78d01a4f6310752aef254a3f5cf9ec31816d52dadc75da72a9e425a867bb9281

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apphost_dEV7lOB7z6.exe
Size 1.1MB
Sample260818-sladjavcma
SHA256 78d01a4f6310752aef254a3f5cf9ec31816d52dadc75da72a9e425a867bb9281
MD5 dc6c6e49dcf960a14ffa4b5c01dd8388
SHA1 de2fc50b597dfd27f61172b46084c9e93416e51a
SHA512 868acab51651c08dcccded934827e8882c49e3077855b35916a7d3415c78cd4fcf69d3bd935af0524046b58b9f1528851a731eafcb62f66748767ceed49128fb
SSDEEP 24576:5+ubKPnC57+8ZnsTWzVvJfoFH11N+2ttMud3LbKi6tP5K2+:tbKPC5XoX1N+2tt/kPJ
TLSH
T1EE458E1E5B8402BCE0B2D578CF568892E776740A47B15EEF0AC04D625F27AF49F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4084	apphost_pBRM4rjmD3.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	apphost_pBRM4rjmD3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
4	discord.com
8	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
3	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs

pid	Process
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe
4084	apphost_pBRM4rjmD3.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1359014972\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1705027425\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1359014972\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1359014972\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1705027425\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1359014972\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1359014972\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1703084102\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3128_1705027425\protocols.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	msedgewebview2.exe
2744	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3128	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	apphost_dEV7lOB7z6.exe
Token: SeSystemProfilePrivilege	2240	apphost_dEV7lOB7z6.exe
Token: SeDebugPrivilege	4084	apphost_pBRM4rjmD3.exe
Token: SeSystemProfilePrivilege	4084	apphost_pBRM4rjmD3.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4084	2240	apphost_dEV7lOB7z6.exe	89
PID 4084 wrote to memory of 3128	4084	apphost_pBRM4rjmD3.exe	90
PID 3128 wrote to memory of 1356	3128	msedgewebview2.exe	91
PID 3128 wrote to memory of 4856	3128	msedgewebview2.exe	92
PID 3128 wrote to memory of 4856	3128	msedgewebview2.exe	92
PID 3128 wrote to memory of 4856	3128	msedgewebview2.exe	92
PID 3128 wrote to memory of 4856	3128	msedgewebview2.exe	92
PID 3128 wrote to memory of 3168	3128	msedgewebview2.exe	93
PID 3128 wrote to memory of 3016	3128	msedgewebview2.exe	94
PID 3128 wrote to memory of 3016	3128	msedgewebview2.exe	94
PID 3128 wrote to memory of 3016	3128	msedgewebview2.exe	94
PID 3128 wrote to memory of 2628	3128	msedgewebview2.exe	95
PID 3128 wrote to memory of 2628	3128	msedgewebview2.exe	95
PID 3128 wrote to memory of 2628	3128	msedgewebview2.exe	95
PID 3128 wrote to memory of 2628	3128	msedgewebview2.exe	95
PID 3128 wrote to memory of 2628	3128	msedgewebview2.exe	95
PID 3128 wrote to memory of 5772	3128	msedgewebview2.exe	99
PID 3128 wrote to memory of 5772	3128	msedgewebview2.exe	99
PID 3128 wrote to memory of 5772	3128	msedgewebview2.exe	99
PID 3128 wrote to memory of 5152	3128	msedgewebview2.exe	100
PID 3128 wrote to memory of 5152	3128	msedgewebview2.exe	100
PID 3128 wrote to memory of 5152	3128	msedgewebview2.exe	100
PID 3128 wrote to memory of 2460	3128	msedgewebview2.exe	101
PID 3128 wrote to memory of 2460	3128	msedgewebview2.exe	101
PID 3128 wrote to memory of 2460	3128	msedgewebview2.exe	101
PID 3128 wrote to memory of 2744	3128	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\apphost_dEV7lOB7z6.exe
"C:\Users\Admin\AppData\Local\Temp\apphost_dEV7lOB7z6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\apphost_pBRM4rjmD3.exe
  "C:\Users\Admin\AppData\Local\Temp\apphost_pBRM4rjmD3.exe" --hosted
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=apphost_pBRM4rjmD3.exe --webview-exe-version=1.2.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4084.2156.3866601929454979375 /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView /prefetch:4 /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x50,0x7ffa38075fd8,0x7ffa38075fe4,0x7ffa38075ff0
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name=apphost_pBRM4rjmD3.exe --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1784,i,18065045473993845498,5385317149983899532,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name=apphost_pBRM4rjmD3.exe --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2040 --field-trial-handle=1784,i,18065045473993845498,5385317149983899532,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name=apphost_pBRM4rjmD3.exe --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2004 --field-trial-handle=1784,i,18065045473993845498,5385317149983899532,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name=apphost_pBRM4rjmD3.exe --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1784,i,18065045473993845498,5385317149983899532,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name=apphost_pBRM4rjmD3.exe --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=1784,i,18065045473993845498,5385317149983899532,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name=apphost_pBRM4rjmD3.exe --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=1784,i,18065045473993845498,5385317149983899532,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name=apphost_pBRM4rjmD3.exe --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4528 --field-trial-handle=1784,i,18065045473993845498,5385317149983899532,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView" --webview-exe-name=apphost_pBRM4rjmD3.exe --webview-exe-version=1.2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4356 --field-trial-handle=1784,i,18065045473993845498,5385317149983899532,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3fdfa54c7eec2cd24d62a1488e15e2c4bf1c6c2f
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bridge.log

Path C:\Users\Admin\AppData\Local\LRez\bridge.log
Size 259B
SHA256 0e63ed86a82ab8f1931070e0d8505e5519f3775012d55a19a73c2831a9a06c90
MD5 42625669cc46ffca1f9e2ecefed7adfb
SHA1 560e6a6006aae3d00b745a61b365958e96f31ce7
SHA512 fc1f2a43b7d612e5b3df2d7ae69ae0b1b40990d6fc26fa467d860ec375f84d3e5a03831759cfd69c28acb605fc97636abe25a14cc78f22d4a409a9b3422ecfb9
TLSH
T1A5D05B80BA6C59B18C954F0CB661185232D4FF6163F71AF36D3495942CA0E003F230BB
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.log

Path C:\Users\Admin\AppData\Local\LRez\bridge.log
Size 1KB
SHA256 52667946433a05fea9211b98df45ae8b791470928a18da29a6f9dfe7cd69fa35
MD5 8adcd7875c0e35f0bb2951999ec60cf3
SHA1 90ebfdaab5bb80585e6acc4b587b63da41c17509
SHA512 16705817f3bee6efda6b3f6512c49dc1d51d013ce6ee6179a33d97744ecfb6cff4a3dfaf866138bfba6d3031e32b219e4d811d27792601d124cc6b1dba766102
TLSH
T12A113BD4BDAD88B2CD95485DB3196E5133C1F9B296B70FB73E2850A038E2B407B22169
MD5 SHA1 SHA512 TLSH

Submit Download

8a7c7461-f130-419a-9cd7-2a375877b92b.tmp

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\8a7c7461-f130-419a-9cd7-2a375877b92b.tmp
Size 15KB
SHA256 4ef8bfa979d3b84482afc269ea90e15aa6d2d76ba9c75a2ab7b9fc05b80f200d
MD5 7bcd20157910ce089143bc1cc2f49cd3
SHA1 eb8c543629b390922926a147ba861fe3efc41a4f
SHA512 f80b6ffdeeb230c7945f0dfbd073d70da6f11e7c3cf4e2a860e9fc2899a290175847be244ff79ca9bf3093852e25e3c6a0711497a70054c228045b767940e093
SSDEEP 384:U+aQikB+z/xvxjg/qhEwNBSN66Cvy49EuEg:z/UxvxjgC+IJyk
TLSH
T178729F2B18657E23A6F3E605B95E179BCBB494B350C27AB88EED5F0D06D73C81342C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ae9f087aa84bd5b0265d721ad7b82a21e184e4c449bd350ed2095da41ecaed0d
MD5 29259b0a17984f1c19b60bae8cefb5e3
SHA1 c5ce63a88f0004b3b893806e2993b8b08f475cf7
SHA512 67853350d1179a4cb740c8698ea28727c5e38d5340b0bf91fc37ad2e72ddeba93638e5aa781e2508f5bb10daaab0fa7347f6d1d8fdd02eed7027e50e2b4ca38c
TLSH
T1BBD004D0531000C4C010503150114F51054055C41C31C15051DC40175540D400401154
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4418cdf3b1f16869269eae7149713dfb983453230dbd9b2b729809d5cee8e7a5
MD5 6d233f1b25d8b395bcc263fb29c753d0
SHA1 f6604581558ae70b52b7e63d5cb6da189c0686aa
SHA512 9ad64cfe6ef2d7f36b03a9896db787054f41467790ff1a48c53545751a178fc04dc9e17ca54677373f7168dea083a5d498abcfb39c8c022eaf848ba812e5d7bd
TLSH
T144D01292331101B8C020203310036B490840D24F4415C040A4ACC52F6B048900D02491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4e21.TMP

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Network\Network Persistent State~RFe5a4e21.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Preferences
Size 6KB
SHA256 2180fd8e5bb4a895436e61b059c93d6a122f8c3bd9fb4eecf095a2254f5ca5ec
MD5 a97218cd39517fd1844056495344141b
SHA1 242b3545473db91a2db07f809bac8af90717aefd
SHA512 fae376731b5e10792b9ba3eef95d9fe543d161eb5e900f2e5dd6b1ce0b5ec8f239d6fd6b24fc1c4431f1d2a6e4048ac03cabbac4d4d3f5e6953dad6b010bb557
SSDEEP 96:sts/dM7ZGrb9Xkio5h16ZQ2s7/x+6Mhmuec4SR1ejefK+gR28XM1C7K:stgCGroH2sV+FMSRQjV/G6K
TLSH
T1ACD1C8425E24797B4CC7F218BA257B53E3F5903265E51E88EBF8462C08EB5DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e69c2920-8397-4846-9861-2cf81a9e0545.tmp

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Default\e69c2920-8397-4846-9861-2cf81a9e0545.tmp
Size 6KB
SHA256 f431897e0f7bb98b316c14b7c41337d7e88553d233502f69b9b39ec12b3021d1
MD5 00f0c8e7290201a350fe446e6b755bac
SHA1 e2e3ddd53d406c30d33f9991e991b92f9aec4fa5
SHA512 f4c96431e541683fe6c49e198e775f5818d10dd97df852875176e3f86c04b4e361fed031ee887f3b425b3247d1343ee47b80e29a99351c628dd319a320314ed0
SSDEEP 96:sts/dM7irb9Xkio5h16ZQ2s7/x+6Mhmuec4SR1ejefK+gW28XM1C7K:stgC8roH2sV+FMSRQjVgG6K
TLSH
T14AD1A5415E24797B4CC7F208BA25BB53E2F9902275D51E98EBF8462C08EB5CD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Local State
Size 2KB
SHA256 d71e444a9c8d8e7a7462d097cc411aad355066aebbb643a8cd3a3665217a253e
MD5 76a753547e80a930a799e38b98c49467
SHA1 008d106dc145598ccc31d27a19288e5e93a97e23
SHA512 1caeed50468bc1657dcbcc480bee626d4bd7aca9d19f01cf118313ab18adf788fc6c57a4d2cc5b56bf5701fef6b46e4974f8878b61d6651f3b9ed666da9ef3d0
TLSH
T16B5183B37910AF3789F29708B64A7B639F75C062AA652F509ADD0F2C41D315C1701C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Local State
Size 3KB
SHA256 4625aea0a406d3c75ac53f4700a74299d5e36c0f2a6ba735821f9005ffdafb44
MD5 7f2fb76bd7d3ab920d9ba446ef46491a
SHA1 7a3e72930628fe1e47f1f97252bbcaab35bf18b7
SHA512 490ed863903dd71b0e8be24f60beb2f33313d32ef98894ecf677cf1fa04682a9c2a76a5d7b2276aeb3001d703c2c21fba128b642bff19f67f3e0bbcee7794808
TLSH
T1236174776960EE378DF2D708B9863B62ABA58023E5953F95DAEC0F1D01D728C1351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59263b.TMP

Path C:\Users\Admin\AppData\Local\LRez\wv2-elev\EBWebView\Local State~RFe59263b.TMP
Size 1KB
SHA256 e7cc4ae0736355d8828f2e7e4d91b5612a9a01fd58a7709476313c6b8e2fcb0e
MD5 dc776fa19ffb90038fe29dc43b94a1f3
SHA1 e2a6e2b6162ca1f91817aaea257e6cdba9260aef
SHA512 53a9d9a6fd629ae3a7070ebba8d9a86397aeb12e5000fa3872f310ff1d66acb532cba3d64f871e89c9e57756689c15982f58f8c77b36b825ae3fb7c05b011b2a
TLSH
T1922165F3E6609F329CE2A3097356BBA36F32806791100F40A5DE4F6D01E314D5A29C36
MD5 SHA1 SHA512 TLSH

Submit Download

apphost_pBRM4rjmD3.exe

Path C:\Users\Admin\AppData\Local\Temp\apphost_pBRM4rjmD3.exe
Size 1.1MB
SHA256 78d01a4f6310752aef254a3f5cf9ec31816d52dadc75da72a9e425a867bb9281
MD5 dc6c6e49dcf960a14ffa4b5c01dd8388
SHA1 de2fc50b597dfd27f61172b46084c9e93416e51a
SHA512 868acab51651c08dcccded934827e8882c49e3077855b35916a7d3415c78cd4fcf69d3bd935af0524046b58b9f1528851a731eafcb62f66748767ceed49128fb
SSDEEP 24576:5+ubKPnC57+8ZnsTWzVvJfoFH11N+2ttMud3LbKi6tP5K2+:tbKPC5XoX1N+2tt/kPJ
TLSH
T1EE458E1E5B8402BCE0B2D578CF568892E776740A47B15EEF0AC04D625F27AF49F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\ld_ui_host\index.html
Size 92KB
SHA256 21d567edb3b046293ccf4f0c011f9dc69aa13eee488b53d2f8f99e50f6179c5f
MD5 1418da701b865caf8cf1169d73b47bd3
SHA1 2e4d61817f41837db6364bb36a1cf67a8e99c473
SHA512 e6cacb6df5962454767d69e861a64bd63c0078dd7d5962a9b54e0300f3405001b98ad05782a95fa2e7df9b783c6ff914859e013b05b00e669d3715420be56dab
SSDEEP 1536:qun/RpTtRYoy5lemrerFrqZ8kToP7yzOQrDan5iu3Asy547TwamjPZS7vKx:I8kToPfn5iuwx5+lDM
TLSH
T17F93F7F27294253A0A77C4DA22655B4EFDA8C103EE475250FEEC03B24FF7E91652B489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge.log

Path C:\Users\Admin\AppData\Local\Temp\logs\bridge.log
Size 1KB
SHA256 31683b2efaa9fdd6052ef454d6e920cc6d9adf022780211413eea3754e32440c
MD5 f0428070f54bf7204e9abf17e56140c6
SHA1 0f7372f1b7fa7c65d58dc825e103b5000ef087b0
SHA512 878fe594682ed59273c7c00703647927a670962206f5e112bb7ffc1591dce41f55e52a6d89b6863e9b157bd0adc08441c752df84568e2cd8eba6d52b9d7bc655
TLSH
T179113ED47DAC88B2CD95485DB3152E5133C1F9B296B70FB73E2851A038E2B447B22169
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.log

Path C:\Users\Admin\AppData\Local\Temp\logs\bridge.log
Size 196B
SHA256 b71ef86615af1f9bd5a3b0a302bd04d7cfa5ef6ec94cfcad92f74117d6dd8fe3
MD5 18d70932a1b6f89a8a555d50c9af5962
SHA1 2403864014d7464797c14a6e07186c4b2562b75c
SHA512 dd1990dbb9f40d1700a118b5d15b559f2ef7f58e34aefc9d5f0a8dec7e297e19605e86cb9a4b42f65e764e7ae7e1f608c2513dac101d8c21d3f5549d79ab0862
TLSH
T1D4D01240BA2C55F05C544F0C7662189632D8BF9123EA5AE36D34EAA42C90E103F230AB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2240-2-0x00000167932C0000-0x00000167932E0000-memory.dmp

Download

memory/2240-0-0x0000016793250000-0x0000016793260000-memory.dmp

Download

memory/2240-1-0x0000016793280000-0x00000167932B0000-memory.dmp

Download

memory/2628-143-0x00007FFA58D50000-0x00007FFA58D51000-memory.dmp

Download

memory/2744-395-0x0000026EB5F60000-0x0000026EB5F61000-memory.dmp

Download

memory/2744-389-0x0000026EB5F60000-0x0000026EB5F61000-memory.dmp

Download

memory/2744-391-0x0000026EB5F60000-0x0000026EB5F61000-memory.dmp

Download

memory/2744-400-0x0000026EB5F60000-0x0000026EB5F61000-memory.dmp

Download

memory/2744-399-0x0000026EB5F60000-0x0000026EB5F61000-memory.dmp

Download

memory/2744-396-0x0000026EB5F60000-0x0000026EB5F61000-memory.dmp

Download

memory/2744-398-0x0000026EB5F60000-0x0000026EB5F61000-memory.dmp

Download

memory/2744-397-0x0000026EB5F60000-0x0000026EB5F61000-memory.dmp

Download

memory/4856-44-0x00007FFA58D50000-0x00007FFA58D51000-memory.dmp

Download

memory/5772-291-0x00007FFA590A0000-0x00007FFA590A1000-memory.dmp

Download

memory/5772-292-0x00007FFA59940000-0x00007FFA59941000-memory.dmp

Download