1651fa337a3ee8d1587ca533094c87d8f7fbea0b05f62e289aad629e20b48358

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pometype.exe
Size 39.8MB
Sample260907-dpyg7sed96
SHA256 1651fa337a3ee8d1587ca533094c87d8f7fbea0b05f62e289aad629e20b48358
MD5 7bed9b598eba9befda899ee5102aaef1
SHA1 ff6540a458c2e8fd328852d3fdea45675a9d6324
SHA512 d1ddb42060dd33aaf236a68c9ce120442c87fd6c365893d38357e3b49ec71659694d4895eeacf38fa6e7742d9cae0e77cbe46fc5646ee051f07dc2c1bd1f0713
SSDEEP 393216:t3NsLW8Cxt/WRntoLbonfHXRxCO451OD8vKkPfRDUf99wpzFTMVbcMpXC58IOp:gLW8Cxt/WRntoLbonfHhE91OiKDWy
TLSH
T16B975A25BA9A59ACD0ABC074834B8A63EE7130CA073569FF04D442753F6ABF06F39715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\PomeType = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pometype.exe "	pometype.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pometype.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2348	pometype.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
848	msedgewebview2.exe
848	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1628	msedgewebview2.exe
1628	msedgewebview2.exe
1628	msedgewebview2.exe
1628	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe
2348	pometype.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2348	pometype.exe
2348	pometype.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1628	2348	pometype.exe	89
PID 1628 wrote to memory of 5676	1628	msedgewebview2.exe	90
PID 1628 wrote to memory of 6116	1628	msedgewebview2.exe	91
PID 1628 wrote to memory of 6116	1628	msedgewebview2.exe	91
PID 1628 wrote to memory of 6116	1628	msedgewebview2.exe	91
PID 1628 wrote to memory of 6116	1628	msedgewebview2.exe	91
PID 1628 wrote to memory of 2052	1628	msedgewebview2.exe	92
PID 1628 wrote to memory of 4448	1628	msedgewebview2.exe	93
PID 1628 wrote to memory of 4448	1628	msedgewebview2.exe	93
PID 1628 wrote to memory of 4448	1628	msedgewebview2.exe	93
PID 1628 wrote to memory of 5056	1628	msedgewebview2.exe	94
PID 1628 wrote to memory of 5056	1628	msedgewebview2.exe	94
PID 1628 wrote to memory of 5056	1628	msedgewebview2.exe	94
PID 1628 wrote to memory of 5056	1628	msedgewebview2.exe	94
PID 1628 wrote to memory of 5056	1628	msedgewebview2.exe	94
PID 1628 wrote to memory of 3280	1628	msedgewebview2.exe	95
PID 1628 wrote to memory of 3280	1628	msedgewebview2.exe	95
PID 1628 wrote to memory of 3280	1628	msedgewebview2.exe	95
PID 1628 wrote to memory of 3280	1628	msedgewebview2.exe	95
PID 1628 wrote to memory of 3280	1628	msedgewebview2.exe	95
PID 1628 wrote to memory of 2668	1628	msedgewebview2.exe	96
PID 1628 wrote to memory of 2668	1628	msedgewebview2.exe	96
PID 1628 wrote to memory of 2668	1628	msedgewebview2.exe	96
PID 1628 wrote to memory of 2668	1628	msedgewebview2.exe	96
PID 1628 wrote to memory of 2668	1628	msedgewebview2.exe	96
PID 1628 wrote to memory of 5380	1628	msedgewebview2.exe	97
PID 1628 wrote to memory of 5380	1628	msedgewebview2.exe	97
PID 1628 wrote to memory of 5380	1628	msedgewebview2.exe	97
PID 1628 wrote to memory of 3732	1628	msedgewebview2.exe	98
PID 1628 wrote to memory of 3732	1628	msedgewebview2.exe	98
PID 1628 wrote to memory of 3732	1628	msedgewebview2.exe	98
PID 1628 wrote to memory of 3732	1628	msedgewebview2.exe	98
PID 1628 wrote to memory of 3732	1628	msedgewebview2.exe	98
PID 1628 wrote to memory of 848	1628	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\pometype.exe
"C:\Users\Admin\AppData\Local\Temp\pometype.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2348.1128.5798112097977178719 /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView /prefetch:4 /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x108,0x7fff4b915fd8,0x7fff4b915fe4,0x7fff4b915ff0
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,17385799938015877533,16228407749616952994,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1736,i,17385799938015877533,16228407749616952994,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1736,i,17385799938015877533,16228407749616952994,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3536 --field-trial-handle=1736,i,17385799938015877533,16228407749616952994,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3972 --field-trial-handle=1736,i,17385799938015877533,16228407749616952994,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4204 --field-trial-handle=1736,i,17385799938015877533,16228407749616952994,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963 /prefetch:1
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=1736,i,17385799938015877533,16228407749616952994,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4564 --field-trial-handle=1736,i,17385799938015877533,16228407749616952994,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView" --webview-exe-name=pometype.exe --webview-exe-version=1.0.50 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4716 --field-trial-handle=1736,i,17385799938015877533,16228407749616952994,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:33127846ae59a274ea312698e1a6ac4faef99963
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:848

C:\Users\Admin\AppData\Local\Temp\pometype.exe
C:\Users\Admin\AppData\Local\Temp\pometype.exe
1⤵
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cloud-account.json

Path C:\Users\Admin\AppData\Local\PomeType\cloud-account.json
Size 170B
SHA256 5db4a6dd097a72ce07d76314a2999010d45768dd131084558136bb80b26716c4
MD5 6eb4cece4f6e23283c99d178e886f64f
SHA1 fe1d24860562b2b7e36caad27c4e6f16d42ede42
SHA512 9827951cc66ed5cb68ecdb204121b2f7ea359f5068a6e290515ee958445f71306908248fce983d5d3673d04ac049ea0aadfee789d9e6c3a458f82fda5070014d
TLSH
T1CDC0805D9287746716C76730DE3155141504C839454575AD11F637B1F60D45351D4944
MD5 SHA1 SHA512 TLSH

Submit Download

preferences.json

Path C:\Users\Admin\AppData\Local\PomeType\preferences.json
Size 2KB
SHA256 56d34e21180e207ccbaa376d57aa835c7a697552f635a32729ef58f305def7e3
MD5 5778043784c610d13a3d97704f43caa8
SHA1 0cda7e989bd0f49aa929fa223429f31f36af2435
SHA512 0f53ae392e733e1eb0a6c1f40d13f89489bf1ada94f4cc07902bd60674221a189272e08234c95d35aef6bec310dd21e56e005eaf8b973379c424b488eccfd1d4
TLSH
T156411C30D1642DF601918578E8EE62971B24DC270E553C38B680844C2F8E77E66BBFE6
MD5 SHA1 SHA512 TLSH

Submit Download

translation-diagnostics.jsonl

Path C:\Users\Admin\AppData\Local\PomeType\translation-diagnostics.jsonl
Size 863B
SHA256 0c33c9401ccecaa363f408291c2b904a9615bca15cf6e79f09f3f07fedd7b81f
MD5 88f30517d9807f827b4d3688efbba8b2
SHA1 36563d69c0f0bc2810481ca6da748c9d1083d8a6
SHA512 1cb117a1e5e1779872b3d3dbb5745c6ea8161a57ff257fe627b1c967de3a283e989a826c2d23a562c5f96a851c4ef7c4fe61cdada8a29ced10e273cc7c0be67a
TLSH
T15B11400D74001CBE6F93B799F52E0F895710E36BC4C14EA6CAEC4E6100EA99EE13283D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c9950410a252aa6c3509f17ecf60adf0e6bb25d04d9055935344dc8b984d10af
MD5 d7b9cb5947f73978312b6f8d7b5181d5
SHA1 e5f50ec720500adef07d76524d72d738de94c464
SHA512 dd554e96b00f6c67eeab408502ddd00e55ec4196713d554f8fa8bc04b1f8051a00a47157dc96d57eaa7811588bd31ca19477f96eb98b640d62c63991d1722952
TLSH
T194D0121236110E34C0202E33100265880403C10B810648545C29C65E2A440500A03891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 359ac4d994f8051a99b909522d0c7f231d0545a76cc4975e9d34b711a3fc8689
MD5 cd7d9b8816354e68d9b237d56bffce12
SHA1 5618d8507495d0c25ecbb5f8e79fc6742de6df11
SHA512 d894dc2e3c7020a8f58c965317c8893fea9913049b493f265183f0db186763d40260c6b58cfd58fbd4eb8e81f29f130cab5e66892b49df394d63c2a581143c27
TLSH
T113D0045055140D01C0141F31101045C04117C40051031D740C11414514C11014143554
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

84a28ce6-082c-49e8-933a-526656c590cf.tmp

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Default\84a28ce6-082c-49e8-933a-526656c590cf.tmp
Size 6KB
SHA256 42e8a61de7ac66789d8eb5c46c804e78277545e5ff49ff89a916b764053f07d8
MD5 23c15002c3b7ed5785e9e530edefa623
SHA1 a591e8a3219832ba3fba58a18f116e809ba6b608
SHA512 89b968481c802abdfa668d1056f02eb290cf1945714e6bf664f88a3399270fb6d8f5e31ff56f691efa4e44feeb4334cd069c1f948020b96cb2ec4890f468d804
SSDEEP 96:stD/d8xom7dNb9Fkyo5h16Z0Js7/x+6MhmuecJ+XuljeTK+gT3r28XM1C7K:st7MocRonJsV+Fd+X2j5t3rG6K
TLSH
T1CED185015E68797B4CC6F109BE29BA02E2F9647275961E98E7FC496C04DB6CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 aa69c142ee86e0a3b76199bf778867e7e37c37674091e7783772b5774adbd02d
MD5 d7e6d0555f4ffc8a3bb2717ff2bc922f
SHA1 7214a876c40fbfbb2734208013e8d436771dd516
SHA512 a6e015bd088f5be4177075c2de1931d28856b02a8a8a85dfb260fc6991f7ca2de76eab7e4f333b80e9cae32aadfffd34417f02ac1c1208cc7bd836181dc9d53a
TLSH
T1ACB012000412119BC208B2700CC9509179347C10031705020050893CE024350D150035
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e286.TMP

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e286.TMP
Size 48B
SHA256 0ad06db5316f5c706df56d441809b7dc96d2cd509379f299a825e9bc7f9aa016
MD5 2f1da518d952170cb9c8c3c14090ceda
SHA1 6d775f507d4963a3f654f2eb6be7500090d2ab79
SHA512 7add5d5177571b4f526f2d6cae7104946a7c60f1e6dd4c2bb0b03028685f0613620141c892dc62c50505f082c0f64e0e38209828f803c4a06c1725fda235028e
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ab288.TMP

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Default\Network\Network Persistent State~RFe5ab288.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Default\Preferences
Size 6KB
SHA256 709f181c9584db1ca87ae9a9f6264f02557b00ce6a9045d4fcea5d76623513ff
MD5 a4496b90e62a6f4b40fecea396346941
SHA1 c5952102a6a1510639162ebc0a425ef116554317
SHA512 c813e2c0c861417a173bb30d9856307a36d1855f657f34249a91e0a5ab45ee7a73f781d2588a9a3a9bfcb6b51493010fc0ebdaae2dfc8fdd60e20e516b2e2dfc
SSDEEP 96:stD/d8xomqGdNb9Fkyo5h16Z0Js7/x+6MhmuecJ+XuljeTK+gT3p228XM1C7K:st7MoWRonJsV+Fd+X2j5t3p2G6K
TLSH
T1FAD195015E68797B4CC7E108BE29BA13E2F9647275951E98E7FC496C04DB6DC2313D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Local State
Size 2KB
SHA256 f34eedfbf68d04df1abada4e43b87fd46d4ec156aeed954878f33118880c4080
MD5 00ff70f8e29eabf2800886c6c298f8e4
SHA1 66f78d0f76f0270d01d4ad40760514d808034745
SHA512 e6c4afdd0f006815073235ca03c8d9ef24ffcd7ea8bc66fc4921da959cabe87dd50b4491fca7d10e78da293d7659878466054c939e7544626b13a4f42b87251f
TLSH
T11F519533A824AB338AE387087D4B7E12CE359166BE972F909BDD0F2801C759D1701C76
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Local State
Size 3KB
SHA256 f41b71cd839aec4bbb39efc38ed57fdbd0299b1465433457e89f286389158b4f
MD5 30192250c4ee71c2618c484c2272690f
SHA1 860d9196bef3a5b5d69fa9dfcacb41524eb79bfa
SHA512 5c5c4c2e6437d1cd83d6ca117bcded77d4692619bfe31e4fa5c9f84cac9dd688ec5bacd99b788c4a41aa566cb2008aed498c15459a7432e42725c7dcb15c6e16
TLSH
T1CE618237A974AA378EE2DB04BC863B06EBA15123E9963F95C7EC0F1D01C32981301C66
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Local State
Size 15KB
SHA256 b0ca96563404965668a2748dee3c5ace603cba92a99f2f49617e567d63091ece
MD5 42126bd552d0f9598eb4144eaa4db7a8
SHA1 b0d2bd7c73cfeb450a7e335df1392370e9c22eec
SHA512 4a4e90bf53fb63b93ee46523489f142fac19576d88f79d088eeb9fa782ba24b30c37b013ebb6d14ff416eb25d7eb8305880f7d82acff1e9411b7df071b2095e1
SSDEEP 384:++aQikB+z/xvxjg/qhEHNBS6+zWeF99zz:J/UxvxjgC+qywFz
TLSH
T1D5729E2755787E339AF3E6047D491B8BCEB998A294C66EF44BBD0F0A07C32E81341C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe598b2f.TMP

Path C:\Users\Admin\AppData\Local\com.shiliux.pometype\EBWebView\Local State~RFe598b2f.TMP
Size 1KB
SHA256 fc051def98db78929473f2d548c6492ea9e0a342aa4cd39df64f0a8f495af86f
MD5 ce2ff0992ddceffa76a108f6c5dc72b7
SHA1 c5f71f906c7259ff718f697de898b4b99ddd4884
SHA512 00c20493ead224b34fc2b0c3f2e6fbc286f59a7bd8e8a022b295d0eef91f0a7c9c7d51b3e7964f87993322977648fa047684198d50c4c908508db69c3d242e1a
TLSH
T14C21B7B3E0342B32EDC2934A2907B9479E31152792564E4063DD4F3902D359D9B29C32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/848-343-0x00000206E1CE0000-0x00000206E1CE1000-memory.dmp

Download

memory/848-336-0x00000206E1CE0000-0x00000206E1CE1000-memory.dmp

Download

memory/848-334-0x00000206E1CE0000-0x00000206E1CE1000-memory.dmp

Download

memory/848-341-0x00000206E1CE0000-0x00000206E1CE1000-memory.dmp

Download

memory/848-342-0x00000206E1CE0000-0x00000206E1CE1000-memory.dmp

Download

memory/848-340-0x00000206E1CE0000-0x00000206E1CE1000-memory.dmp

Download

memory/848-345-0x00000206E1CE0000-0x00000206E1CE1000-memory.dmp

Download

memory/848-344-0x00000206E1CE0000-0x00000206E1CE1000-memory.dmp

Download

memory/5056-102-0x00007FFF6D820000-0x00007FFF6D821000-memory.dmp

Download

memory/6116-26-0x00007FFF6D820000-0x00007FFF6D821000-memory.dmp

Download

memory/6116-267-0x0000019EEC890000-0x0000019EEC8BF000-memory.dmp

Download