0b4018126cbf88a0133968e4096250721d33fd737d7d0633800a1e1ef15dc08a

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LoaderReverser.ez (3).exe
Size 4.0MB
Sample260817-21c8ea1fqa
SHA256 0b4018126cbf88a0133968e4096250721d33fd737d7d0633800a1e1ef15dc08a
MD5 18dbeeddfa3f07a689c53c4be7194cdb
SHA1 8003f945496d4c051d524a0cc16fcdb9ec3fdabc
SHA512 9ccacc3e8c8ce850e9e1645d730dcfa065d6373ebd039ce4f7484f9c5f9ae2a79b8e67d219eb4a85d18f5c395b1cbcb5adb0ff019ea9b4ee33650473763e23ee
SSDEEP 98304:GujdrjLVtL0t4sR2VpUYbHprMF/GpDMOm2KU2Kjdzbs:RdPJZ0t4PjJrMFyMOmg2Kd
TLSH
T1BD1633DDEDCE46B0D096C7B08543783CB23E379E96A16C0936CCA9A4AE1311A6377747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LoaderReverser.ez (3).exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
57	discord.com
12	discord.com
15	discord.com
24	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
11	api.ipify.org
14	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4448	LoaderReverser.ez (3).exe
4448	LoaderReverser.ez (3).exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1386984691\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1386984691\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1386984691\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_900864943\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_900864943\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_900864943\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_842575558\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1016605951\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1016605951\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1016605951\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_842575558\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314813720851625"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4448	LoaderReverser.ez (3).exe
4448	LoaderReverser.ez (3).exe
5852	msedgewebview2.exe
5852	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5240	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	LoaderReverser.ez (3).exe
Token: SeSystemProfilePrivilege	4448	LoaderReverser.ez (3).exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4448	LoaderReverser.ez (3).exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 5240	4448	LoaderReverser.ez (3).exe	87
PID 5240 wrote to memory of 1256	5240	msedgewebview2.exe	88
PID 5240 wrote to memory of 2696	5240	msedgewebview2.exe	90
PID 5240 wrote to memory of 2696	5240	msedgewebview2.exe	90
PID 5240 wrote to memory of 2696	5240	msedgewebview2.exe	90
PID 5240 wrote to memory of 1112	5240	msedgewebview2.exe	91
PID 5240 wrote to memory of 2468	5240	msedgewebview2.exe	92
PID 5240 wrote to memory of 2468	5240	msedgewebview2.exe	92
PID 5240 wrote to memory of 2392	5240	msedgewebview2.exe	93
PID 5240 wrote to memory of 2392	5240	msedgewebview2.exe	93
PID 5240 wrote to memory of 2392	5240	msedgewebview2.exe	93
PID 5240 wrote to memory of 5656	5240	msedgewebview2.exe	110
PID 5240 wrote to memory of 5656	5240	msedgewebview2.exe	110
PID 5240 wrote to memory of 3880	5240	msedgewebview2.exe	111
PID 5240 wrote to memory of 3880	5240	msedgewebview2.exe	111
PID 5240 wrote to memory of 4516	5240	msedgewebview2.exe	112
PID 5240 wrote to memory of 4516	5240	msedgewebview2.exe	112
PID 5240 wrote to memory of 5852	5240	msedgewebview2.exe	113
PID 5240 wrote to memory of 2480	5240	msedgewebview2.exe	114
PID 5240 wrote to memory of 2480	5240	msedgewebview2.exe	114

C:\Users\Admin\AppData\Local\Temp\LoaderReverser.ez (3).exe
"C:\Users\Admin\AppData\Local\Temp\LoaderReverser.ez (3).exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=RendererCodeIntegrity --mojo-named-platform-channel-pipe=4448.5684.9303532289099505621
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff8c90ab078,0x7ff8c90ab084,0x7ff8c90ab090
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,229413047284460610,1691690061366027436,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,229413047284460610,1691690061366027436,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2300,i,229413047284460610,1691690061366027436,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3608,i,229413047284460610,1691690061366027436,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2188,i,229413047284460610,1691690061366027436,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,229413047284460610,1691690061366027436,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4636,i,229413047284460610,1691690061366027436,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4720,i,229413047284460610,1691690061366027436,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name="LoaderReverser.ez (3).exe" --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2632,i,229413047284460610,1691690061366027436,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
    3⤵
    PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1016605951\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1386984691\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_842575558\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_900864943\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_900864943\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 afb8d09a62072628080cf7d34de528b672731909e779947d3d3b37d286ff12fe
MD5 5965abde5a8366c48058bd4eb303d019
SHA1 46884ab4e0e3ca7bcff35803069bd2313b9c8d9f
SHA512 01b1950d1c3f0b0ebb90e824f2fc18aa15366df3d744df0e9d63d3cf49bddf81e7339c06c2b90e88b47451c8ced8c69ce611c9a9513b6bd40cc665989a15e4d0
TLSH
T128D012D372014134C8107073115261490881C51F40098440943CA95D5A180540A03441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1727b915ffe16b00501b0bd064a4d2f178083299b0eb8cd2a54d91921efff41b
MD5 d4e3320e608cc006e0146617198f5e46
SHA1 caa5be88840f56632a20213dcf48eef49b5a1977
SHA512 63d41fd2d11f267ce59829dfdde1de5f06d84239639a272952e597eb7c3f15ce6f44a5a6a7e93a30f6b8db4d151d2600bed861eecd899e76245370bc8ae293f6
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8022bb4f-9e50-420a-9c54-d9d2fdea54bc.tmp

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\8022bb4f-9e50-420a-9c54-d9d2fdea54bc.tmp
Size 6KB
SHA256 fcb4bd9b367897f8b6787ef090ce4f8d4149e320f90ea45c98242db83d8d3724
MD5 ae4ba640d4044bf8a2a08532648f7c1f
SHA1 e9101d49df298a842965531d31a8b7d05156d0f7
SHA512 0df997ef973d37702dcffaa94ecbd0a27dfecf9f6bae271e128aa0e87474f331565221c676788a0ad4a66adffcf0c38cb82835f6f2e6a681e0bba0f114860cc9
SSDEEP 96:sty05u3YSN+b9iaffOZ8i0vhEDkdPm/7qx+WVHMSm+uec4FKjMdQj0+gGw/MEB:sty0kTNMfWZ8paCO/S+WiqFKodhL/M8
TLSH
T13BD1B6425E68697B8CC7F2197E35BB12E2FA106265D40E98FFFC851C08E66DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe598cf4.TMP

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Network\Network Persistent State~RFe598cf4.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Preferences
Size 6KB
SHA256 113124e6177be8bcf7a63a0bdb177351df819ca7ea66203dcc0450791ec4c56e
MD5 1d1eddf0e9b095cb35020893b1c04265
SHA1 f5443e73836fab3b0684d65c4a2285c6126d71c4
SHA512 f7a9d169a747dbc06f72b2187492ad3861a76e309379137d61bb175aeb0dd5d4d3d566c28bdd53f09a20897e83ab6c22bde9591bdc65c0f2b836b4bc1bde8d14
SSDEEP 96:sty05u3YSN+b90affOZ8i0vhEDkdPm/7qx+WVHMSm+uec4FKjMdQj0+gZ/MOB:sty0kTN2fWZ8paCO/S+WiqFKodhL/MC
TLSH
T164D1C6425E28697B9CC7F6197A35BB12E2FA116265C40E98FFFC861C05F66DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Local State
Size 2KB
SHA256 d1fd50f6363733997d1ad12d74bba9fbc7b9c4f5c821d21571f15ca6975987f7
MD5 9f3c7c5f24e8a7f1679124d6b46b716b
SHA1 e4c03ea5a597f1d726ac5273253ba236e72ef5e5
SHA512 acb35e4243165cf3d0ed5783ecaacfbd1b860298b4d07a49bbf964463fdfe7717d5290a557b7939a0f4e49e474ffb0fdde4594a852edb34aa2940b442207447c
TLSH
T1435196B2A804FA3B9CD39504794A2F13EE359165D6D52F90AEDD0F0C02EB29C2313C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Local State
Size 3KB
SHA256 dbe2c92d80044098b0b830b356c8634c501357001c327ff072462ec4cba70ff8
MD5 6a687777c121447d2dc13346957277fb
SHA1 db2733b1ae0884906b06bcb693ca9f7bc1addfef
SHA512 6d9e9853445ca13b001598b583dd9c7f72c00ef4929c0027297cbc21d9c0e03f75ac22a85a6352fbd12a049257623784dc5752e1247b9a0712460b2ac852002a
TLSH
T173718462A564F92B4DE3A905B8862B03BBA55137D5D53F94DEEC0F0C02EB3981352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Local State
Size 16KB
SHA256 65ec915c4cdcaa0a55229dcaf806ca67f496c168079d727ff3d65862ff2aea5f
MD5 a8de611f364b2e576e451246815d7da8
SHA1 36e5faee1b18f59d9ae239016e45b24c520d2434
SHA512 19a4a3e14b68b8d0459db0ee9e52bb2f93c777ae0b4e25fbe4cae25e8082ef2561c7a2a38dc472887aeb9e3a31dbf641279025ce8cf761866be61f0d67bfc091
SSDEEP 384:zj+aQikB+z/xvxjg/qhEwNbZYpAkN/pK8L3PuEL:m/UxvxjgC+ZuO/f/
TLSH
T1D872AD2A55A93E27A9F3EA44794D0B4BDAB5847290C27AF84EED5F0E07CB3D40303C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Local State
Size 1KB
SHA256 3660e911150160f076fbf4c8d633ba3184643119da50de6aeb2914d1949f6025
MD5 a4edb38ac0d8eec66883c557e22a0a08
SHA1 952680e877aaee98a29d5678375a44ca58e32147
SHA512 13710321e69a8eac74678f803ecf80b0365d201205ca0decd1601d0a2f4456e3e8719e86c2c0382d45becc4a93598081b8b5cb87ea4f72f4d527d38db00a8957
TLSH
T1BD2165B2C084FA7ABC865416B256AE876E50513681D55F48AACD0B0D23EB2CC5533C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Local State
Size 1KB
SHA256 866900fda298aeec73b1792b446d96225c967712455573d1bdd9f17fd28b5ad9
MD5 7133e83f781b34944d16cdfb2266ce84
SHA1 1facdeb1e41871c51dca3ad9f9304c3fb9ba6fc7
SHA512 9a8d7a86acbcc3f2327a764ef88ed674023f973550790d636a2ba4a1ad9b66b53148226e61a1fc25d43c9560686dffc132f2ddff4616a5fa504f2270134a41eb
TLSH
T15331B5F1D080BB36AC86A4067246AE83AE206136C1D51F846ADD0F0C13FB28CA437C33
MD5 SHA1 SHA512 TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\ld_ui_host\index.html
Size 86KB
SHA256 50314df467a70096cfabe485b4b106a42eebe6237e74958b3d8814bf04b17c40
MD5 15fc0f5ef8971cc5dd40800015fd8521
SHA1 54d7136d53e056015b391dde56cb34fd1ba6648d
SHA512 d877f167694faf4706b4a3eca6d9c94f26d648bdb7e3687b145766c04462aaf0bdab9a0bee9ee88c73d2483bc5de19215fcaf306ff4c6cc4303ae7f2efa5efa0
SSDEEP 1536:qun/RpTtRYoyMrerKrIZedToP7yzOQrDan5iu3Asy547TXamjPZS7vK7:EedToPfn5iuwx5+eDm
TLSH
T15E83E7F27294253A0977C4DA23655B4EFDA8C103AE475350FEEC03A14FF7E916A2B858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2392-134-0x00007FF8E4EB0000-0x00007FF8E4EB1000-memory.dmp

Download

memory/2468-86-0x00007FF8E4EE0000-0x00007FF8E4EE1000-memory.dmp

Download

memory/2468-85-0x00007FF8E5510000-0x00007FF8E5511000-memory.dmp

Download

memory/2696-248-0x00000192CCCA0000-0x00000192CCCCB000-memory.dmp

Download

memory/2696-35-0x00007FF8E4EB0000-0x00007FF8E4EB1000-memory.dmp

Download

memory/4448-234-0x0000000140000000-0x0000000140737000-memory.dmp

Download

memory/4448-233-0x00000001400EF000-0x0000000140339000-memory.dmp

Download

memory/4448-0-0x00000001400EF000-0x0000000140339000-memory.dmp

Download

memory/4448-1-0x00007FF8E5870000-0x00007FF8E5872000-memory.dmp

Download

memory/4448-3-0x0000000140000000-0x0000000140737000-memory.dmp

Download

memory/4448-2-0x00007FF8E5880000-0x00007FF8E5882000-memory.dmp

Download

memory/5240-235-0x000001FF61910000-0x000001FF62910000-memory.dmp

Download

memory/5852-400-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download

memory/5852-402-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download

memory/5852-406-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download

memory/5852-407-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download

memory/5852-412-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download

memory/5852-411-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download

memory/5852-410-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download

memory/5852-409-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download

memory/5852-408-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download

memory/5852-401-0x00000194825D0000-0x00000194825D1000-memory.dmp

Download