2b698aa3cd7e195f699b8b5b2ca0617f70a2fc484081d0a7f26596e38b3f0e68

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nfa-loader-latest.exe
Size 1.4MB
Sample260808-sgpyess1dw
SHA256 2b698aa3cd7e195f699b8b5b2ca0617f70a2fc484081d0a7f26596e38b3f0e68
MD5 f89c0a1ccfeac11adcd7f592ebdf4944
SHA1 cf1e01989c16c61a4bbef2d0905ce039382c38f2
SHA512 a3164ba08dc1641552ef9b10e4bdb0702b0231249202e04c9ba825a035266900cc17154c963d7cd1b9bad7aa4e2e29b7fdd6e1a5f5ad5824127dd549b6686d93
SSDEEP 24576:ZCAunPk/G8g3UWMex8SQX0sQJSgp85Js0e+8f2/PMjEHf8mJy5xL:ZCAwUe3EU311sUj45Ja
TLSH
T1B56533785FACA5E1D388BDF113E812343D26B4502CC15E94A00F9DDEABE05A565C3E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan upx

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nfa-loader-latest.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3716-0-0x00007FF7C2A40000-0x00007FF7C2E8F000-memory.dmp	upx
behavioral1/memory/3716-202-0x00007FF7C2A40000-0x00007FF7C2E8F000-memory.dmp	upx
behavioral1/memory/3716-222-0x00007FF7C2A40000-0x00007FF7C2E8F000-memory.dmp	upx

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_1130026204\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_838158647\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_473549480\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_669476254\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_669476254\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_1130026204\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_1130026204\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_838158647\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_838158647\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_473549480\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_669476254\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306751849490671"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5640	msedgewebview2.exe
5640	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2092	msedgewebview2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3716	nfa-loader-latest.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3716	nfa-loader-latest.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2092	3716	nfa-loader-latest.exe	80
PID 2092 wrote to memory of 5116	2092	msedgewebview2.exe	81
PID 2092 wrote to memory of 2356	2092	msedgewebview2.exe	82
PID 2092 wrote to memory of 2356	2092	msedgewebview2.exe	82
PID 2092 wrote to memory of 2356	2092	msedgewebview2.exe	82
PID 2092 wrote to memory of 2384	2092	msedgewebview2.exe	83
PID 2092 wrote to memory of 4892	2092	msedgewebview2.exe	84
PID 2092 wrote to memory of 4892	2092	msedgewebview2.exe	84
PID 2092 wrote to memory of 1304	2092	msedgewebview2.exe	85
PID 2092 wrote to memory of 1304	2092	msedgewebview2.exe	85
PID 2092 wrote to memory of 1304	2092	msedgewebview2.exe	85
PID 2092 wrote to memory of 1424	2092	msedgewebview2.exe	87
PID 2092 wrote to memory of 1424	2092	msedgewebview2.exe	87
PID 2092 wrote to memory of 6116	2092	msedgewebview2.exe	88
PID 2092 wrote to memory of 6116	2092	msedgewebview2.exe	88
PID 2092 wrote to memory of 2352	2092	msedgewebview2.exe	89
PID 2092 wrote to memory of 2352	2092	msedgewebview2.exe	89
PID 2092 wrote to memory of 5640	2092	msedgewebview2.exe	90
PID 2092 wrote to memory of 2656	2092	msedgewebview2.exe	91
PID 2092 wrote to memory of 2656	2092	msedgewebview2.exe	91

C:\Users\Admin\AppData\Local\Temp\nfa-loader-latest.exe
"C:\Users\Admin\AppData\Local\Temp\nfa-loader-latest.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=3716.1096.17458984793386373430
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.loader.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7fffd623b078,0x7fffd623b084,0x7fffd623b090
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1704,i,17690446982051342950,6056966333902264595,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,17690446982051342950,6056966333902264595,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1716,i,17690446982051342950,6056966333902264595,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3476,i,17690446982051342950,6056966333902264595,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4628,i,17690446982051342950,6056966333902264595,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4624,i,17690446982051342950,6056966333902264595,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=752,i,17690446982051342950,6056966333902264595,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4612,i,17690446982051342950,6056966333902264595,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.loader.app\EBWebView" --webview-exe-name=nfa-loader-latest.exe --webview-exe-version=1.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4604,i,17690446982051342950,6056966333902264595,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
    3⤵
    PID:2656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 803e5177ab920d796746fa6eadfde1863291eaeeea5c26ce3b10a4c326cd9708
MD5 dc6bf827941632e74e64e3ff130434c6
SHA1 15726f7c0bdd86a317bd59fbdea28535352b9ded
SHA512 14176444c196931ceb006f2b7fb53f4dfd9a3106cde3cd7cdcaa82f1067c4f179528b8c6d76311e28039a11f96debfc7cd70e3f6cc89e065b6064312c2e9f773
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 24d57a112215bd8a6a9b7870a902d7a641bb5a95c1b0f64b1a188ff836080154
MD5 72bd40cd85619067920cd27e91099306
SHA1 de474349b8ce83423aef9c8eeb1ce49673cc3908
SHA512 21befc6fa097db45972c127f5945fb94ec9a7e7cd6ed1ebf4f5b6cc82cd4c14fc1da8bbe0f0d86f800c78f7f122c27e5ade0870a6f12fd6fe8e3a42293702d61
TLSH
T18BD011233B828238C02020330083A28C2802F20F828A8002A82C8A2FAA280B00F22883
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

366ab405-2bfc-4cb6-b7bf-598be2846ff6.tmp

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\366ab405-2bfc-4cb6-b7bf-598be2846ff6.tmp
Size 6KB
SHA256 009e7a958d8f7f18ab6b7ae339463683aa1b1879d05659712142c65364173211
MD5 5a0272bef97542b954e2fd9ff66f4cbb
SHA1 107b46fbe2de082d58f3fef4b64b016745795448
SHA512 6eaaa2e8f298b24a221bc465a264d4f993ca4acd834b1e4bbf0f65a07bcb2d1709bc5e877e564251a9fe6c65d020746e9e14032a34f0c7f0181bebd8a3b1ba48
SSDEEP 96:stt05+Enulb9jPffHZ8i0vhEGktNm/7qx+WVHMSm+uecJPNSjMdQjS+gEipMEB:stt0YhPffZ8paNw/S+WiTPEodrXpM8
TLSH
T1FAD1B9029E28B9774CC7F6197E35BB16E2FA106172D41E98EBFD851C08E66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2482a9a730d120f9da83a16605018a6a4d7242ad0447dc82a55d23bcf25d3d36
MD5 b44dc0a6b601315b6427b8f361796af6
SHA1 e5bdbe6189985b7d2ea27e17399db20c29e46409
SHA512 153591461d914815a7294158fbbfef523d5762c3de0119f226f87552b0ce9c016950605283f8f47033dba10e1c523849ed50cb136cdfc0ddeaf70a74f7681c01
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 49eb6be9dccdcce625eff7e9dea7f8bcd95a242a950003773de26e458fcf75e8
MD5 5fb2ed17b36613f04328e5bcf5a2a5bd
SHA1 ffbafa7a10009d80232c2daef0a94790eeec91db
SHA512 b794f6aa828ba061e313bfb05d8610bd6a4dd6a13d4b0824b41a85fcb07751b1c3f10be266f06a98ea28793c11a8e29a090b8024ed82b64eec3f5ce25eb3937f
TLSH
T1AAA0025125400A22E59483705CD245547674BC2112177741A5911C68ADE03F09349C21
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe598bdb.TMP

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Network\Network Persistent State~RFe598bdb.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e553ac5e-3adf-421b-9f3a-d747155c2c87.tmp

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Network\e553ac5e-3adf-421b-9f3a-d747155c2c87.tmp
Size 571B
SHA256 3b75731511939aa3cfb2dccdde15a0aa0ca04f3d23e414746e146cb312082e0e
MD5 44223cb5dd04a4e8b49c26e501c25246
SHA1 0b6b75e2fa7b459d3bb74728b5c320e08426d87a
SHA512 7cf3250729d84e3dd8055ab3a9a1e7b42639217e23def3072cb902bc26bbb0ec64c74b5e0c42651d01b472c8c415dda165ca4bab4101d2a251bf70f6e8abd67e
TLSH
T1D8F0C651C3E4D57E474513F016347537C53D040591182D1BEDDDF79A57E1075E11040F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Preferences
Size 6KB
SHA256 51938d8a5fdabd5a9c82b558f273c4a6f71cbf1dda78ee376cc24a7a10431d4a
MD5 61a20db20475c6c85a77a0759603e539
SHA1 75957910e6c982512a34470c59db3b4f28d0e494
SHA512 c8d018b60735967471dd09ba3222ed3a0ec7b643155275537e16d2bc525493dd3df4e91eb2d72eaec935cdcd72afdcc7488fb18618a4c1e15a38bde2216990e4
SSDEEP 96:stt05+Enulb9jTffHZ8i0vhEGktNm/7qx+WVHMSm+uecJTZSMFHdQjS+gTYpMOB:stt0YhTffZ8paNw/S+WiTTIqdrKpMC
TLSH
T173E1B9029E2879774CC7F6197E35BB16E2FA106261D41E98EBFDC61C09E66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State
Size 1KB
SHA256 3d832e0ecfffcf348f8defb3d63b4fc86298fcdbbe34605ca4b73d18d5ea6df2
MD5 fc2df5a21af7e57c0f4790c1299ec8bb
SHA1 7c95ce56960324c243bfbc496b566eab2bebd556
SHA512 977233004de30e2f2195913ecb234e5cc19f72982d048861be712eaccb00135f7fa9366f2693833aee04cb70893c47e7f8a79e875d5dec2bd410a9598ed19900
TLSH
T1463195B3DC942FB25DB29941B21A7F933D10003EC2544F9862CD5B0C12D75CD6166833
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State
Size 2KB
SHA256 3bf3078df6f9a3070b784cccb45b0e2cbc241325e32dd908c83ab8dc1ad60fcf
MD5 4dcae40fc929b7bd3d083f42e3b85d56
SHA1 be3b87bd3ce790294d49c99d3abb68af79e54d64
SHA512 f31c42fb93cf7ada29113e1ca3df043eb95c00fcc40694f3b3fc0873ab7c6a017a6540cbd885130f02799a375dfe6bba8789ac35f8ea2f891ab35f0f0155aafe
TLSH
T15B51B473AC546F774AB28A44B90E3F12AD294079DAA51FA4A6DC1B0C01D758C3302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State
Size 3KB
SHA256 6c7a15fb1554f7ed4cae0366e89a81b557a126ac13fa6b04d33326293c9647d7
MD5 c69149c31f979a6f39896a5b635902cd
SHA1 bf51fd6fecdb96da16e112839ac66dc905ac00b1
SHA512 60dcb34596b00da55b2e4e8d5f26c13f0e31a229f7f51a6a266856fbe49b1768e1e1ce65375d45acd97696d27b15c6e278f2f8390ca6f5cd6b1a56fe7125ecf2
TLSH
T1FD718526AD64AE774EF29A40B88A3F16BE65403BD5D52FA8D6EC1F0C01D76C82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State
Size 16KB
SHA256 a1be92d366a1b10c5e70f5e7f2cabd1c914db6467c41e6dbbf1bb8749457e27b
MD5 0685e7e8d3d7cbe435f9f7ee5d015223
SHA1 e6a96964ca2f80d48ed2de96a48efcf5a4ff0176
SHA512 59a188687f39bdcc4ce35443874a74c8050d44aca15f8ec1612cbae1fd1508f80d40965c4960953f91aacbcdb4c28c4db7808a163b821c36f48609cd480cb49d
SSDEEP 384:zQ+aQikB+z/xvxjg/qhEBNbrU2JdPbH9zH:j/UxvxjgC+kcprFH
TLSH
T185729E2B69782E3359F3F500795C2B8BDEB884B290C56EBC4AED6F0D06C72D81302902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State
Size 16KB
SHA256 e8e008bd00bbf07f554243e584fd96dfbee3b8a0ec3687758d5b09e8ec2f3209
MD5 7c62499e53dd6c1c0d678eb28d5f4415
SHA1 7e0024718892b1634796b116fbc4f70e75719b73
SHA512 c76fe3cdb475e6a7c81d2bf3b60c1a6b3bb80ae4690888d9e272b32ee512c311c68f85d15315a9ea0f5f8321cced3953cf3e9b7af93335cc3f9b2bf788688241
SSDEEP 384:zl+aQikB+z/xvxjg/qhEBNb5U2JdPbH9zH:M/UxvxjgC+qcprFH
TLSH
T195729D2B69792E3355F3F500795D2B8BDEB884B290C56EBC4AED5F0906C77D81302912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587337.TMP

Path C:\Users\Admin\AppData\Local\com.loader.app\EBWebView\Local State~RFe587337.TMP
Size 1KB
SHA256 f3acf33d61200f5a60198621c2c8689cffbf5f027f3bbff27f180679799af3e4
MD5 c8b3930d4cba534243be4c40296739ef
SHA1 987237459eb1a92f9d3179aab4dfb144be5bff55
SHA512 5b5d3b53dd1a8ecf447c23332868672dd0ffdf4f00f7b93b3eecffe7b41184ae074a81e128399913fdb774f9fa096621fbb5195f60aff4503f08e5ee9923859c
TLSH
T1A8214277DC942FB26E718944B21ABFC73D14407E82584F5CA2CD670C12D75CD55A6837
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_1130026204\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_1130026204\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_473549480\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_669476254\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2092_838158647\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1304-128-0x00007FFFF5FA0000-0x00007FFFF5FA1000-memory.dmp

Download

memory/2356-249-0x00000259C5120000-0x00000259C55D8000-memory.dmp

Download

memory/2356-219-0x00000259C5120000-0x00000259C55D8000-memory.dmp

Download

memory/2356-404-0x00000259C5120000-0x00000259C55D8000-memory.dmp

Download

memory/2356-26-0x00007FFFF5FA0000-0x00007FFFF5FA1000-memory.dmp

Download

memory/3716-222-0x00007FF7C2A40000-0x00007FF7C2E8F000-memory.dmp

Download

memory/3716-202-0x00007FF7C2A40000-0x00007FF7C2E8F000-memory.dmp

Download

memory/3716-0-0x00007FF7C2A40000-0x00007FF7C2E8F000-memory.dmp

Download

memory/5640-372-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download

memory/5640-365-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download

memory/5640-373-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download

memory/5640-377-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download

memory/5640-376-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download

memory/5640-374-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download

memory/5640-375-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download

memory/5640-371-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download

memory/5640-366-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download

memory/5640-367-0x000001B9DE0F0000-0x000001B9DE0F1000-memory.dmp

Download