660f1a38bb5772fd54838a3d86d17fbe9b223f31f768eb1b1519e35f5f3f1684

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Signature Nib.exe
Size 12.0MB
Sample260912-vg83ea1cmc
SHA256 660f1a38bb5772fd54838a3d86d17fbe9b223f31f768eb1b1519e35f5f3f1684
MD5 5297d2a177b3f632ff3c8e81555beb56
SHA1 4eef38cda023ffa473d9aea01303fb99f45124ff
SHA512 82243d07d5f2dd5fc09ce8ecc3f8f928c425bda48c543c3f094de43f21f559265a5c72c01e6efb169032c80a9bf38ef37dbc8630d936c99eb326d48c85600af4
SSDEEP 98304:dOFqbhKiLv3+fdywhgLTLHLtHAXkGk7dbdI4E+4:kasiU9hgLTLHLtHAQ7XWB
TLSH
T1D8C66B57ECA544E8C0BDC1348A7A92237B71BC494B2023D72B60B7246FB7BE05EB9754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Signature Nib.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1738563912\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1738563912\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_176754658\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1738563912\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6096	msedgewebview2.exe
6096	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
716	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	Signature Nib.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 716	2288	Signature Nib.exe	90
PID 716 wrote to memory of 5744	716	msedgewebview2.exe	91
PID 716 wrote to memory of 748	716	msedgewebview2.exe	92
PID 716 wrote to memory of 748	716	msedgewebview2.exe	92
PID 716 wrote to memory of 748	716	msedgewebview2.exe	92
PID 716 wrote to memory of 748	716	msedgewebview2.exe	92
PID 716 wrote to memory of 5564	716	msedgewebview2.exe	93
PID 716 wrote to memory of 4120	716	msedgewebview2.exe	94
PID 716 wrote to memory of 4120	716	msedgewebview2.exe	94
PID 716 wrote to memory of 4120	716	msedgewebview2.exe	94
PID 716 wrote to memory of 4592	716	msedgewebview2.exe	95
PID 716 wrote to memory of 4592	716	msedgewebview2.exe	95
PID 716 wrote to memory of 4592	716	msedgewebview2.exe	95
PID 716 wrote to memory of 4592	716	msedgewebview2.exe	95
PID 716 wrote to memory of 4592	716	msedgewebview2.exe	95
PID 716 wrote to memory of 4632	716	msedgewebview2.exe	99
PID 716 wrote to memory of 4632	716	msedgewebview2.exe	99
PID 716 wrote to memory of 4632	716	msedgewebview2.exe	99
PID 716 wrote to memory of 6096	716	msedgewebview2.exe	100
PID 716 wrote to memory of 2308	716	msedgewebview2.exe	101
PID 716 wrote to memory of 2308	716	msedgewebview2.exe	101
PID 716 wrote to memory of 2308	716	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\Signature Nib.exe
"C:\Users\Admin\AppData\Local\Temp\Signature Nib.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Signature Nib.exe" --webview-exe-version=3.7.4 --user-data-dir="C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2288.5084.4738757414582372729 /pfhostedapp:39a0fd71392fef204a74932a89364ec100b8e261
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView" /prefetch:4 /pfhostedapp:39a0fd71392fef204a74932a89364ec100b8e261 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa34ff5fd8,0x7ffa34ff5fe4,0x7ffa34ff5ff0
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView" --webview-exe-name="Signature Nib.exe" --webview-exe-version=3.7.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1700 --field-trial-handle=1364,i,18398291383710687830,18445299642990054138,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:39a0fd71392fef204a74932a89364ec100b8e261
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView" --webview-exe-name="Signature Nib.exe" --webview-exe-version=3.7.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2060 --field-trial-handle=1364,i,18398291383710687830,18445299642990054138,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:39a0fd71392fef204a74932a89364ec100b8e261
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView" --webview-exe-name="Signature Nib.exe" --webview-exe-version=3.7.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2336 --field-trial-handle=1364,i,18398291383710687830,18445299642990054138,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:39a0fd71392fef204a74932a89364ec100b8e261
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView" --webview-exe-name="Signature Nib.exe" --webview-exe-version=3.7.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1364,i,18398291383710687830,18445299642990054138,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:39a0fd71392fef204a74932a89364ec100b8e261 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView" --webview-exe-name="Signature Nib.exe" --webview-exe-version=3.7.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4508 --field-trial-handle=1364,i,18398291383710687830,18445299642990054138,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:39a0fd71392fef204a74932a89364ec100b8e261
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView" --webview-exe-name="Signature Nib.exe" --webview-exe-version=3.7.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4512 --field-trial-handle=1364,i,18398291383710687830,18445299642990054138,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:39a0fd71392fef204a74932a89364ec100b8e261
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6096
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView" --webview-exe-name="Signature Nib.exe" --webview-exe-version=3.7.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4628 --field-trial-handle=1364,i,18398291383710687830,18445299642990054138,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:39a0fd71392fef204a74932a89364ec100b8e261
    3⤵
    PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2bc1765b8160c76c2415a650980f5883e336d37549e23d75da551a7e03b935fa
MD5 ec7d568bf0b92e08f354ee9bfa07c8e4
SHA1 6789141afd4eee4d3450f349ff24f42e79ae9041
SHA512 8410a6c1952d5b14b19742239e11005e52b0f19ecf9a8b6af18059618f5ff167852e41e74f057e2680cabbaa25f6779db354d13b4c9bd9c454e6910f186e4632
TLSH
T190D01123B20202B8C02820330003BA8C0802C30B808A8008A828AA2E2B880A02E2B882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1e4e8bbf520ebb52b6190ae4595cf6d70fdb1ee6e56aeda0b00ae0a1407bd595
MD5 09b40c3a8b4d932506cbde622cf62d3a
SHA1 212be095c6b154f9f4f50db4cb51f984275ef13c
SHA512 405262b71f92bc46e66e3c140e8e64dacaf1080e552897fe5039ce2d73b514eb642df71e4e860ef0a24af0cb924495a7c4e77adf63a52cb1b0a6d3bd2f7d5c4c
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

3b26ece0-9cc3-4f86-a33b-0095544e06a7.tmp

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Default\3b26ece0-9cc3-4f86-a33b-0095544e06a7.tmp
Size 6KB
SHA256 7a68ea69de17e8cdd7b415c3f19a388c1c369f0cd3b440b60433eda0c86c8448
MD5 b9df041b3af8bdd66a6c828aa3346208
SHA1 70a62f579cd3ccf15f4beff05940eb681b30e52f
SHA512 b7d000d17e42f8c072b78a448db65807445b82583a51eca0eb33b603ab660b9d2ffcde5d6d208fe1d1204e057824ecf68cb983583a14e7ccb25e10977579b912
SSDEEP 96:stT/dfYtQb9nkOo5h16Z5Cs7/x+6MhmuecSHF1ejeyK+g+28XM1C7K:stLZBNoKCsV+F2HFQjywG6K
TLSH
T1D3D196415F6869BB4CC6E249BA29BA03E2F95072B1D51E58EBFC462C04DB6DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e23a410387b4f5aa5ec5943441c68e10105ecec9707f42ff12eddb7814616e3f
MD5 80d158c76b0891920c57a7967488a10b
SHA1 bbfdcde3dd73aa6879eef0894f64197198153514
SHA512 48c3526677c12e55c468624daf451d9fe204c204dc2d388cc64594901aaae333e8bea13e3e66503925ef961fd214aacd4c8c451e25aeae87f714bd31a5a06900
TLSH
T13AB0112020E30C22C2200330A2C38B0232328C0883A3080880A8F8308B2A3888A02000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59aca1.TMP

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59aca1.TMP
Size 48B
SHA256 c1e727bd987df5d85d1d07245082b4c66eea12666a752a0ebe1201091dc68c15
MD5 bb3177d40404a644c4846c5f8a6ab1c6
SHA1 d8cceee9c047fde493d406c3b6de2ce4070adf86
SHA512 fc829a1581d92e9505ef90167cf69006435b75a0c1f6dce6aa81271b1c7de66d090a2cca23062a6c58cc6f851a19a7521e8e4c62033a753fabb943fe91528c00
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a82be.TMP

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Default\Network\Network Persistent State~RFe5a82be.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 6929c33e3113e14a8288f82e66b84d6e9cc25d83f015ac584e59a65541e3a097
MD5 38f13baafc5f196060d0be556512c16c
SHA1 52e9726f22415ac0ed26b727f4202c0b3a0e5686
SHA512 0b5a71ecd9b4cefe292432b2e513b0d485e67334f8ed5f1d8c4af2807c90987ab1afd4af4c871094aba4483695197b4b5b7796e27199849cb6589405fe914932
SSDEEP 96:stT/dfYEGQb9nkOo5h16Z5Cs7/x+6MhmuecSHF1ejeyK+gY28XM1C7K:stLZHNoKCsV+F2HFQjySG6K
TLSH
T158D1A7415F64697B4CC6E259BA25BF13E2F95072B1D41E58EBFC462C04DB6DC6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Local State
Size 2KB
SHA256 071d17bcf6e10c14e7f44df64f19de456b774a05d76b673797c0538be4b87936
MD5 4d336fb2aa9ad9e294f777f622895f6a
SHA1 5438065b88da38128449381b8b616166dd251800
SHA512 026e18982ad28864f24db062802c589221eaa0397ce2a12daaad83fe6e952757ef64b927e40501fbe38912957cf6c274ded8017c8fffb2cc7f86713feeca7bee
TLSH
T1CC5184B36D546A7A96E397847A867F239B3951A6FA522F50E9DC0B0C01C754C3307C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Local State
Size 15KB
SHA256 178829fdb44e5aec6bb8891c44a58eecee1981c59a6d77ebd024add4e7978cd0
MD5 987ef6dd4a2904b349984bbd55291cc7
SHA1 810df0e6f6348b5d4d26c5eae43c29a18f7027ee
SHA512 141283d343460dd338217b91f0a6d4db59a81d2db313a30cde02e61f2d75f92121a15637360fef55be3c8595dfa1e83f85c26ba545f9c1b37f4ad3683528e2c2
SSDEEP 384:m+aQikB+z/xvxjg/qhEwNBSECSLBMwUxNI09zS:x/UxvxjgC+83qnx9FS
TLSH
T114728E2B59A86D2296F3F6407A49074BCFB998B2E4C26EB44EBC5F0D16C72941343D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Local State
Size 3KB
SHA256 39a545fa244b62e5ea46ef7c3ada7da1c2c5ffea2e569820a192b86b9ec73ced
MD5 9ff3ea51b6368a071bf8e7acf7743d3e
SHA1 2f1d385cb26dc0b2fa3cd6240e89af5063f9fe12
SHA512 4804d87229c5db46a9828d26922cab5fa89c51a4cdf37803d80b217392cb5a1eaf344446ca267194677b9f886c4ec7c065b87141a972da6e89e8847316d2738b
TLSH
T1F27194BB9DA4A97B4AE3DB4479862B17A7A55177F9813FA4D9EC0E0C01C728C2343C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595b74.TMP

Path C:\Users\Admin\AppData\Roaming\Signature Nib.exe\EBWebView\Local State~RFe595b74.TMP
Size 1KB
SHA256 21f2916b68c8e067b78a3c28eaedded151a0db858cab8c9b15dbaa91adfee8a5
MD5 d31fcaf73f399c997d6d9c61f611ba94
SHA1 fbe3ecbcbb2d20fd41b1966a21384e39f26731aa
SHA512 3ae00bb4f8766ebc6a6497258857ca0aa1862e7bb48cdf127a791bc7caeff2369bae3d5786ec276221a6f92d0c65d25e8b976c4f5e29e8d98417ec6fc6365d45
TLSH
T1B93174B3DDE42A397A92A3822242BA575F2151FBE2424F44F4DC890D02D704CB52FC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-26-0x00007FFA537B0000-0x00007FFA537B1000-memory.dmp

Download

memory/4592-102-0x00007FFA537B0000-0x00007FFA537B1000-memory.dmp

Download

memory/4632-224-0x00007FFA53F00000-0x00007FFA53F01000-memory.dmp

Download

memory/4632-225-0x00007FFA52350000-0x00007FFA52351000-memory.dmp

Download

memory/6096-291-0x000002829D3A0000-0x000002829D3A1000-memory.dmp

Download

memory/6096-289-0x000002829D3A0000-0x000002829D3A1000-memory.dmp

Download

memory/6096-288-0x000002829D3A0000-0x000002829D3A1000-memory.dmp

Download

memory/6096-287-0x000002829D3A0000-0x000002829D3A1000-memory.dmp

Download

memory/6096-286-0x000002829D3A0000-0x000002829D3A1000-memory.dmp

Download

memory/6096-282-0x000002829D3A0000-0x000002829D3A1000-memory.dmp

Download

memory/6096-280-0x000002829D3A0000-0x000002829D3A1000-memory.dmp

Download

memory/6096-290-0x000002829D3A0000-0x000002829D3A1000-memory.dmp

Download