0b747ed67113bbb27248dcc510f006b1e79c008b1450eb2d1c3df3b4c033500d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
scanwrx.exe
Size 9.2MB
Sample260905-blk2la1vfy
SHA256 0b747ed67113bbb27248dcc510f006b1e79c008b1450eb2d1c3df3b4c033500d
MD5 63eff68e20256125cadec7944a94681d
SHA1 e19ffce5004cf8a51c7ddad6c079d8e1f50e5ced
SHA512 0c50efff9b9486dbea491be0b3e4d74fd630400bb49e306807db60e4bf427c2e5b57d5c0d59589d47f4df175c86621132c8584b46def45fa6c2c15d71c5f879a
SSDEEP 98304:cQSaM/IpoSUWoDPdeufqHujn3UlB1Xzv4NRT9f5A9JVXXmIydRhl71xgFm2cr5a:dN27deVSFJ5sXWIyPhrOK1a
TLSH
T1F8A66C03F6A241E8C0AEC175C35AA633EB76B88D4930B2AF5BD44B212F56F506F5D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	scanwrx.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_544064496\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1199055192\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1199055192\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_544064496\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1199055192\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1199055192\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_1199055192\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_466300443\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5088_544064496\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1004	msedgewebview2.exe
1004	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5088	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1172	scanwrx.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 5088	1172	scanwrx.exe	89
PID 5088 wrote to memory of 5100	5088	msedgewebview2.exe	90
PID 5088 wrote to memory of 4680	5088	msedgewebview2.exe	91
PID 5088 wrote to memory of 4680	5088	msedgewebview2.exe	91
PID 5088 wrote to memory of 4680	5088	msedgewebview2.exe	91
PID 5088 wrote to memory of 4680	5088	msedgewebview2.exe	91
PID 5088 wrote to memory of 2744	5088	msedgewebview2.exe	92
PID 5088 wrote to memory of 2112	5088	msedgewebview2.exe	93
PID 5088 wrote to memory of 2112	5088	msedgewebview2.exe	93
PID 5088 wrote to memory of 2112	5088	msedgewebview2.exe	93
PID 5088 wrote to memory of 5544	5088	msedgewebview2.exe	94
PID 5088 wrote to memory of 5544	5088	msedgewebview2.exe	94
PID 5088 wrote to memory of 5544	5088	msedgewebview2.exe	94
PID 5088 wrote to memory of 5544	5088	msedgewebview2.exe	94
PID 5088 wrote to memory of 5544	5088	msedgewebview2.exe	94
PID 5088 wrote to memory of 4312	5088	msedgewebview2.exe	98
PID 5088 wrote to memory of 4312	5088	msedgewebview2.exe	98
PID 5088 wrote to memory of 4312	5088	msedgewebview2.exe	98
PID 5088 wrote to memory of 436	5088	msedgewebview2.exe	99
PID 5088 wrote to memory of 436	5088	msedgewebview2.exe	99
PID 5088 wrote to memory of 436	5088	msedgewebview2.exe	99
PID 5088 wrote to memory of 1004	5088	msedgewebview2.exe	100
PID 5088 wrote to memory of 4800	5088	msedgewebview2.exe	101
PID 5088 wrote to memory of 4800	5088	msedgewebview2.exe	101
PID 5088 wrote to memory of 4800	5088	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\scanwrx.exe
"C:\Users\Admin\AppData\Local\Temp\scanwrx.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=scanwrx.exe --webview-exe-version=1.0.0-rc.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1172.4176.14021597680590407340 /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView /prefetch:4 /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffd8da05fd8,0x7ffd8da05fe4,0x7ffd8da05ff0
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView" --webview-exe-name=scanwrx.exe --webview-exe-version=1.0.0-rc.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1384 --field-trial-handle=1776,i,4719186940340367865,22703203321859132,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView" --webview-exe-name=scanwrx.exe --webview-exe-version=1.0.0-rc.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=1776,i,4719186940340367865,22703203321859132,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView" --webview-exe-name=scanwrx.exe --webview-exe-version=1.0.0-rc.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2336 --field-trial-handle=1776,i,4719186940340367865,22703203321859132,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView" --webview-exe-name=scanwrx.exe --webview-exe-version=1.0.0-rc.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2520 --field-trial-handle=1776,i,4719186940340367865,22703203321859132,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06 /prefetch:1
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView" --webview-exe-name=scanwrx.exe --webview-exe-version=1.0.0-rc.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=1776,i,4719186940340367865,22703203321859132,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView" --webview-exe-name=scanwrx.exe --webview-exe-version=1.0.0-rc.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4408 --field-trial-handle=1776,i,4719186940340367865,22703203321859132,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView" --webview-exe-name=scanwrx.exe --webview-exe-version=1.0.0-rc.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4500 --field-trial-handle=1776,i,4719186940340367865,22703203321859132,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView" --webview-exe-name=scanwrx.exe --webview-exe-version=1.0.0-rc.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1064 --field-trial-handle=1776,i,4719186940340367865,22703203321859132,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cb228718e2a7a30a94dddbe03fcb1caf70dd3d06
    3⤵
    PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8ac4c598a915804dcf05cf182c1212aaaf39daecdf9f3f224342abe84141c0ec
MD5 90fba49fd50515fbfb6a0a73628089c3
SHA1 a6a2051546f9f6a9d444a7385cb4057be1509326
SHA512 50c6f943ad8d9cab009152abd21c96b69a1156154f79e42f019f99761bbb3fd8e77b886b3027d9babdd0e5c79ff05b51a868312a29f58a6938c19e102de55e26
TLSH
T169D012127A060234C01021335502610C1440C1CB400640816428895D3A480640B07855
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c7228c085a7060b656e1a86c7edcd46146b6445189649ba9286502cf4a0f6c66
MD5 68c629f75ccc689c3227859b7cbc5267
SHA1 af277cba71ccc436fee5ba2e157bdfecf8d988a4
SHA512 aab56f8987d3b2c6ee4a49873c34db6a6b8f2f865d1bf44b91f756b1273d0b1e49ab7061636cbfd0f80bb88fc89471e6774ae15e7508a76b1912733913ccc681
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0deed583-6c36-4a23-b1ec-74f08838e27a.tmp

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Default\0deed583-6c36-4a23-b1ec-74f08838e27a.tmp
Size 6KB
SHA256 a70efc4cd4bd18bf0a2f701a24ca45395f550c1287ab8cbe6e37a9f09e7e92a0
MD5 1ccc5ee3c8c12e6f99a90250baecd079
SHA1 298606bb2ee5d72e00323f42fc3b7421f8a380ba
SHA512 8085f45f4e2961c2b1d50fba78141810fc40a6340a7a2a4023e000c1b7a6e6bf21e540280cd193b186a1454e42b75676f667a9a66c13d62a992eed796e9d0083
SSDEEP 96:stk/dKTeHb99Fkgo5h16Z0FCs7/x+6MhmuecJFIs1ejeiK+gK+28XM1C7K:stoocfon4sV+FdesQjqU+G6K
TLSH
T18CD183025E28797B4CC6E509BA297B17E2F9643264D61E58E7FC462C09DA6CC7307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 676fb917f187b287cdb83e748ae45ee85d4176552f558552d190885e68659ac8
MD5 612c844bf0a729c1c103fabe092bacbd
SHA1 c02e686c8fc9b4cd4303bb6d33bfd523caede80b
SHA512 29c80ef19673acff5ca0559684c0c68de074cea83a9664c6f14259c979d698cf401f26c9cd9ebd3a03f2d8b41304884205bf27144935e22909b6aad110c54c7b
TLSH
T1E1A002114A825456D1304B7070C5435632B38D6212471F0191F0D1B49D787436102206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 22a46452d3a9170d69827ea8dc68455807f429e7ac51077d5a3b1f617e0d1044
MD5 30e5134b7cbdac5896a1027665f68653
SHA1 086b620a3d9df5f8b942fa4a084a40f5fcdd1ccb
SHA512 c1a5d16835c99d06dad48711d874535e82a40830657951bfcdfe53ccbec360c575f16369b613f7c66745789c774eb64ecad33349ae74f5de62eecd4b9c278d47
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a1668.TMP

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Default\Network\Network Persistent State~RFe5a1668.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Default\Preferences
Size 6KB
SHA256 7c45116ac20c84d64cf3c92960edb8a8c4c0261c47d9951335be481f10973232
MD5 0344354a6ef6cc95fc60c2e1b19a695d
SHA1 9f4202d3d8a4c36880cb4c0e2e3b63f97fc150d9
SHA512 ce5b6827eb0141ab4bd2da7bbd0a9295e0a7800862a31a48ecb73d8911bcdb6e9c72114d2bee0eab4d329aaef564bf84417869124ea2c00052301d8103738c8e
SSDEEP 96:stk/dKTFGHb99Fkgo5h16Z0FCs7/x+6MhmuecJFIs1ejeiK+gA+28XM1C7K:stoo2fon4sV+FdesQjqq+G6K
TLSH
T1D2D183025E68787B4CC6E509BA297B13E3F9647264961E58E7FC452C09DAACC3307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Local State
Size 15KB
SHA256 f8d252de526e1b0217f57cab8bf2befcd419cd9fccf3f2948b484e9a71446164
MD5 e12ab1725aa94fbd77b18e09cfbdcc78
SHA1 1753aaf438eefd655726d7dbb5d87e0a0e4d38bd
SHA512 6bc9e97ddb91ff69fadd5e6fe3546672620ff29eb6e89cc38ce3e1d4c621fa4add61623d03657b7a08b926d05c233f4a9d6e91d5d105846419e36a6fb4505a9d
SSDEEP 384:E+aQikB+z/xvxjg/qhEwNBS/o/dp4KNIE9zW:j/UxvxjgC+3oVGKbFW
TLSH
T197728D2754697E339AF3A6057D590B4BCFB998A390C26EB84EFC5F0E0AC73941342D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Local State
Size 2KB
SHA256 28913bcac6b86bbe28f9a402da9e1e325f282fa221c66dc6d886a4e40056279b
MD5 6984294a95fcc89b687da41f899cb8b1
SHA1 b7bad44107eb4bcd5d201c10be51af6494f73a4b
SHA512 a9c9d44dcc85a79cef7fc82f6ced8aed4642c2791f71d120ef6a942a4bd7129c61e9f2fcf10c3fd7038865be8f4926c99e2b78ca173a4877bea30d700f5869b1
TLSH
T1CD5192336824AB778AE287097D4A7F22DF7550629A561F149BEC1B0C41DB24D2346C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Local State
Size 3KB
SHA256 034c02008ad740f77dcfeba38981c76b7af851fb9e03d05bd356b834aac3671c
MD5 c87da52537e1a8597baff3dfeffe0456
SHA1 e4de0e34d494494925975ec7d815327e343e7a76
SHA512 d5014e2b251574feaa1b2e6e9d8b9f93c052870a2fcc8a428c22dae7b60df296b1322c9defb0634024b52890f762360951a6e7a64ade07259cd3e775407eb311
TLSH
T15A6166376934A9778EF28B057C863B16ABA55023E5963F58C6FC1F0D01DB3882342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58ee53.TMP

Path C:\Users\Admin\AppData\Local\com.companywrx.scanwrx\EBWebView\Local State~RFe58ee53.TMP
Size 1KB
SHA256 1ff9cb6e44468a92bbfc60c172d3a692b1128816a3e332320c02246ef8e1e08c
MD5 cf7317e47bf07cab73fdb5a7e7d5bd02
SHA1 20de2f69d89457d4a6aa6efc9910adf189cbc1fc
SHA512 0e1a72edc5b13fd79dd8f87e8d3aa3d72beef04c26dff6a9986b3a020ba2bd799d37242389c3f816c970546a165b2bec692659aefb48a089135ea18e3c9f7aea
TLSH
T1DF216573E4285FB3DD91574B391A7B079F71102782158F0853ED5B0E42DA24DA55EC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-329-0x000001DF58FE0000-0x000001DF58FE1000-memory.dmp

Download

memory/1004-331-0x000001DF58FE0000-0x000001DF58FE1000-memory.dmp

Download

memory/1004-337-0x000001DF58FE0000-0x000001DF58FE1000-memory.dmp

Download

memory/1004-340-0x000001DF58FE0000-0x000001DF58FE1000-memory.dmp

Download

memory/1004-338-0x000001DF58FE0000-0x000001DF58FE1000-memory.dmp

Download

memory/1004-336-0x000001DF58FE0000-0x000001DF58FE1000-memory.dmp

Download

memory/1004-339-0x000001DF58FE0000-0x000001DF58FE1000-memory.dmp

Download

memory/1004-335-0x000001DF58FE0000-0x000001DF58FE1000-memory.dmp

Download

memory/4312-252-0x00007FFDB0140000-0x00007FFDB0141000-memory.dmp

Download

memory/4312-253-0x00007FFDAEA10000-0x00007FFDAEA11000-memory.dmp

Download

memory/4680-28-0x00007FFDAE330000-0x00007FFDAE331000-memory.dmp

Download

memory/5544-103-0x00007FFDAE330000-0x00007FFDAE331000-memory.dmp

Download