5358e009
SHA512 b88ea41506aab97f04485518f86e681941f593614cdc909f0b7fb59d8c0a918e9abf59ed2fee855befc510d1d17f4c4b3b62385bbf725653371de627bf968b21
SSDEEP 196608:tJOM8vfZy/PzBwReQ+v22aw8F/6Q7++f+YZWvcQ77b0Mlku7c:zO9vEwHXhFNf+YZIcQ/b3lVc
TLSH
T168D6BE0B965901F8C0BAD0789A478D53FA7174894335A7EB379C49136FE2BE4BA3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4024	powershell.exe
4428	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	loader.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	loader.exe
File opened (read-only)	\??\Q:	loader.exe
File opened (read-only)	\??\K:	loader.exe
File opened (read-only)	\??\N:	loader.exe
File opened (read-only)	\??\P:	loader.exe
File opened (read-only)	\??\R:	loader.exe
File opened (read-only)	\??\X:	loader.exe
File opened (read-only)	\??\Y:	loader.exe
File opened (read-only)	\??\Z:	loader.exe
File opened (read-only)	\??\A:	loader.exe
File opened (read-only)	\??\B:	loader.exe
File opened (read-only)	\??\E:	loader.exe
File opened (read-only)	\??\L:	loader.exe
File opened (read-only)	\??\S:	loader.exe
File opened (read-only)	\??\T:	loader.exe
File opened (read-only)	\??\U:	loader.exe
File opened (read-only)	\??\V:	loader.exe
File opened (read-only)	\??\D:	loader.exe
File opened (read-only)	\??\G:	loader.exe
File opened (read-only)	\??\O:	loader.exe
File opened (read-only)	\??\W:	loader.exe
File opened (read-only)	\??\F:	loader.exe
File opened (read-only)	\??\H:	loader.exe
File opened (read-only)	\??\I:	loader.exe
File opened (read-only)	\??\J:	loader.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	loader.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_383690738\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_383690738\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_2101191982\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_2101191982\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_2101191982\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_383690738\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_2101191982\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_2101191982\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_2101191982\manifest.fingerprint	msedgewebview2.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1136	cmd.exe
4664	net.exe
1284	net1.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	loader.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304580886263923"	loader.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
4428	powershell.exe
4024	powershell.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
4428	powershell.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe
1620	loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4172	msedgewebview2.exe
4412	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeIncreaseQuotaPrivilege	4428	powershell.exe
Token: SeSecurityPrivilege	4428	powershell.exe
Token: SeTakeOwnershipPrivilege	4428	powershell.exe
Token: SeLoadDriverPrivilege	4428	powershell.exe
Token: SeSystemProfilePrivilege	4428	powershell.exe
Token: SeSystemtimePrivilege	4428	powershell.exe
Token: SeProfSingleProcessPrivilege	4428	powershell.exe
Token: SeIncBasePriorityPrivilege	4428	powershell.exe
Token: SeCreatePagefilePrivilege	4428	powershell.exe
Token: SeBackupPrivilege	4428	powershell.exe
Token: SeRestorePrivilege	4428	powershell.exe
Token: SeShutdownPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeSystemEnvironmentPrivilege	4428	powershell.exe
Token: SeRemoteShutdownPrivilege	4428	powershell.exe
Token: SeUndockPrivilege	4428	powershell.exe
Token: SeManageVolumePrivilege	4428	powershell.exe
Token: 33	4428	powershell.exe
Token: 34	4428	powershell.exe
Token: 35	4428	powershell.exe
Token: 36	4428	powershell.exe
Token: SeIncreaseQuotaPrivilege	4024	powershell.exe
Token: SeSecurityPrivilege	4024	powershell.exe
Token: SeTakeOwnershipPrivilege	4024	powershell.exe
Token: SeLoadDriverPrivilege	4024	powershell.exe
Token: SeSystemProfilePrivilege	4024	powershell.exe
Token: SeSystemtimePrivilege	4024	powershell.exe
Token: SeProfSingleProcessPrivilege	4024	powershell.exe
Token: SeIncBasePriorityPrivilege	4024	powershell.exe
Token: SeCreatePagefilePrivilege	4024	powershell.exe
Token: SeBackupPrivilege	4024	powershell.exe
Token: SeRestorePrivilege	4024	powershell.exe
Token: SeShutdownPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeSystemEnvironmentPrivilege	4024	powershell.exe
Token: SeRemoteShutdownPrivilege	4024	powershell.exe
Token: SeUndockPrivilege	4024	powershell.exe
Token: SeManageVolumePrivilege	4024	powershell.exe
Token: 33	4024	powershell.exe
Token: 34	4024	powershell.exe
Token: 35	4024	powershell.exe
Token: 36	4024	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1136	1620	loader.exe	81
PID 1136 wrote to memory of 4664	1136	cmd.exe	83
PID 4664 wrote to memory of 1284	4664	net.exe	84
PID 1620 wrote to memory of 616	1620	loader.exe	85
PID 616 wrote to memory of 2312	616	cmd.exe	87
PID 1620 wrote to memory of 4172	1620	loader.exe	88
PID 4172 wrote to memory of 3876	4172	msedgewebview2.exe	89
PID 4172 wrote to memory of 2128	4172	msedgewebview2.exe	90
PID 4172 wrote to memory of 2128	4172	msedgewebview2.exe	90
PID 4172 wrote to memory of 2128	4172	msedgewebview2.exe	90
PID 4172 wrote to memory of 4476	4172	msedgewebview2.exe	91
PID 4172 wrote to memory of 2920	4172	msedgewebview2.exe	92
PID 4172 wrote to memory of 2920	4172	msedgewebview2.exe	92
PID 4172 wrote to memory of 3048	4172	msedgewebview2.exe	93
PID 4172 wrote to memory of 3048	4172	msedgewebview2.exe	93
PID 4172 wrote to memory of 3048	4172	msedgewebview2.exe	93
PID 1620 wrote to memory of 4412	1620	loader.exe	94
PID 4412 wrote to memory of 4952	4412	msedgewebview2.exe	95
PID 1620 wrote to memory of 4024	1620	loader.exe	96
PID 4412 wrote to memory of 1364	4412	msedgewebview2.exe	98
PID 4412 wrote to memory of 1364	4412	msedgewebview2.exe	98
PID 4412 wrote to memory of 1364	4412	msedgewebview2.exe	98
PID 4412 wrote to memory of 5052	4412	msedgewebview2.exe	99
PID 4412 wrote to memory of 4672	4412	msedgewebview2.exe	100
PID 4412 wrote to memory of 4672	4412	msedgewebview2.exe	100
PID 4412 wrote to memory of 4376	4412	msedgewebview2.exe	101
PID 4412 wrote to memory of 4376	4412	msedgewebview2.exe	101
PID 4412 wrote to memory of 4376	4412	msedgewebview2.exe	101
PID 1620 wrote to memory of 4428	1620	loader.exe	102
PID 4412 wrote to memory of 1616	4412	msedgewebview2.exe	107
PID 4412 wrote to memory of 1616	4412	msedgewebview2.exe	107
PID 4412 wrote to memory of 3572	4412	msedgewebview2.exe	108
PID 4412 wrote to memory of 3572	4412	msedgewebview2.exe	108
PID 4412 wrote to memory of 3248	4412	msedgewebview2.exe	109

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\cmd.exe
  /c "net start w32time"
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:1284
- C:\Windows\system32\cmd.exe
  /c "w32tm /resync /force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:2312
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=1620.3372.10641589823566995771
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0xec,0x7ff964a0b078,0x7ff964a0b084,0x7ff964a0b090
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,6563314179707426743,5566274816798328276,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:2
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1996,i,6563314179707426743,5566274816798328276,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2264,i,6563314179707426743,5566274816798328276,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --enable-gpu-memory-buffer-video-frames --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3540,i,6563314179707426743,5566274816798328276,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:3048
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=1620.3372.11721939144948226810
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ff964a0b078,0x7ff964a0b084,0x7ff964a0b090
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,7847020258333101253,921417957436771069,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1740,i,7847020258333101253,921417957436771069,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:11
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2056,i,7847020258333101253,921417957436771069,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --enable-gpu-memory-buffer-video-frames --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3424,i,7847020258333101253,921417957436771069,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4484,i,7847020258333101253,921417957436771069,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4524,i,7847020258333101253,921417957436771069,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAADCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4472,i,7847020258333101253,921417957436771069,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:10
    3⤵
    PID:3248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
MD5 a71e351e0584693771a3e1ab5ed855ee
SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
TLSH
T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 527583dacd97ac0330fcd30a301b422dc2b9894b292a38188ade6c96df764667
MD5 7a0e7ce4c6a682fdcfc2d5e11cfd14d8
SHA1 82fd69f2e9e6e3ba7865da5159a9bb74820585cd
SHA512 f74c1c0f1ec546836f8d34d98895a028518eefd8eecc4e011448b59c0a61ef1bbc661488675097965a1806b28e272680d6699d0767c777a4280e910c47c27381
TLSH
T1F0218B33B79DC165C8D9117A20CCAD00B275C3C744DECF8B2A84C229A97F5DADB945E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uavw5113.x2g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uavw5113.x2g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3b1ceeb4-edf8-4e1f-b47e-9b50d711c126.tmp

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\3b1ceeb4-edf8-4e1f-b47e-9b50d711c126.tmp
Size 3KB
SHA256 37ef886be2f0a4812eed640263b489d4a3ce5b7785acf4b2506b5d3da7c54364
MD5 948a5eba1806b2cfd86031694b1531b0
SHA1 6e9115a0a885180e494e0a4636e255395379ddb7
SHA512 04378853d2867fd3a37ab67fd869359ece08ac6392b15b99b35b243f7c9e41620a12fa8d09e6b7d8d3916220f6cd7c2f1d9245533cf8c5457fca8235178df543
TLSH
T1CE71B4366968AA3B4DE39A45B9852B03BAA5513BD5D03FA4D6ED0F1C02DB3DC2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 580a4074f597f9d7a9da3f260b115fbee4cb0be2acc25513bb522c0afb0d747f
MD5 88dc6d16343dedc00541fb6172dc4c0d
SHA1 59012ab0d385aa0d7060dfc4b3322272fdabd458
SHA512 cbd5784e9378cc336f5c16bdb777a64d96e12ece999ac2152a5e0276cd054c42bb5a7c850492d0982bbf0b1a6f4ed81d49ab9f5b27c0f4d2f858495fd95132e6
TLSH
T161D0121232420634C41020371102A5091440D70B4009414AE428C61D5E044501A02492
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c25feb526c18e319abd0e0e9f8ac81d363455d2c90c6c7ce577cb2e84157914c
MD5 eba46a8eaa3adcc7bb3436ad99ab3a54
SHA1 f0d6e67c6ef654ac0eef34850836ba88303d9576
SHA512 fc1a4392bfc8058de5cbeb08078fb6b9cb2972045d05c48ad6e77151d9dad779136ecf395e4179751456b851b298b22f8a26fac723a1be2e4a10c233cc4a6f21
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Local State
Size 1KB
SHA256 09a3af5e3b892c43508e0e6f870cef9a3bf6e40ec4247ed168b6ac547d06291b
MD5 c9e301800aa199d5251976f023ec4a38
SHA1 034e77b73b421e3a117369776ea02744c641d61c
SHA512 65a124673b8f2ba7173dc9e775ba18961a597b0ef4fa35e1d58e99cd4b24a7cda29cdab6fd185b7d897af562c398cc9e7055c142d66f948a4cd27ee096d556de
TLSH
T1403187B294A42F376D82574A7601AB037E20517E82506E04D1DF4F2C02D72DCB135C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Local State
Size 2KB
SHA256 1a64dadbc2b974b7ad8fc6a4d18b1639556d40e92fe5ed1a82971f208856a4ca
MD5 718a66856772d6ab87b2b0775c6a9b38
SHA1 17805110a541c8947e858909c68224a4332fef09
SHA512 1d6772776dc430af9a0b66be1433f21f62bc9043ceb40e6a76ef8bd444e72802f896f701b5259a965732ab2c9670182eff41f5099be185ba3684bc9912662fd4
TLSH
T1EA51847369186B378DE34648BA466F13AE35616A86913F60D6DE1F1C01DB29C3342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Local State
Size 4KB
SHA256 a55f39ac759506dea330d10d20d6d3b619f7c8e8da77f128e97763ea31e74fb1
MD5 0c8005ade6b557886e335c4b6c2b1b4e
SHA1 1eedf9ef71b141c50cfeaa24934e37c396a040bc
SHA512 b2ad9767241917771bb7ed4708829387e99fe5fe557d256c3c409309613c77b045e890c2fe60425a617602f61694eefd6443de138a32e12d629d6ffd8adaa45e
SSDEEP 96:zu+F3NkCEXlfHZMpf58Frh/cInURoDotoTilqDLBuZ+qP6hkZt9TS6Ta:zLF3NbApZMpiooDU4eM1uZth5I
TLSH
T12F91B3226974AA274DF3DA49B9463B03BAA49127D5953FA8D9ED0F1C02DB39C2342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe582baf.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Local State~RFe582baf.TMP
Size 1KB
SHA256 0c5c20cd6cde33bcee18d3a478f18769426cffd4c09ded60751eb49848a2471b
MD5 f29a7bec4f625772d9207b9a446cf482
SHA1 2a77a3bfef72a65f91bdd70a5acf3f8b0a9296d9
SHA512 7b0613579d6dd19e3fcea52d11387ec27dd7a289f14cad66b8d7dd2febd0de04d5531e6b732c2e796e2ccca0353cac8d3191a519f072df5be886724d12d3cbff
TLSH
T1FA216577C4A82F376D810659B611AB433E50917E82546A18D1CF572C02D71ECA276C33
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 221f627f779bdfe77b13762336f8c3ce61ba9adbd2a9e24b893a701347af905c
MD5 f77eb5ce5596bf45228444a75149ca69
SHA1 2b91646359b08f86e99c4995b3d42a5dd173d158
SHA512 6af70d3dbd143d489e7a6aaf7d351611e25ef623cd6fa968d3c7835f91bf53bfea90e0329beae757083c62ebf9fa39a9794cfd782347a7d0683515ba29a593c6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e4dbd50b51e32c92a5ee6923e3d3bf2d5be026f06b268f88d6571fb8d3a04a52
MD5 c2557c16f07dd22a46bf6649e5f2d98c
SHA1 92300607b8edc3e75ad956c8b669167dfe1efddf
SHA512 36b4a9a032e3660676beb98c0b899220475eb4dc87d6f36460d46a6addac018a175116ae315c5b28f9feff32151e864af8a8644ea48b09b8ad5ea0ca27d5b933
TLSH
T10FD0121732114638C03030330302720D0710C10B80054008682C855D6E188900E17441
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f16e9eaba6f6012b36ee6df062e1ad2dcac1c8e4d6b9fd461b38a98569c835d4
MD5 b112b10f7d05ffd6f36f17f490f0665a
SHA1 fe3cde30b40949068d0b07f06971faba894f5e41
SHA512 8d4a320e1a3d25a4586cc75441cf139fdf086cd86be4c43d472f17df83d658526fb6f89e3c1e4033b03becdf528d4a7af7d659b51621e5db9c4ceb90d0b6fd26
TLSH
T19021FD8C580248B9D311E47A1BC91C42B2B4986BA98BBDC23E1EBD74C40C3479C38126
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c7ac75eba51ac18d5d22f7e900dfc272328b3bb1eb2d69b49878b54e6d483ffa
MD5 d546144ab7a1ecf140cc4be643fd4f7c
SHA1 dc37b9476ad4529c2fe4534ff3e45c4c2f27be8c
SHA512 ce81c9634b78b5053af4724040298f2538bafa2dd9fac044936795688c9596a47f3f4dafbdf90448da805d6dd871625151668679e7c37a8fb56a4672867c6bcd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 53058681e104e265bb36dcfd4ce7a200b504d900d0eb9b420b6e073c91a637f5
MD5 5d806a7f121613da629f38ba7034cbd2
SHA1 e95192fb066488198c164e995505fc5c5e2ffa98
SHA512 42d935d77fa16644c3156559ed765d040bcdf58f5815ac9e4e7528c0258615a49fbbc5751d748c1368b7bbfa5b150aaa8773c5064f2bd9d24ffc2f6692b9cadd
TLSH
T1244167EBC7D8412CE84212F92B25691BCE1D5D2443283D7AC9E5BF8F93E0860E310A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58def1.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\Network Persistent State~RFe58def1.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 99d571087b2aacd54157df6f4663515db42678ad12bbcd11a1869ce00a2a3ac8
MD5 c41a41a7ae2b412e9e10677ef5d89fc0
SHA1 e0438236443e771fc660a25d9c4fc5c455e4a1b9
SHA512 9bac60850c9081c1cef1ed9ae636a2c30b2b17540ecc152fc2af4df0e3b1bae3cdca80cd38860847ccf6a0e2d88707b5d076b90ff017eaba90b9cab988107c78
TLSH
T1D3F024AAC07AF4B60078596B0D447D08AD7AF434814269F9D722C22EB430AF34203403
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 0a94859d5d6575a9a4272191fa3252766c988c8cf6e4e1b17b99f0d8b222ae27
MD5 e0974e4dfda3c44db0db699606321e64
SHA1 c87d09e052ae61cb18e424ecf418e6cd7c54fef0
SHA512 2cbafd2b3c1eb92d703a055a174927374def4901061be814a5c325fd46ae19189242708b14871f801f4199b9db8b85e59a38aa723e186313cda9c163676cb154
TLSH
T155F024ABC07AF8B60078596B1C407D44AE7AF838814269F9EB62C12EB030AF35703443
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 02a405136cf6cd5783ff46fb33d6c199a795e5a3d97421a91ec3926e3fc89959
MD5 eea039b3878f30aa2372e5a424bd792a
SHA1 32e9157c24aee3dc62af7f9d06913869fa9a6074
SHA512 1a9723b835d6f5ed77b068458a2fa8ea1f517faf70063019124ff25c9a1e32d3239065da664733517e060acb2f5359c56c41cbba8b8df96e1f54288ff9b5d25a
TLSH
T1B1F024ABC47AF4B610786A6B0C407D44AD7AF478814268F9EB62C12EB070AF34703413
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 8e57e4ae0bbdebf0f7e767e725769ee1fd1f6ce64b46a8db1b06837a33d2e537
MD5 d0d99b4ac7daa3c1c2bc1d4d3ecff983
SHA1 9636886462b046354eac344f5632c907a5d2d1b4
SHA512 84a5867ac0025160ea05b2470cf311b81cd89b9f403f7c90d11bcf64820f7ce2eb39434b0bc94e3aeea9d4371a608fbc2edc45c81cdc8a76fd9456fa8790c15c
TLSH
T1B5F024A7D07BF4A60078A9AB0C407D04AD7AF4388542A9F9EB36C62EB0306F35303443
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 6bbf9dca4bc6881f79ae620353bca47578c31db0c2beef030592ea1173a18635
MD5 2ae9aaf5d311a00ed308c315c5b417c3
SHA1 851e7ea6cdb3c5c606a69160e0b76508bea65bb5
SHA512 8c1ca4fa8f141e62db92ed77837b92e5a5d6038a646812f9e74c266658c699a909c65db3f10562481a82b8d974bd70b52b306428cb7b6f7a533df8af75c2788b
TLSH
T149F024AAC47AF4B600B8596B0D407D44AD7AF438814268F9EB62C22EB030AF74703803
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 75c9bac24c4e379d4e75ad940a681834909b40f2f56afba4b1d2f57b5efbace2
MD5 b43275f49ccc21316ca92bd7cbb91252
SHA1 25e1dc0f08a2ca4994669990760573fef70cd4b5
SHA512 793b24b77bf64e1a31c2e499ef5e7b3ffda9a441d64723b579ec4573111c1f23f82e777c72717b2c5c6df75b2074fd500ca0448562a2096f75bfc7b8d7cacfde
TLSH
T10BF024A7D07BF5A60078A9AB0D407D446E7AF4388242A9F9E722C52EB030AF35702403
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 b17ba565f39caab1fa7ffc38f0917ddb0b6ac7e3744b355cb5babe751923cbd9
MD5 079599ae674f638f65e8792773757cb0
SHA1 5d1b918b2eac27660afcad77472bd00397ee08ce
SHA512 f1e0e3b255c44c101bf1505e44787a2fde47202207f18bab73468487c0bdee8cc05ff87c34c5ed1cc94f21c7f1f0cdc5efdcb29f543cd1a5db7f5f328bbca810
TLSH
T122F024A6D07BF4A61078A96B0C407D446D7AF4388142A9F9E722C52EB030AF35703803
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe588f3b.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity~RFe588f3b.TMP
Size 522B
SHA256 e9f5e3c7d32fe15bd9ff924b2c5a00eed71c534267377e71cad40177d3390a06
MD5 0affe056a2e2250b67e9f51202e260c3
SHA1 1a7fa87cf80172017ca5a8a7bc7cf4f36bd896a7
SHA512 bff8dacacca1a7fe224e64d7ffd0fa7619a1e4ba1cc00ac723e192c9e761c1fc661cb91228c6b42a517618e4669230090d77104df3719608e2ac3758bb6aeab6
TLSH
T176F024AAC27BF5A60078A5AB0C40BD006D7AE4B48541A9FDEB22C52EA0346F75203443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 962b4c3aa8e8fe85f6eaaf104df8a2ecd4540aa2d55f8833ec4380ba6a6a6d56
MD5 e8776258d1e56c280a38c9bf09af5dcd
SHA1 c99056015c3658e8dee2859afbf3487abcc1dd9e
SHA512 3707827e38ecb52a11fbf5f6efd6287238416b8ecb0b543afac281aaaa5c23d2d715c090c687688a98017caf1253a459d4955f8becdae6984779e524ed65ad99
SSDEEP 192:stE0ypgfmZ8pawI/S+Wi9Z+wYByQPtSM8:st1ypgpy/VKwK8
TLSH
T110E195029E786D774CC7F219BA25FB12D2F6602265D41E58EBFC861C08EA6DC6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 b22790046d7397b6c104b3ff120c7b2151b7e00f2f5569afb37fdfdc4690292f
MD5 8a68ba6d7aee1b49bd69942cad1eb51c
SHA1 fc26084cd4dbfe6aebc8d11c863f50dbe31b968d
SHA512 86138b59f3c5d34602c550ebfcbee397c0a2c5a2cde2d9916ab8772e04ff3a6914d1c7bd7939030944730c50bcba83f135047b349cb7bc5bba85a1389f4f9304
SSDEEP 192:stE0yxgfmZ8pawI/S+Wi9Z+wYByQPCSMC:st1yxgpy/VKwHC
TLSH
T1EAE1B7025E786DB74CC7F619BA25FB12E2F6602265D11E58EBFCC61C04EA6CC6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe589313.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Preferences~RFe589313.TMP
Size 6KB
SHA256 e286bcc88ce37114eb4f7f8549ebbd729349c1cb19d403d9bae97479591333d0
MD5 910decf9da9d6249339683e26983d898
SHA1 31b2a16e9ac6bc56534c803e7528c9c2ee5ee435
SHA512 ffebf60b6484fe1adda99d02857ce772836f8f4e2e878d093e46ed21840ca86923e717a26cab041c74e596f160882518ca6bc55cda4bf86d79f21b4297df519e
SSDEEP 96:rE05kL4kCb9EgffgdZ8i0oETk5lm/7qx+WVHMSm+uecnZ+1iYByQj3P+gzSMEB:rE0ypgfOZ8pFwI/S+Wi9Z+wYByQPtSM8
TLSH
T185D1A6025F786D7B4CC7E219B925FB16D1F6612265D51E58EBFC861C04EA6CC6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State
Size 4KB
SHA256 1fd8ba8a3ec18d134c71b39a6914fa5621deca597d272225f3de30677ed35af6
MD5 4a77ea5f0897ad281165e28d2e4dbc17
SHA1 c0c8d9424f371436ed299ff877db8336d3ce794f
SHA512 e119e0f45b4ef4aff11fcb92efb270e9cb7bae8d4c3e1950061c13fab0d4d8c77e7bc14cde756eca01ac7f2b5a07bbefd2a8545670b7225500f4f8c4096ed7aa
SSDEEP 96:zuXObNkCEM0fHX+qxu58Frh/cInURoDotoi+PDY4BBZI6wBZOFZ6TJlkxa:zaObNbGuqxtooDUDyhBZhPCN
TLSH
T12A81A7266564AE674DF39A44B9493B07B6649127D5D13FA8D9EC0F0D02DB38C2342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State
Size 1KB
SHA256 0cb1121cc4814a972c35dbb6735945d435f68c7b9ea605f5d1e54d4252f5a33b
MD5 a2229cfafa37db4e7bae89efeebdea57
SHA1 7a10c53c01ac4cb480cdb4ebb300a262ca22aabd
SHA512 1a1fc01bc528bec154a1ce48178cd712a7047bde95719014bbc898282505c1d26e009c13766742d48b77cbc87b1618d2a7585ab2bdbc67b0b38492f9592aab2b
TLSH
T18231B7B1B0486FB31D92566472093B4B2D205329C1606F54F5DD4B0803EB28CB51BC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State
Size 2KB
SHA256 02daedbd420e06d858076a0732711c0dcdd2f940ed3c4a765c485f764bab14d7
MD5 424a56232bfef1b132975a4e51c3f37c
SHA1 8c07054a5ebcbcf841193a16f51d947ad0f02020
SHA512 4ea1dc056c9aa81f6db564ffc167525fea3872be96d71e6e1911fff742e4b5124f63e66ab10dea13288e93cc60dbee9809d406c44c0ab9ef1b1b43f93089bab5
TLSH
T1CA51B6727808AE734EE3565479093F13AA35A265DAA13F70E9DD1B0801DF69C3742C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State
Size 16KB
SHA256 64f52a3d7d2e6a7d76817ed732519a7308cfbf8568398cffd64eae0e423042e0
MD5 ca570e6ddf39fad109781b6e7939e428
SHA1 6f5e47ffefc5976cce3af7477b4bf85095e20dff
SHA512 c2a6fbf0166c9418c47159ae922a774d4b384eb5e3a2d62d3f6a8c702affb3a5d14cc8b3bae66c30eaa9c212b4a9a26d292cb505d109ed759171d97d12664534
SSDEEP 384:zN+aQikB+z/xvxjg/qhEwNbCxdQhrU2UL9zX:E/UxvxjgC+lPSrU2ULFX
TLSH
T1E2729E2B64697E2369F3B9047A5D174FDA7495B294C13EB88EED6F0902DB3DC1342C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5832a4.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State~RFe5832a4.TMP
Size 1KB
SHA256 4d6ad9daf315ff224acf0d120a3f35632018ff122ac991e4604050c696960a25
MD5 3376a33ca2213d642a5a4fa844adc12a
SHA1 d7d029a4fb52870c0309bd93088dfc15a372ea50
SHA512 5269108ab6a4fb6c5fd118b0f6ddae894195df5c8fd11f20ac2325021751eb8821081c28b00c2051d9ec0fd8a98ef229b1c0024453266d0978f4da81ffd3019e
TLSH
T150219572E04C6EB36D824524A2197B4B2D209229D260AF18F4CD170803DF69CB627C37
MD5 SHA1 SHA512 TLSH

Submit Download

daa08502-52db-4969-ba3d-de7be4a1de13.tmp

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\daa08502-52db-4969-ba3d-de7be4a1de13.tmp
Size 3KB
SHA256 84dbf284c1076285f09ca65264c751dcd00cd3b245f37a6460f5e79fa0e31852
MD5 7d05879d6c69d20d4eadc1fe6f5d30ba
SHA1 b5baa3cfe3e3bd8eb085f275c71ea6b6aae29d16
SHA512 bdf71ff215aeda3c5a4e2e0c6ecbf33387bfe212a60333aaa0d70840944150d2ad0d0929765929ab892f4d49199c5d9d83eac2f220c9e0831f20c304ce56f5b2
TLSH
T11771A7267468ED774EE39A54B9893B06B6659226E5D03FA4D9EC1F0C01DB38C2342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_2101191982\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_383690738\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4412_383690738\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1620-0-0x00007FF65CD30000-0x00007FF65D9BC000-memory.dmp

Download

memory/2128-27-0x00007FF983850000-0x00007FF983851000-memory.dmp

Download

memory/3048-146-0x00007FF983850000-0x00007FF983851000-memory.dmp

Download

memory/3248-903-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/3248-902-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/3248-899-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/3248-900-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/3248-893-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/3248-894-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/3248-895-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/3248-905-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/3248-904-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/3248-901-0x00000196825C0000-0x00000196825C1000-memory.dmp

Download

memory/4024-450-0x0000020561B50000-0x0000020561B72000-memory.dmp

Download

memory/4428-495-0x00000223F8D60000-0x00000223F8D6A000-memory.dmp

Download

memory/4428-496-0x00000223F8DA0000-0x00000223F8DCA000-memory.dmp

Download

memory/4428-486-0x00000223F8CA0000-0x00000223F8D53000-memory.dmp

Download

memory/4428-485-0x00000223F8C80000-0x00000223F8C9C000-memory.dmp

Download

memory/4428-497-0x00000223F8DA0000-0x00000223F8DC4000-memory.dmp

Download