6b7fd846215966c103da2517b35f191c5d73b8d922409f1ce405d2937bb9a93a

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.1MB
Sample260808-xelkfack5z
SHA256 6b7fd846215966c103da2517b35f191c5d73b8d922409f1ce405d2937bb9a93a
MD5 bf53742d603e0cccc34e63ab6fc24501
SHA1 b96a83fa93c930b532f516a2e47581637ce95658
SHA512 228cbc5c6f45dea3c6808abfcacc2ce0e5203b15598c79d4c36a3ac8af8c36021234060ac70594454e029c912770c9ce6598d8570e1ae10d8947e1d2abc4b3d1
SSDEEP 12288:11vNYM/Jx3pPIParbObxoZUsZx5m+bcxbD+bwbDbUbRmb4XbvbYbIHSwkjJhIDLN:11vNDz3+P0HSBvIfHYt16sCCOmcP
TLSH
T1FB45CF21DE950878F1BF82F4C9230A54D6FABA48431FC29F52D4177A6F52BDA9A37310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1114504099\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1114504099\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1114504099\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1553604054\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1553604054\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5384_1292401341\test.txt	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6016	msedgewebview2.exe
6016	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5384	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 5384	4684	2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 5384 wrote to memory of 5340	5384	msedgewebview2.exe	90
PID 5384 wrote to memory of 5436	5384	msedgewebview2.exe	91
PID 5384 wrote to memory of 5436	5384	msedgewebview2.exe	91
PID 5384 wrote to memory of 5436	5384	msedgewebview2.exe	91
PID 5384 wrote to memory of 5436	5384	msedgewebview2.exe	91
PID 5384 wrote to memory of 552	5384	msedgewebview2.exe	92
PID 5384 wrote to memory of 3620	5384	msedgewebview2.exe	93
PID 5384 wrote to memory of 3620	5384	msedgewebview2.exe	93
PID 5384 wrote to memory of 3620	5384	msedgewebview2.exe	93
PID 5384 wrote to memory of 480	5384	msedgewebview2.exe	94
PID 5384 wrote to memory of 480	5384	msedgewebview2.exe	94
PID 5384 wrote to memory of 480	5384	msedgewebview2.exe	94
PID 5384 wrote to memory of 480	5384	msedgewebview2.exe	94
PID 5384 wrote to memory of 480	5384	msedgewebview2.exe	94
PID 5384 wrote to memory of 2812	5384	msedgewebview2.exe	98
PID 5384 wrote to memory of 2812	5384	msedgewebview2.exe	98
PID 5384 wrote to memory of 2812	5384	msedgewebview2.exe	98
PID 5384 wrote to memory of 4548	5384	msedgewebview2.exe	99
PID 5384 wrote to memory of 4548	5384	msedgewebview2.exe	99
PID 5384 wrote to memory of 4548	5384	msedgewebview2.exe	99
PID 5384 wrote to memory of 4300	5384	msedgewebview2.exe	100
PID 5384 wrote to memory of 4300	5384	msedgewebview2.exe	100
PID 5384 wrote to memory of 4300	5384	msedgewebview2.exe	100
PID 5384 wrote to memory of 6016	5384	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4684.5556.15561031754601332474 /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView /prefetch:4 /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffcedff5fd8,0x7ffcedff5fe4,0x7ffcedff5ff0
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView" --webview-exe-name=2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1596 --field-trial-handle=1616,i,18022152293262696970,4345113715024943982,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView" --webview-exe-name=2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1984 --field-trial-handle=1616,i,18022152293262696970,4345113715024943982,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView" --webview-exe-name=2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1616,i,18022152293262696970,4345113715024943982,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView" --webview-exe-name=2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3328 --field-trial-handle=1616,i,18022152293262696970,4345113715024943982,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53 /prefetch:1
    3⤵
    PID:480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView" --webview-exe-name=2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=1616,i,18022152293262696970,4345113715024943982,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView" --webview-exe-name=2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1616,i,18022152293262696970,4345113715024943982,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView" --webview-exe-name=2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4596 --field-trial-handle=1616,i,18022152293262696970,4345113715024943982,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView" --webview-exe-name=2026-08-08_bf53742d603e0cccc34e63ab6fc24501_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4588 --field-trial-handle=1616,i,18022152293262696970,4345113715024943982,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d608c5758b59fe184b4404175f65dd404585ba53
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cd4045634d77dbe8fc362d30f364bc66892986ae04b452b716003e4a1d205f6a
MD5 03837d7830b5db204cd23ae29f37843c
SHA1 a79c39c4395b0cd99a695df670082811380b837f
SHA512 4ac6e062b51144753261f3f50b900555a770c1953248616c7b6d7f00741191a63545c6b679fc87a6f898935b039c1743902e6b7858a21b09ad66efed60ce9750
TLSH
T149D01122B2028238C028203B28A3B20A0800C22B800A8002A83C8A2E2A080A00A028A2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 948564fac978313e01408c7ac2afbf406668acb72aba374d69a858b85f96498b
MD5 bc5e9e6fe3f3fcfbc8ea241983663989
SHA1 2693824ad20be041aa02f73e4158cca7b6950e7a
SHA512 77f3117a458252818eb1118c814cd2509d46707b1d7a9094ef5e64bc8501a63f8a06a4242a11d651f8f8cb70cace8ac1ddef7050070443d5a74733111915f851
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

0c3403a6-9576-4737-9312-9aa6c90cfde5.tmp

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Default\Network\0c3403a6-9576-4737-9312-9aa6c90cfde5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a93d5.TMP

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a93d5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 ce96ad34581ebbee013efd64d1b5c2423a9094b31a3b6f1ce7bfae499bedc00c
MD5 def629f240eefaa9fb8dde9c09de82b9
SHA1 a7cf685271ee6e4f098a170eb4f52f2a1766d7e1
SHA512 106cd2df92ba600d964576931ebb7fdc6cc0e2b81d4ccd6da4be8469d98661706da6ec3f4be0f1ca37c0c3895292bf11aae1bbfff8bc3d7f6076f5431d07612b
SSDEEP 96:st9e/dpBaGNatb9OkPo5h16ZZs7/x+6MhmuecmjegK+g728XM1C7K:stIXpWo+sV+FijQBG6K
TLSH
T121C194025E28787F4CC6F659BA39BA03D2F9603234D51E58EBF8461C08EB6DC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 c56edeb1dd12f9747b49a5ce3450622f057f01d2f95cee5ae4c7b363ab778874
MD5 dbe45381a1eb8e3f384cea3207e8a998
SHA1 6c5e44cf4f47d65fd47ee5e27094fa269a4ca14c
SHA512 c11591f786e497e73cce98c87138648e369d76f0b557ff1eb641cf973098cf33537f2b632cf00e46682bc1151fa5ccda94c932850632c519c60a23da5747ff6c
SSDEEP 96:st9e/dpBaGNBGtb9OkPo5h16ZZs7/x+6MhmuecmjegK+go28XM1C7K:stIXbWo+sV+FijQaG6K
TLSH
T161C1A5025E28787B4CC6E659BE397B03D2F9607264D51E58EBF8461C08EB6DC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Local State
Size 3KB
SHA256 b15a0b803a9f822bd7b3098b208f12daf36c6d51799597eff3968884bab802ba
MD5 36d722625ce0c9ec651c5c288b535738
SHA1 92801d3272f554ec382300c436ea052174b9b408
SHA512 9a1521eaad8274811a7a389a53c4e554efc663a2a2c5a3e62140569f07cad0d96bd7a76ac57552096b8ae4598a0b4ffcd279fd259a771f999d7fd8092e516571
TLSH
T1F76193276970AA7B8DF3DA0879863B02BBA15177E5813F64C6FC0F1C10EB2981352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Local State
Size 3KB
SHA256 7ebe3a1ea15ce28625aaee71f401a55a13838a9cf2827d4e201f1870096094c1
MD5 28b336d1b51b1524ebc0e15f98a787f5
SHA1 c8b666578777b0bf0ab006f572fb7e3620fc089e
SHA512 1d3c23000796d4a6544bbd670428352a080d7378e9e64c90f0022fabcb7124b5e484bc715b7951527b0cce45f8cb509dbd72fefb55f4f61f681aebfccb0b3be7
TLSH
T17D7194265875AA6B4DF3DA447D863B02BB654177D5813FA4CAFC0F0C11DB3991352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Local State
Size 15KB
SHA256 f081fdf0df66a203b382f2c6aa1e648eaf646d8817b703bc7b20bf1a22be6718
MD5 868406d7240aa26718728380d252434f
SHA1 6eb18c43d3400b3674cb14266704a2bfd867d5b9
SHA512 0bb9faec16ab750a0ed4f46fed16590fcaac3d99902ca12294b164d88080cf9fae195cb6cf24b366620055e78b5a70f202d23b6115dc1e9299e222383555d5a7
SSDEEP 384:s+aQikB+z/xvxjg/qhEwNBSEljsmLAVdpSD9zM:L/UxvxjgC+cFNLUEFM
TLSH
T10372AE1B58793E27A5F3EA047D4D078BDFB884F290816E784ABDAF0906DB2D80342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Local State
Size 2KB
SHA256 dd0651b57fc7c592f79bc5582202429cc56882d735aee522b93c54fe9442810c
MD5 5a6baade434bc4c5145445161b058773
SHA1 0517a496b41239a650282043027a050099df44b3
SHA512 b183386a0d07aab3861263281a7e3fbd78185e44eb52d3eb2b3661d8b789c27a69b849558e35a950e18dafda0800ace463224a74dffbf20d6c8e19f34fa610ab
TLSH
T1F65194736C206B7789F38A487E4B3B12EF3591E596522F20DBEC1B1810EA25D1352C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597e1f.TMP

Path C:\Users\Admin\AppData\Local\Temp\MaxSecurityBuilder\WebView2\EBWebView\Local State~RFe597e1f.TMP
Size 1KB
SHA256 b99340cf3f69548b65ff5bd85eeba0ad649d702b19ae02cf6bd91c748d1ea0b1
MD5 add1b7c548bd152dc76d8ac20d1c1a85
SHA1 0f5e0afe6a36ed1eec8b4bd7ac48c7214117f14f
SHA512 2c6bf99cee50b00946a724ce1c4b56fb3ab4196d58c7a28a9d0d324987556ff8442ff0beae319ff11ca71acff3846108e36decf757407f34ed61284c0ab82b83
TLSH
T1DB2165B3A4751F73ACF29689360B7643AF3051BA81014E00D6FD8B1D21BA19D597AD36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/480-102-0x00007FFD0F5F0000-0x00007FFD0F5F1000-memory.dmp

Download

memory/2812-217-0x00007FFD0E0F0000-0x00007FFD0E0F1000-memory.dmp

Download

memory/2812-216-0x00007FFD0F870000-0x00007FFD0F871000-memory.dmp

Download

memory/5436-187-0x000001F5D1C10000-0x000001F5D1CB8000-memory.dmp

Download

memory/5436-20-0x00007FFD0F5F0000-0x00007FFD0F5F1000-memory.dmp

Download

memory/6016-322-0x0000017EAA860000-0x0000017EAA861000-memory.dmp

Download

memory/6016-315-0x0000017EAA860000-0x0000017EAA861000-memory.dmp

Download

memory/6016-324-0x0000017EAA860000-0x0000017EAA861000-memory.dmp

Download

memory/6016-323-0x0000017EAA860000-0x0000017EAA861000-memory.dmp

Download

memory/6016-321-0x0000017EAA860000-0x0000017EAA861000-memory.dmp

Download

memory/6016-320-0x0000017EAA860000-0x0000017EAA861000-memory.dmp

Download

memory/6016-319-0x0000017EAA860000-0x0000017EAA861000-memory.dmp

Download

memory/6016-313-0x0000017EAA860000-0x0000017EAA861000-memory.dmp

Download