65835af691b37f84b304fe804b2cb013b6fc24b9292c61f72bb6671c59dca966

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kuaihuiping.exe
Size 9.9MB
Sample260825-12l19seq7z
SHA256 65835af691b37f84b304fe804b2cb013b6fc24b9292c61f72bb6671c59dca966
MD5 63b3ed577e0f4301e0a01cfdf3eeeeaa
SHA1 7e069b10228a7b47e5d6d5595dc0fbbfec08b766
SHA512 61192529d290ff433648777827230ef8994f5d75ed9b9814ac8ce2b889442a9e8b44e934c9c1d9ae50308382d3165360dcf723cf9c0f63774916e354ea90b9a0
SSDEEP 98304:HKSTDOuT7/d9V1GfT55Ir4uUslq1okvXDcCQobrpRUQPNwIU9z8cJXfXq3:XTDv/KQrPi5JwIZ2Xy3
TLSH
T138A65943F26290E8C16AC175835A6233FB317C4907357AEB5BE48B253F62F906A3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kuaihuiping.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_1342624073\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_1276475262\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_1342624073\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_1342624073\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_1276475262\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_1342624073\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_1276475262\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_1342624073\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4676_712049693\english_wikipedia.txt	msedgewebview2.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
432	cmd.exe
460	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1052	msedgewebview2.exe
4676	msedgewebview2.exe
5128	msedgewebview2.exe
3328	msedgewebview2.exe
3160	msedgewebview2.exe
2516	msedgewebview2.exe
4680	kuaihuiping.exe
1224	msedgewebview2.exe
3428	msedgewebview2.exe
2984	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1524	reg.exe
5752	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3160	msedgewebview2.exe
3160	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4676	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4680	kuaihuiping.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4676	4680	kuaihuiping.exe	89
PID 4676 wrote to memory of 1224	4676	msedgewebview2.exe	90
PID 4676 wrote to memory of 5128	4676	msedgewebview2.exe	91
PID 4676 wrote to memory of 5128	4676	msedgewebview2.exe	91
PID 4676 wrote to memory of 5128	4676	msedgewebview2.exe	91
PID 4676 wrote to memory of 5128	4676	msedgewebview2.exe	91
PID 4676 wrote to memory of 624	4676	msedgewebview2.exe	92
PID 4676 wrote to memory of 3428	4676	msedgewebview2.exe	93
PID 4676 wrote to memory of 3428	4676	msedgewebview2.exe	93
PID 4676 wrote to memory of 3428	4676	msedgewebview2.exe	93
PID 4676 wrote to memory of 3328	4676	msedgewebview2.exe	94
PID 4676 wrote to memory of 3328	4676	msedgewebview2.exe	94
PID 4676 wrote to memory of 3328	4676	msedgewebview2.exe	94
PID 4676 wrote to memory of 3328	4676	msedgewebview2.exe	94
PID 4676 wrote to memory of 3328	4676	msedgewebview2.exe	94
PID 4680 wrote to memory of 432	4680	kuaihuiping.exe	95
PID 4680 wrote to memory of 1524	4680	kuaihuiping.exe	97
PID 4680 wrote to memory of 460	4680	kuaihuiping.exe	99
PID 4680 wrote to memory of 5752	4680	kuaihuiping.exe	101
PID 4676 wrote to memory of 2984	4676	msedgewebview2.exe	106
PID 4676 wrote to memory of 2984	4676	msedgewebview2.exe	106
PID 4676 wrote to memory of 2984	4676	msedgewebview2.exe	106
PID 4676 wrote to memory of 1052	4676	msedgewebview2.exe	107
PID 4676 wrote to memory of 1052	4676	msedgewebview2.exe	107
PID 4676 wrote to memory of 1052	4676	msedgewebview2.exe	107
PID 4676 wrote to memory of 3160	4676	msedgewebview2.exe	108
PID 4676 wrote to memory of 2516	4676	msedgewebview2.exe	109
PID 4676 wrote to memory of 2516	4676	msedgewebview2.exe	109
PID 4676 wrote to memory of 2516	4676	msedgewebview2.exe	109

C:\Users\Admin\AppData\Local\Temp\kuaihuiping.exe
"C:\Users\Admin\AppData\Local\Temp\kuaihuiping.exe"
1⤵
- Checks whether UAC is enabled
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=kuaihuiping.exe --webview-exe-version=2.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4680.5312.10617354776299801297 /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc
  2⤵
  - Drops file in Windows directory
  - System Network Configuration Discovery: Internet Connection Discovery
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView /prefetch:4 /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcedff5fd8,0x7ffcedff5fe4,0x7ffcedff5ff0
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView" --webview-exe-name=kuaihuiping.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,14419990224339903652,6764584448211120697,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView" --webview-exe-name=kuaihuiping.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2112 --field-trial-handle=1796,i,14419990224339903652,6764584448211120697,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView" --webview-exe-name=kuaihuiping.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1796,i,14419990224339903652,6764584448211120697,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView" --webview-exe-name=kuaihuiping.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3440 --field-trial-handle=1796,i,14419990224339903652,6764584448211120697,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc /prefetch:1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView" --webview-exe-name=kuaihuiping.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=1796,i,14419990224339903652,6764584448211120697,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView" --webview-exe-name=kuaihuiping.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4488 --field-trial-handle=1796,i,14419990224339903652,6764584448211120697,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView" --webview-exe-name=kuaihuiping.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4492 --field-trial-handle=1796,i,14419990224339903652,6764584448211120697,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView" --webview-exe-name=kuaihuiping.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=1796,i,14419990224339903652,6764584448211120697,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:831ce7f877ed5219fa1b77c7c3dc1124af1f7efc
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2516
- C:\Windows\system32\cmd.exe
  "cmd" /c "vol C:"
  2⤵
  - Executes a command shell one-liner
  PID:432
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:1524
- C:\Windows\system32\cmd.exe
  "cmd" /c "vol C:"
  2⤵
  - Executes a command shell one-liner
  PID:460
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
  2⤵
  - Modifies registry key
  PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 62df41e705f38f9183a5a19edd2d9fe539b3fb37eca7a537d06c45282ed684b1
MD5 96c7700a2e113b0e1ce41a8a80a6badc
SHA1 0c70541f0bf0ad0f268b9b7b4284c982a6ca9fa3
SHA512 a9bb87c87ad51c65624cf9a6d4fc6938c9672468274906a3405c159fa42d7734d3c621dcf63821b2a4d5f0c7011f13c52487d297ead9ded771becc19d362714e
TLSH
T140D0122B3A210134C11020330003F1083411E20B400D40409438D63D5F944502906491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 51f453af9f0a4af7b85583bde3de1d06f7e6bc4f581cc44771bd9e4243f94052
MD5 5e135fabf58a5bddfb3c8a230fcae731
SHA1 128429a584f28afa9d972e6124c36420e39abb0b
SHA512 35183c0c03ff71f51df22ac42e4c9618dbd8d5e107d8189b5b9e6f71c04ccbc381ae7df94348fd942293fe9f5c59ed4db143d16efabbfec4c3d2ac958e221828
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 bb63bba916a88c5ca1cd1eb6c40486ed35140ad4f659003b4f0f1c59140007df
MD5 4795caba82f01fcbe84b88ee31cabad8
SHA1 46aeb8bb7fd7220af19d05f9414d5af5ec4f9889
SHA512 b27d54dd0de1c0e5e50a27352bcdb38c824f2bb038428ac0e1181ecdfa268af2f1eb87c179aea2044810fafdc65137cff9a7360bdacb5e4b5ff272f79f18af5d
TLSH
T1EDA00211064D4553C12187B021C602C833BE89524287ABC9D4E0C168B950B80C532400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ce04.TMP

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59ce04.TMP
Size 48B
SHA256 32f321f09ee8f48e2f5258fafabde9b337ae7389c43ebf868fb6977dd931788a
MD5 d51b6bd2ee066188191adad46b1db296
SHA1 edac4f85699857d688b2ba90cc9827a42f7831fb
SHA512 2604732f96e3be1983e757275e10a43f5e17a7f4987ea4a64cda813d395517c02ed91af1c903bdcbf59256867d6fe6a92f0990389b34f4e136d7a8e17c03a97d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa430.TMP

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Default\Network\Network Persistent State~RFe5aa430.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Default\Preferences
Size 6KB
SHA256 24eab6b6e54bdeaa18a4e1e5a6ca45b2c9ba80469d39023d2a124528d1ba9f8d
MD5 351e100d881f8abc2c8d7ba779219c07
SHA1 b7b6895dc34076096c28e3fe3089806d17a85d5b
SHA512 6c1d745467eda9901ebbbe092a4d8346b98a5d1625057a6882d54ddcdd6d8cab9ee90ccd0fc39f5f710ee719ab571f77805ebafd70247c8e37cfc13e71e790d0
SSDEEP 96:stOp/dXj+yGYb9skOo5h16Z0as7/x+6MhmuecJgO1eje4UK+gn28XM1C7K:stAxyVonasV+FdgOQj/H5G6K
TLSH
T14FD195025E24B9BB8CC6E119FB397B57E2F9607265941E48EBF8452C08DB6DC730780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f642bcb5-e0b1-4df8-9854-af1905b94564.tmp

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Default\f642bcb5-e0b1-4df8-9854-af1905b94564.tmp
Size 6KB
SHA256 f140c42503f7c92295583f831e034478d3b108d59918c48c505d900f72d4d2f6
MD5 242f161f75997f4692cbf1aeb45f1b32
SHA1 bbb3cb18b68f7aa45f085b9efb423c013f452845
SHA512 896f112d695fd6d39ca1b2014ea7bc5009145099ae7111ac97cf53097834184b5b619d6222034740b9d3bb8a7382cd9baa8cd6320348e81bcc6adb4044543b31
SSDEEP 96:stOp/dXj+zYb9skOo5h16Z0as7/x+6MhmuecJgO1eje4UK+gE28XM1C7K:stAxYVonasV+FdgOQj/H6G6K
TLSH
T10ED195026E24B9BB8CC6E119FB357A57E2F9503264D55E58EBF8462C04DA6CC730790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Local State
Size 15KB
SHA256 7b54357a27e9bf1f8e16718aa845b0cd3b1207bc51c133737f0a37e8586d4dd6
MD5 6aed8299a63907f15cdd69122e01e0d9
SHA1 784ef8fce0e1708ced0b9cc1ced965822b7d7bab
SHA512 1d56287f52d8e4868779b1caa8293d9068d6cc862118a16ad0d3022ada84de448358c5b4da32291f9e0f21f17e43229e7b7533ccad85b70955be5bfc20e006b1
SSDEEP 384:p+aQikB+z/xvxjg/qhE8NBShMDAioJIyd4n9z0:U/UxvxjgC+0MWa4nF0
TLSH
T16772AF1B95787E27E5F3D604B9091B9FCBB894A291C16E784AFD6F0902873D82306817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Local State
Size 2KB
SHA256 4f2154f8a6e573faf068285493aacecd299d1a7f5847925b9cbb5dca79b27eeb
MD5 eff9a9d7ab8b8d04ca2dbca3fe913fec
SHA1 a5210cd3451c9369a4ee23a5f114c8dcbe0cfb88
SHA512 cdf961f178f3d190e9caf330f0777d9d0c9f8a39fa508033250d12bbbb857a99ecd4a67f6ed1fddcb769ec0fcfad4df93faa888c6387354d9b9d954c597ad7f6
TLSH
T15C5177337814AB77DAE24718B90B3B27CD3A9096AE921F1496ED0B1941D715C7705837
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Local State
Size 3KB
SHA256 c596f2eb1586cdd713761d2fef9801a00b2db8c6eb25dd98f816eb520795e7ea
MD5 d717a2696b4198e211c902c8923a32d9
SHA1 a5a4d98fef7ae88ffc49319dafff9dbb8d4b85a6
SHA512 eecd1a6fa8cd412c84527be08d21c0a6d1a3e642b131ba4cef4c0880137fb4edcac9aeabf2d1a7bd3140c727cb88c07f92ee7e4d5153f0913a073268cf36b96a
TLSH
T1446194236864E93B8EE29B14B9473B17A6A55063E9C53F58D6EC0F1D41D729C2341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597b8f.TMP

Path C:\Users\Admin\AppData\Local\com.kuaihuiping.app\EBWebView\Local State~RFe597b8f.TMP
Size 1KB
SHA256 4168ae6acdd7997f95291505f07961318eb056b65c4cc737e79de3f8e7f1c1ec
MD5 3267e9b289102fed1df4bb9f6402130f
SHA1 b88a03c385a67e986003d72dadb356a97beb8ea6
SHA512 d1a4e7871b12c6c45e18caa527e01be66238aab2e1f4f3a63294c5cec66efa837128248891a7f12647c142f145c580b8894bb522fa2c059d336f24c108aecb42
TLSH
T18421B7B3E464AF33EDD1574E7207B66B4D315097C6810E0462EE4B2782E318CE42A837
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2984-258-0x00007FFD0E0F0000-0x00007FFD0E0F1000-memory.dmp

Download

memory/2984-257-0x00007FFD0F870000-0x00007FFD0F871000-memory.dmp

Download

memory/3160-325-0x000001759BE60000-0x000001759BE61000-memory.dmp

Download

memory/3160-316-0x000001759BE60000-0x000001759BE61000-memory.dmp

Download

memory/3160-314-0x000001759BE60000-0x000001759BE61000-memory.dmp

Download

memory/3160-320-0x000001759BE60000-0x000001759BE61000-memory.dmp

Download

memory/3160-324-0x000001759BE60000-0x000001759BE61000-memory.dmp

Download

memory/3160-323-0x000001759BE60000-0x000001759BE61000-memory.dmp

Download

memory/3160-322-0x000001759BE60000-0x000001759BE61000-memory.dmp

Download

memory/3160-321-0x000001759BE60000-0x000001759BE61000-memory.dmp

Download

memory/3328-102-0x00007FFD0F5F0000-0x00007FFD0F5F1000-memory.dmp

Download

memory/5128-199-0x0000020C16BB0000-0x0000020C16C58000-memory.dmp

Download

memory/5128-26-0x00007FFD0F5F0000-0x00007FFD0F5F1000-memory.dmp

Download