5d756c3d6ef2776b574a69c5096b065531be128b78f579017e08ca7c60e7d181

Analysis

user interaction
yes
max time kernel
14s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
weblauncher.exe
Size 13.3MB
Sample260930-srpemsbd37
SHA256 5d756c3d6ef2776b574a69c5096b065531be128b78f579017e08ca7c60e7d181
MD5 7d99b702bcd90ba66a84ad53f636550c
SHA1 a61fbd6769615902b83ea2ecb94b0296de9681b4
SHA512 7cf5910ccdeeea03ddaec1e3916f5fd78436a84af18dc5f7244801c9047e61ac34fd291338594a654b9e67a2c8035435e43af606176390d51814c33d708c4253
SSDEEP 98304:UiqMy8ptSnCzJuT40LcMj4Kkz8qqoTqupR+Ui8t+PT+I5GYHasdKl6ED2+BaVjbC:UNMDJcLcMsX+tdKqefFRL
TLSH
T108E6F6217B5E99ACD19BC47483874A72497130CB0B35B9FF449496382FAABF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	weblauncher.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	weblauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	weblauncher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3112	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2576	mspaint.exe
2576	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3408	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3112	PaintStudio.View.exe
Token: SeDebugPrivilege	3112	PaintStudio.View.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2752	weblauncher.exe
2752	weblauncher.exe
2752	weblauncher.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2752	weblauncher.exe
2752	weblauncher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	mspaint.exe
3112	PaintStudio.View.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3408	2752	weblauncher.exe	85
PID 3408 wrote to memory of 5116	3408	msedgewebview2.exe	86
PID 3408 wrote to memory of 1768	3408	msedgewebview2.exe	90
PID 3408 wrote to memory of 1768	3408	msedgewebview2.exe	90
PID 3408 wrote to memory of 1768	3408	msedgewebview2.exe	90
PID 3408 wrote to memory of 2680	3408	msedgewebview2.exe	91
PID 3408 wrote to memory of 3208	3408	msedgewebview2.exe	92
PID 3408 wrote to memory of 3208	3408	msedgewebview2.exe	92
PID 3408 wrote to memory of 3928	3408	msedgewebview2.exe	93
PID 3408 wrote to memory of 3928	3408	msedgewebview2.exe	93
PID 3408 wrote to memory of 3928	3408	msedgewebview2.exe	93

C:\Users\Admin\AppData\Local\Temp\weblauncher.exe
"C:\Users\Admin\AppData\Local\Temp\weblauncher.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2752.4320.16099846257863261187
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x104,0x7ffa4262b078,0x7ffa4262b084,0x7ffa4262b090
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,17469840770597865320,11556345768848810452,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,17469840770597865320,11556345768848810452,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2360,i,17469840770597865320,11556345768848810452,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView" --webview-exe-name=weblauncher.exe --webview-exe-version=2.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3604,i,17469840770597865320,11556345768848810452,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:3928

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ConfirmFind.png" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3988

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Projects.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
Size 238B
SHA256 c61905237a87f3f069ed771e5c184966775168d06a148df1adcf3e84e33614f8
MD5 78f9bc07225e008ea34470d3b9345641
SHA1 74fb58f2ef1e52db308b2c95ee575f21cceec80a
SHA512 6ab668f462f3d5a989e495fb54d0f330dec2afd3b8c548daa77179b63957e0efd170341547a1012164cc3b9bf4692309e49012eb72d6a07823752383cea352a7
TLSH
T1E2D0232FD1C44E3E9180030E4A5C4841F4E417B9B2500C0CDC4AFCAC9753088003AD31
MD5 SHA1 SHA512 TLSH

Submit Download

cloudCommunitySettings.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json
Size 2KB
SHA256 52bfb22aa2d7b0ce083d312fb8fa8dcda3063207186f99fc259aebd9064cbedc
MD5 f4e4a03ebd0ab3a953c56a300d61d223
SHA1 97a9acf22c3bdd6989d7c120c21077c4d5a9a80e
SHA512 12aa71eea45720a4d7d057da0b662635671e4cd165ad2e0d30a3d2a43950b47dd60c26c1bbbe049418f815850e571b8d93e4c8b8cbbd686abc3cf7926ba719c2
TLSH
T12F519CEB0003BD5826FF95057133F52FF48FE096548856DB98C1E8BFE6A9064B29A028
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a39fdb406f0b49ae5e472376e38464be8a26f47b22c6b081829f7fff60170205
MD5 8b1870ac65254094c1dbb0d1ce849342
SHA1 f1b66bad708eb5bb8596b29b4b616f6d491b11da
SHA512 3bfcd2892314b7f1134812739b0631ce341f6b2813e0947b5cd5e0491a65abd79fc34688f5d2dc3086fc151b17bb00f328ef871712bdceb37eb4e4996c446d5e
TLSH
T1A1D0041551041045D0151471003143400540D440015143044C54401F155111540510CC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0dc1413e29726b560bce922ce62bc50c82b8709c07c61d829b42b986e7bcc5d4
MD5 9455c3b9223dde1b1ad75080f93f096d
SHA1 f18118f8ba84479ac95230768a61bc71e3119769
SHA512 62cc04f9abeb41419b15c5b16c652802faf5bcc0c057275fcfdfc87165ab289716f2bd3977e39b7475b67267d5e1eeeb0f938bdc64ecce48c19b59cc810f1ddc
TLSH
T173D0121732010178C0202473001363480840D10B414581049C2CC52F2B1406409124C5
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0f7781fc883a46e69fba739ffeb396f307bfdac27a93db2ed0558e27adeae296
MD5 36b881a08665ab30659232fcc147f51b
SHA1 3f7fffef7bc5033e5fbc957ebb4f24ecab59b5b8
SHA512 449b07c0b9db9086c8a7d68f97529cd57c812b7759dc6064a593d12714e07b89ea6b180aeb9636c30884e61b8d4411b69232fb0357151622f41d796b2097750b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 eaa1eb129d382edb056c34189a995a555e959295be8c6defaed5a225ad5137ca
MD5 fed8b23cfe998b8ebce28a3157a6bd9a
SHA1 033e8f4e6248c8bcd51db8069c6dbbdb6233c8c4
SHA512 96977a6ba27bf4287eccee8eb7ee92eef4ed489807f4df8f6c0a2adccaef54d339cc61c668166edeb543cf9ee477d6ba8d82df3d8524206d0e63d99683ff520b
TLSH
T1C5A00219C241104ED560637C1186C578372268141197475171914879BDB4F926E1A014
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 1KB
SHA256 0d7357b43bf643d04341216362cb5e14a50ba830ce575b67b06a858db862afdb
MD5 1011fb087b8bc25df8ac8d43641192e4
SHA1 a8cc7651787c75e63a1ba08aee6967762182e060
SHA512 26c0e4993b7a5f9a6e437356ca6a24fff64c6d3a454dc6b924149ac202c5f3bfe1a444cc058714052dfd4c7ae52df11da7d1ce7879cd102515dec6ad1ac7072e
TLSH
T1A431A9B3F8D43F7A9DD2E58AF041AF5F1E35117A51614E58A0ED8B1C01E668C9135C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 2KB
SHA256 f7ed21b1243a2784be3ec8d6a0dc3435a502e267abc07a9a29f08c687e348d66
MD5 a8b82204dd766fd365d895755214eb4b
SHA1 f5019a92f294e9b266cd23227dbcbbc7d6f82b56
SHA512 f751fd198e3362ecb9d2d46b1d6e0df165912b010693e6e698f4c34369d5482e4dbbcd5d7cf37eff313f1a3abb55bc022e2ea082d0f54eac2c858b6b05881a3b
TLSH
T1AB51D873BC446A7BC9E3D948F8493F1B9A39516596912FA499ED4F1C00DB25C2312C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 3KB
SHA256 131af482978133dff9ea2c455bc31acb663d3bdfe4be7d683413ada18d486442
MD5 7fbe08eabd7b71342f0a0423881ba329
SHA1 5df875822170ff05fd12473d229cb7f7baa27bb1
SHA512 4032a579c3639e7a0d1248a296be8af36bcae0f8557c4410bf9fabe8da38f9d6a30e760d3c04571073359971947b66033e909253b3e70f9e66cf8ccb1b0ef280
TLSH
T14F719672B8A4A97B8DE3D944F8852B1B76A55137E5D13FA8C9EC0F0C01DB3981311C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State
Size 4KB
SHA256 ddb4509c972073579ca37950bc006bbee9733e912afb59ce7a85f12cc63156cb
MD5 0be10881f39baa74c0ac382777ad95f8
SHA1 baf67ef8f434daa0fd078847df9b3c324a2b3063
SHA512 57643379cee7ca829e58cc56b12de4cfcce50bd7550b1872473da88b5f7c395192b193d37999db421def38a5800afd63e402c221e6fa2bf7fed26d79f2f7a5ba
SSDEEP 96:zuNlP3NkCETp4fb7ala78Frh/cInURoDotoN5VFDgBiVpb6g/ZUvZmTHlqa:zYlP3Nb2pe7x0ooDUaPEup4uv
TLSH
T17891B62268A4A97B8CF3D549B8453B0BA6A55027A0D43FA8C9FC4F1C019B38D2312C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585cc1.TMP

Path C:\Users\Admin\AppData\Local\com.casualdev.weblauncher\EBWebView\Local State~RFe585cc1.TMP
Size 1KB
SHA256 3f5d2cd4c1762140a8dd17cc56c492f940fe080b4787bbd49b6e755ec771f5e1
MD5 53327b6ebd0659e748a383dfefbaa847
SHA1 ee067f37e79fdd4a39fd0927092af6e08cbfcf0a
SHA512 f193b60894ce828243256ec4f73106975125a31d51e051bca19a6adfe4954ea58ec74dcd30d9508b623727c1da1d136f6112487efa9167bd385210d8584bcf24
TLSH
T17821B7B3E8C47EBAADD1D48AF041FB8F1E60513A51604E1CE0DD8718019B59CD235C3B
MD5 SHA1 SHA512 TLSH

Submit Download

configuration.json

Path C:\Users\Admin\AppData\Roaming\weblauncher\core\configuration.json
Size 1KB
SHA256 d9e00fd5bb4e82438dd99bba80b1ccb73d8a93110f60df73e706f0101a390499
MD5 7ef831e4d0c9491ebf57b8fd76b07c73
SHA1 89af2cee0b3217ef6939386572dce04e10ee8481
SHA512 0b030ac1830557f14d49957697bed72cf5bdb3c97edf1c821f4a651b9a874b0ab4f6b11cfc93c64d30caa7a12e103a5e0b48e9863a0ae2873fdb56dc0d720fc8
TLSH
T1EC31F525CE256CF74094A03DED6E9153A75445530E4E3C18F389A59C2F0E63F61FAAC8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1768-25-0x00007FFA5EA90000-0x00007FFA5EA91000-memory.dmp

Download

memory/3208-58-0x00007FFA5D8B0000-0x00007FFA5D8B1000-memory.dmp

Download

memory/3208-68-0x000001D5C45A0000-0x000001D5C45A1000-memory.dmp

Download

memory/3208-330-0x000001D5C4570000-0x000001D5C459B000-memory.dmp

Download

memory/3928-127-0x00007FFA5EA90000-0x00007FFA5EA91000-memory.dmp

Download

memory/3988-340-0x000001B2CC770000-0x000001B2CC780000-memory.dmp

Download

memory/3988-349-0x000001B2DD430000-0x000001B2DD431000-memory.dmp

Download

memory/3988-351-0x000001B2DD430000-0x000001B2DD431000-memory.dmp

Download

memory/3988-352-0x000001B2DD4C0000-0x000001B2DD4C1000-memory.dmp

Download

memory/3988-353-0x000001B2DD4C0000-0x000001B2DD4C1000-memory.dmp

Download

memory/3988-354-0x000001B2DD4D0000-0x000001B2DD4D1000-memory.dmp

Download

memory/3988-355-0x000001B2DD4D0000-0x000001B2DD4D1000-memory.dmp

Download

memory/3988-347-0x000001B2DD3B0000-0x000001B2DD3B1000-memory.dmp

Download

memory/3988-336-0x000001B2CC730000-0x000001B2CC740000-memory.dmp

Download