608ea581a01b8860d23a2a5494851fca31106189ad11d5c0f8d088d9000addd4

Analysis

user interaction
yes
max time kernel
134s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VTRL.exe
Size 4.0MB
Sample260907-ja18faep8s
SHA256 608ea581a01b8860d23a2a5494851fca31106189ad11d5c0f8d088d9000addd4
MD5 6d3bc274e60139c3d69c5746f63d6e32
SHA1 969ae7482177a3f83c9a7713db4865450e4e2dd8
SHA512 e88d2a52a13e02d78ae6ad65bfe76d365343d4660fdf4c8ca08002b8248176bf6432e6b6b12b4e54db7745c26d2271c773cc51580d5c5efb5036a30aa46cf32c
SSDEEP 98304:vpFPklz/aiAZEf7A8TfE7zX1YgVYO3K5:vP8lzivb87E7za5
TLSH
T187163313026D0D7CE726847EAF12534A749669345B58A1AE73C701F8E926BCCFCA1FC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan upx

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\VTRL = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VTRL.exe --flag1 --flag2"	VTRL.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VTRL.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/236-0-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-224-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-246-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-258-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-276-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-296-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-300-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-304-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-332-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-336-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-349-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-353-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-365-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx
behavioral2/memory/236-389-0x00007FF666090000-0x00007FF666F0C000-memory.dmp	upx

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\vtrl\shell\open	VTRL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\vtrl\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VTRL.exe \"%1\""	VTRL.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\vtrl	VTRL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\vtrl\ = "URL:cc.vtrl"	VTRL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\vtrl\URL Protocol	VTRL.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\vtrl\DefaultIcon	VTRL.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\vtrl\shell\open\command	VTRL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\vtrl\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VTRL.exe,0"	VTRL.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\vtrl\shell	VTRL.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
236	VTRL.exe
1424	msedgewebview2.exe
1424	msedgewebview2.exe
236	VTRL.exe
236	VTRL.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4460	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
236	VTRL.exe
236	VTRL.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
236	VTRL.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 4460	236	VTRL.exe	89
PID 4460 wrote to memory of 5356	4460	msedgewebview2.exe	90
PID 4460 wrote to memory of 6060	4460	msedgewebview2.exe	91
PID 4460 wrote to memory of 6060	4460	msedgewebview2.exe	91
PID 4460 wrote to memory of 6060	4460	msedgewebview2.exe	91
PID 4460 wrote to memory of 6060	4460	msedgewebview2.exe	91
PID 4460 wrote to memory of 1172	4460	msedgewebview2.exe	92
PID 4460 wrote to memory of 5516	4460	msedgewebview2.exe	93
PID 4460 wrote to memory of 5516	4460	msedgewebview2.exe	93
PID 4460 wrote to memory of 5516	4460	msedgewebview2.exe	93
PID 4460 wrote to memory of 6040	4460	msedgewebview2.exe	94
PID 4460 wrote to memory of 6040	4460	msedgewebview2.exe	94
PID 4460 wrote to memory of 6040	4460	msedgewebview2.exe	94
PID 4460 wrote to memory of 6040	4460	msedgewebview2.exe	94
PID 4460 wrote to memory of 6040	4460	msedgewebview2.exe	94
PID 4460 wrote to memory of 1424	4460	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\VTRL.exe
"C:\Users\Admin\AppData\Local\Temp\VTRL.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:236
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=VTRL.exe --webview-exe-version=2.6.0 --user-data-dir="C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=236.4576.7981568278889808518 /pfhostedapp:aa7442c79fcf87b1cb99f097cc734175fa617ff5
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView /prefetch:4 /pfhostedapp:aa7442c79fcf87b1cb99f097cc734175fa617ff5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb35ee5fd8,0x7ffb35ee5fe4,0x7ffb35ee5ff0
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView" --webview-exe-name=VTRL.exe --webview-exe-version=2.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,3870212429668046394,15502385627556007209,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:aa7442c79fcf87b1cb99f097cc734175fa617ff5
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView" --webview-exe-name=VTRL.exe --webview-exe-version=2.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1936 --field-trial-handle=1788,i,3870212429668046394,15502385627556007209,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:aa7442c79fcf87b1cb99f097cc734175fa617ff5
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView" --webview-exe-name=VTRL.exe --webview-exe-version=2.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1788,i,3870212429668046394,15502385627556007209,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:aa7442c79fcf87b1cb99f097cc734175fa617ff5
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView" --webview-exe-name=VTRL.exe --webview-exe-version=2.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1788,i,3870212429668046394,15502385627556007209,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:aa7442c79fcf87b1cb99f097cc734175fa617ff5 /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView" --webview-exe-name=VTRL.exe --webview-exe-version=2.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4436 --field-trial-handle=1788,i,3870212429668046394,15502385627556007209,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:aa7442c79fcf87b1cb99f097cc734175fa617ff5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3f9a3d5666d0cba8c0cca9ddc7049e010892d607d096084ecba18f1b3f0b3dd3
MD5 0e55bb2b9fe6ec7047bca575d3349727
SHA1 b1eec272d99f3edc7b6282cb94f11f41405f6f8b
SHA512 725f57291eaded49bec8ffcb1d8b80c72e900b50d7f0ed8d655411d0ed3aa8b13814e406b76f8611a2a1f4aedaa41362769ebd6a0a0e9c092efb8818bb36cc07
TLSH
T163D0121332110174C4102533101262080444D10B8549410A9428875E9A440700E06451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bd84d3f62f734bff3fe26ef34afa0e5a4e5aecf8de652e86684b8b243366c661
MD5 f9ae460e6aeb6758bd6a39496e1adf09
SHA1 8b57b82688dc80e445f0f8a802f4fd0f54618fa1
SHA512 82cdd5fc670e34a53444a59d5079c0f711a496711884a543e121e8716424e8dd8ba164197aada85cdcabfadda65ebe790808e7138b3da2b67668e8cc82384183
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8d532307b4c4b03db9161637247d2b3acf374ae4fe7011db58ca0a22b3f3da80
MD5 ba2fd16c0aeaa20a14160e74dd063230
SHA1 2a5f9fcc49b8e446cca0275a718119260acc9ccf
SHA512 7138efa0639d8f00f2c21a06c140d4905b9b083c84f5b0ec8c3816d4a8e031da317090341422c5422ab86335d79b433b7d3c0d2ae4c4517323272ea5d40621a7
TLSH
T18CA002358141105FF100437D60C34AC573318A1242171B0E49959169C8683B04145868
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599689.TMP

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599689.TMP
Size 48B
SHA256 b86a31841e9613ae3a965ea1948bc6195ab15e047b7c55c74f1c29325e5f4f36
MD5 b828007d95a1afdb77e4226a24dacef1
SHA1 3be8c2019e93f5ab42d4ecc619f9dbca8e4318ec
SHA512 06f2b2b1eb025e1e674e60de160f9fc8276bcf0e3f419ffad20493935f9f36132894d08033ee3dc1e4b4a5d33a7ad267c906087e948571a230ec8c84cbc445aa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7205.TMP

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Default\Network\Network Persistent State~RFe5a7205.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Default\Preferences
Size 6KB
SHA256 de92ec9d52e3e89590860b564cff295b29ea800089ad6fc393b1e9eb7880cd54
MD5 b4a1be898e1e32608a81eace5e2b2f8f
SHA1 e282cd5304f2f1e3357bc4b7ff3a885394fb22fa
SHA512 ddb850329dff2f7171bc3bab4d7a312702a285b7737b0f5a35b9a5801d7c61bb6123bce4d1b8a02e0761ded62e28c9e8cf294a2bdbda2aa52172aaaa666890ff
SSDEEP 96:st5/dM++hufGaqb9Jkxo5h16Z0Is7/x+6MhmuecJFoU2MFNjeFK+gUC628XM1C7K:stdObhcuqonIsV+FdFoP2jXq3G6K
TLSH
T1B6D1B7026E64797B4CC7E119BA79BB53E2F9647270D12E58E7F8492C04DB6CC630390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c846fea5-828a-4123-ba92-1f36dd4650ca.tmp

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Default\c846fea5-828a-4123-ba92-1f36dd4650ca.tmp
Size 6KB
SHA256 6230cce3cb4c8cef9a09a7d0e3f89ee7486d38fa2ed4a28039238cfb95e965e0
MD5 ae8c6b5e995abdc0bebbcd1d6a65ee0e
SHA1 6548b96a2b852e90971f450f7218a23f925a1d57
SHA512 97176f6c5abd0de42bada10fdd17f984ce120978ce902ebcc93ed8db9ece97d4b5c4a73aac1c6d828107db3319a34fff05c727b4cb0987a50517a8e77d7823dc
SSDEEP 96:st5/dM++huoaqb9Jkxo5h16Z0Is7/x+6MhmuecJjU+j0jeFK+gRv28XM1C7K:stdObhOuqonIsV+Fdjh4jX/G6K
TLSH
T1C3D1B742AE64797B4CC7E109BA39BB53E2F9647270D12E58E7F8492C04DB6DC630390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Local State
Size 17KB
SHA256 dbc9054570c529a6b54d1c362390aead253434d8512e1ea40462c165109ba057
MD5 856d850df7f78ae2d798bd0b81559992
SHA1 a81bb40cd28033ef1fcd8e426ab52199ee9b3839
SHA512 e01a9a40eaafd021f8158781a493e4acbef41e053f122fe92d838b080081ff4b667774426c249864457cf09f867bd8d43c83d3c774e4e0f46cd89dbca670f8a7
SSDEEP 384:4+aQikB+z/xvxjg/qhEfNlwFvwuaIVC4mFrYe9zM:3/UxvxjgC+EewA40YeFM
TLSH
T108728E36D868AE2799F3E7857A4A6B8BCBB9947254C52DE48DE81F0D47C33DD0342C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Local State
Size 15KB
SHA256 8fa8dab45385591e3f8c2d215a96a8692c6966320ce495248b65eb2ee431c0ad
MD5 602232984a09fbfcd0f71a83f1ff9a65
SHA1 52a997fb7387e3d716e0dce99be010e4445b6b79
SHA512 d664cb899fec98203f6a6a6ce66da0e1b40680f513cd4aaf0ee9d85ed9d9767195d2ec4aa3caea01322bb831fc5ebde44881662593be16d74eb9126f926abedd
SSDEEP 384:j+aQikB+z/xvxjg/qhEwNBSwFtwuDmFrYe9zM:C/UxvxjgC+40o0YeFM
TLSH
T144729E2798693E3395F2E6457E591B8BCBB9987394C26D784EAC5F0E47C73EC0342812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Local State
Size 2KB
SHA256 6bd9cbbd76b444d11a9f28fd3facbc0190c2974cf60874c11ebe2a16fe24d25d
MD5 dd072d9293a41646c8ccf25c3603612e
SHA1 3afd27e77ba247704a60fa4c35aee032c387bc66
SHA512 b4ecccc0de5c3e1005dc502147cd64435b863d9c9785a20f7206ffeaa82edbf8b02efbbd69cdd0563f3914b10a1d61530905cca7a912ab1e2bb10d6eef21dc49
TLSH
T1AF51B7337C546BB786E25B45B9873F13CE396072AA612F4096DC0B0C81D725C4342C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Local State
Size 3KB
SHA256 72ab3313d07a621ea5b0158150716c6729fbbcbd5fda29b5e6bb77b3b5c5290e
MD5 6e661f6a545e2cfbcb9e67fcb050e674
SHA1 c37b1d324477c82b8d149abbc6996dcdf6365bde
SHA512 96bd6f272473ee9467345d2aaaecc094d33f40ef2580c30fcf8e0ee7c7eedd740a8feddff3ee903f56bc562c20b0a2b79bc03c1f24add919b3401fc7a3636dc9
TLSH
T1316185376DB4AAB78EE29A45B8C63B06ABA55037E9913F94D5EC0F0D41D739C0342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Local State
Size 15KB
SHA256 0e82d3197e4d9f34f7cddfe8faeb396ec9d987ece2791fc22d8b8fd63bd203d8
MD5 ac59d1cebdd7a133da7207f2865663ca
SHA1 1868fe470fcf9310a77dde244a22b51bcb1cd91d
SHA512 c0b4ebfb679f4d4a66d9da522cfe839580997b428d91cb2d3465ad75172a253b1d594e206c9daebac0d8bae33687122b3cee65b2331ab2ce1da18b7bd4a090f8
SSDEEP 384:n+aQikB+z/xvxjg/qhEmNBSwFtwuDmFrYe9zM:2/UxvxjgC+G0o0YeFM
TLSH
T1D3729E27A8693E3395F2E6457D591B8BCBB9987294C26D784ABC5F0A07C73EC0342812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594452.TMP

Path C:\Users\Admin\AppData\Local\cc.vtrl\EBWebView\Local State~RFe594452.TMP
Size 1KB
SHA256 4e6f2ec878aadb972441290eee5b320fc5c166f61170e7af80f532df69fcb998
MD5 1b5642a57dcc1158d3463c91ee1993c2
SHA1 c9401c0288ec23f04872cbcbb526d2e92517ae24
SHA512 d33e50b2dfe37852b7873e75090dd222a174d463eeb592e3982563cf6f6f2417ac35eca1c600e4879198acd3b719f401ed77e2488fc9b58dd123f567c682eb06
TLSH
T1562165B2E8E82FF2DDC1269721837B579E31203B96100E00A1DD471D42E715DC65BC33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\cc.vtrl\settings.json
Size 76B
SHA256 d3d68c88c92a74282445e1487f2640d52774f691b31259ba4356588a1374ae19
MD5 86e6818e419177fb09cb35ac6207f11d
SHA1 0069d0d05905f121d553c73621bd44b4cdd4e3c8
SHA512 abd878c27d4952dc7d6583257e319c8e9b293d14d998741d91d98ff219051253ac24247ea47567d126913a50e5f2cad6486702f21a52a60fd6fc6fb3f44ee5ab
TLSH
T1D4A00250F80440FA45C805E8DC6CC93BCB147E69119C7C9DC157744C68DCE3B21A89E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\cc.vtrl\settings.json
Size 75B
SHA256 6b76848f733aa02fd1dee6af07b38e469e85f298fc9c5984a971bf9ccf0d84b4
MD5 af3a0e4993525f4f92f2f6c8b7739252
SHA1 19152d63eb87d1148ebe6dcc0c72a59cdd191763
SHA512 89ef92f75849a1de2832c6aaafb3a9494636a0ca75abd77f564780b5f1c734fd80d5842e43877fb5c3192a3dd5331ca05ec4791833acd4b8d48721edee0981e1
TLSH
T170A00250B81840F645D805D49CAC992BCF247E69119878ADC157744C58DCF2B21695E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-365-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-349-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-0-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-276-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-389-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-332-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-353-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-258-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-296-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-300-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-304-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-336-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-224-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/236-246-0x00007FF666090000-0x00007FF666F0C000-memory.dmp

Download

memory/1424-386-0x000001A784600000-0x000001A784601000-memory.dmp

Download

memory/1424-382-0x000001A784600000-0x000001A784601000-memory.dmp

Download

memory/1424-375-0x000001A784600000-0x000001A784601000-memory.dmp

Download

memory/1424-377-0x000001A784600000-0x000001A784601000-memory.dmp

Download

memory/1424-381-0x000001A784600000-0x000001A784601000-memory.dmp

Download

memory/1424-383-0x000001A784600000-0x000001A784601000-memory.dmp

Download

memory/1424-384-0x000001A784600000-0x000001A784601000-memory.dmp

Download

memory/1424-385-0x000001A784600000-0x000001A784601000-memory.dmp

Download

memory/6040-323-0x000001B576B40000-0x000001B576BE9000-memory.dmp

Download

memory/6040-103-0x00007FFB577D0000-0x00007FFB577D1000-memory.dmp

Download

memory/6040-287-0x000001B576B40000-0x000001B576BE9000-memory.dmp

Download

memory/6040-243-0x000001B576B40000-0x000001B576BE9000-memory.dmp

Download

memory/6060-248-0x00000207EFB70000-0x00000207EFC19000-memory.dmp

Download

memory/6060-286-0x00000207EFB70000-0x00000207EFC19000-memory.dmp

Download

memory/6060-226-0x00000207EFB70000-0x00000207EFC19000-memory.dmp

Download

memory/6060-20-0x00007FFB577D0000-0x00007FFB577D1000-memory.dmp

Download