bafa8d2f9a38c30e6e5414ef02e88d7f52bb9def429fe400236d818198c268c9

Analysis

max time kernel
100s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kenveil-desktop.exe
Size 13.8MB
Sample261002-pg3bzavzfx
SHA256 bafa8d2f9a38c30e6e5414ef02e88d7f52bb9def429fe400236d818198c268c9
MD5 3a12973acb117c7ef7d3a6524121ad75
SHA1 f6a6215ec54a87bdd7aea8c2d58969a243e85344
SHA512 80a572bf5d0ab09893b01ab83bc6a164a78dc1cbec0ce311693fc7b3f840087274fa268b9c9692978b7326584f046771be34170e6fd17329b83a84b72c7f7a93
SSDEEP 196608:QnFDGCwV9NGwQjZNw6pFhsUigNf2tlpweImmPx0LZapxpgIJsT584YnUFZdK:QnFyJXuZNwajsUigNpe1mPxDgzT58Ph
TLSH
T1D5E6C043F29552E8C05EC278935EBA33E632BCAD093472EB5BD44B212E66F506F1D709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kenveil-desktop.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_338276176\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_338276176\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_338276176\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_338276176\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_338276176\keys.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4248	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4344	kenveil-desktop.exe
4344	kenveil-desktop.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4344	kenveil-desktop.exe
4344	kenveil-desktop.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4248	4344	kenveil-desktop.exe	89
PID 4248 wrote to memory of 6088	4248	msedgewebview2.exe	90
PID 4248 wrote to memory of 2732	4248	msedgewebview2.exe	91
PID 4248 wrote to memory of 2732	4248	msedgewebview2.exe	91
PID 4248 wrote to memory of 2732	4248	msedgewebview2.exe	91
PID 4248 wrote to memory of 2732	4248	msedgewebview2.exe	91
PID 4248 wrote to memory of 5980	4248	msedgewebview2.exe	92
PID 4248 wrote to memory of 5056	4248	msedgewebview2.exe	93
PID 4248 wrote to memory of 5056	4248	msedgewebview2.exe	93
PID 4248 wrote to memory of 5056	4248	msedgewebview2.exe	93
PID 4248 wrote to memory of 5544	4248	msedgewebview2.exe	94
PID 4248 wrote to memory of 5544	4248	msedgewebview2.exe	94
PID 4248 wrote to memory of 5544	4248	msedgewebview2.exe	94
PID 4248 wrote to memory of 5544	4248	msedgewebview2.exe	94
PID 4248 wrote to memory of 5544	4248	msedgewebview2.exe	94
PID 4248 wrote to memory of 52	4248	msedgewebview2.exe	98
PID 4248 wrote to memory of 52	4248	msedgewebview2.exe	98
PID 4248 wrote to memory of 52	4248	msedgewebview2.exe	98
PID 4248 wrote to memory of 5488	4248	msedgewebview2.exe	99
PID 4248 wrote to memory of 5488	4248	msedgewebview2.exe	99
PID 4248 wrote to memory of 5488	4248	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\kenveil-desktop.exe
"C:\Users\Admin\AppData\Local\Temp\kenveil-desktop.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=kenveil-desktop.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4344.2736.14374137321424708519 /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView /prefetch:4 /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe79d75fd8,0x7ffe79d75fe4,0x7ffe79d75ff0
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView" --webview-exe-name=kenveil-desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,6630689275071067585,13502780341234137071,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView" --webview-exe-name=kenveil-desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2100 --field-trial-handle=1780,i,6630689275071067585,13502780341234137071,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView" --webview-exe-name=kenveil-desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1780,i,6630689275071067585,13502780341234137071,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView" --webview-exe-name=kenveil-desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3488 --field-trial-handle=1780,i,6630689275071067585,13502780341234137071,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27 /prefetch:1
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView" --webview-exe-name=kenveil-desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4416 --field-trial-handle=1780,i,6630689275071067585,13502780341234137071,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27
    3⤵
    PID:52
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView" --webview-exe-name=kenveil-desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=1780,i,6630689275071067585,13502780341234137071,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView" --webview-exe-name=kenveil-desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=816 --field-trial-handle=1780,i,6630689275071067585,13502780341234137071,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView" --webview-exe-name=kenveil-desktop.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4648 --field-trial-handle=1780,i,6630689275071067585,13502780341234137071,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f4a337d338e51deb1de75ae1c1113f46de398b27
    3⤵
    PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0313f620b4493e623f4ca3aacac407590afe01ced6e5e394c34cbd4202e2b92f
MD5 12d7d85a2cd8f41897fb756e8c432a79
SHA1 b8b2afe71e6d3158a8177d2588def38899bffb65
SHA512 37b55e4a1258fa7b6eed2bc36605de6452a7e53b8c42115522873d23524f71a119290e18d0d4c6de7a9b7715f7121d4c67da2bd56f228b2e59aeb88ede4d3daa
TLSH
T15CD0122232130538C011357B0142658C0400C10B518580806438C51D5A540A00907451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dd34cadeb9fe48a35b447d0872b457df9ced05c09bcee136fcc5ea22cbd9cd6f
MD5 bc4f67e314e8973cbddeb940549411e3
SHA1 44fad5a5be1ba5eda5816943da486343c1d34216
SHA512 fe072d58e6a03ab66245566ba07163f72ec061dc5cd20045bbf9ef7022477637139e2ab52df567ced14269d336545ae5ee74707ff72b3e2f0faddcc289e8ba3f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

3f29e926-0030-42a9-9f0e-3bce3078e1ed.tmp

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Default\3f29e926-0030-42a9-9f0e-3bce3078e1ed.tmp
Size 6KB
SHA256 5c6b3657a8f4f60f4c694df58fe6768b6bf0b8249a3d7a4016e3841a0e8b0cf5
MD5 1072187ad8a7b77f0c0409fb3ca2bbd2
SHA1 5112f69cf8a68f8b4c33dc5ca6476be9c805d647
SHA512 ec1a9daacb751e92ec41d280d8df52ae02d068a4a1bf011456674ca9018af1177183e7ae0800d185be926059ae1490ee300532065cd47556be3489ecf7dc92f5
SSDEEP 96:sta/dKuXGJKb9kk5o5h16Z08s7/x+6MhmuecJ9VZSg9jeh5K+g8ld428XM1C7K:stCoXeon8sV+Fd9VIqj2k6wG6K
TLSH
T180D1B7025E24787B8CCAF509BA797A13E2F9703260D51D58E7F9452C04EB6DC731790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 a03f66fba0bd3590c5cd023dfa40481dca168320f12b093cb3532213e3a591cf
MD5 54792467a12ae8322f54ad8b0662b735
SHA1 f5de55c66e4db7dee928655b4aac80f1a81bcac2
SHA512 b5fd32cbf3d804d0865d0a35d400a009d1f191719f1d6ac7c27ac02914ba8c921e5c69533b3ffb194311b87f7823a0856901985e031b8a4af8a20cfec39fe0d5
TLSH
T157A002305544698FD14D03FD2DE141D17331882026235A55D1A55065FC713968105562
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6e4be6385c4a58307a6a839a49b7ff53dd807d0ff790f48958bcaa3a8862809e
MD5 7507c9a92d094f43c506d4bc8b1a253b
SHA1 cc63ed5019a171597143c1d77162296eb8d3fdd8
SHA512 d2a5527203ced2e9341c9db9198280047171a8629915a305b84ab4e515c0a6fbde2b5f5a81fbddbbb49a85c383054856d3d14abf1f15b5ca8253d01ba1157fd6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2cfadfb8-ae8a-4770-abf7-c5356c8663a6.tmp

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Default\Network\2cfadfb8-ae8a-4770-abf7-c5356c8663a6.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

baf0a3ce-7d66-43ec-8bde-094f54ed79b0.tmp

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Default\baf0a3ce-7d66-43ec-8bde-094f54ed79b0.tmp
Size 6KB
SHA256 90a15f6543b3c5df08657b337896632346ffd5d6ebeb5ffda3e56845ea90a7fd
MD5 5ae95748cab4344579b0f80cab360db2
SHA1 184a15bd7b02ef3e7654d256d61e8c56661dae03
SHA512 4e353f149c08b6d00e9232ee125b0100d46adbb886c787ec4cd2570db1e9bb8933dd573c0144221ee972b2570fd467797feb2b5ed90857f6f4d0c8bb5a80f113
SSDEEP 96:sta/dKuwJKb9kk5o5h16Z08s7/x+6MhmuecJOt6fjeh5K+g8+N28XM1C7K:stCoFeon8sV+FdOtKj2k6qG6K
TLSH
T193D1A6026E2479BB4CCAF509BA697A13E2F5613270D51D58E7F9452C04EAACC731790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\Local State
Size 1KB
SHA256 b8ba45a761c247fa73f924961e815c0aefeb9cbd9e138d142356cb86b2b33a91
MD5 bb050ce4ecffff8b09e39ddcc3ee6bb1
SHA1 9ba7108e062d23ea5362c240566705e31f2e8a72
SHA512 3c1f5de9f11519ed45a387375998edbda14aeb0552c9407721c1395cafb2ea238c3c4d0cfa568d1e6b2be800dcd9ceaf072da4823bb02275ce2b2ba33841b591
TLSH
T15E2184B3DAA02F73ED91620B36527E435E7182A782610F0057DE4F1806E654DE71DD77
MD5 SHA1 SHA512 TLSH

Submit Download

c909fdae-cbfb-42f9-a6f3-cb9c7d55e110.tmp

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\c909fdae-cbfb-42f9-a6f3-cb9c7d55e110.tmp
Size 2KB
SHA256 68c780fe3298b719123088f6460759c73d877f33e4e36eb54d6c96169226bc5d
MD5 89ac86e5731080aa5bea6c5fdf4a0da0
SHA1 23c70ec5a17f561204e3b1c550240346287e743b
SHA512 13e2128467377c31326dd1e2f1f9866c34d4c7d8200c0c8ba4139a4d0524e1935440ab0a7affb747941706592a442064b1523cf6246a645010f2daa3aa8775de
TLSH
T1BF51B733A9507F77CAE296057E463F13CE7582A2A6622F109BDE0F0801D794C2305CBB
MD5 SHA1 SHA512 TLSH

Submit Download

d9279fb3-e3b5-424f-8f74-40248dd128b3.tmp

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\d9279fb3-e3b5-424f-8f74-40248dd128b3.tmp
Size 3KB
SHA256 3c709969fd95cdd67dd358f8c101b6d5a788acc1a5570689ceeddcdb80d6265d
MD5 6cc712b1293ebe5f588345dc6d7905a3
SHA1 214a870714dd9f3420a9b94614e314d7ede5728a
SHA512 9e5d95422885f744da41c595e153cc53302286dda8c1e0d9b5fa829cc96b3afc28cf61d19e540bb281e2d3292a5d52a19a68ddf5bbb31471c726f3695fdd3cc8
TLSH
T141617437A9A4AA6B8EF29A05BD863F03A7A58127E5913F54C7ED0F0C01D768C2341C57
MD5 SHA1 SHA512 TLSH

Submit Download

ec0e9824-bf61-40ea-bdf3-550fe895c47f.tmp

Path C:\Users\Admin\AppData\Local\app.kenveil.desktop\EBWebView\ec0e9824-bf61-40ea-bdf3-550fe895c47f.tmp
Size 15KB
SHA256 192665ed4c6edb90e402d2072ca4693c779c4d1024247c73ac4c680d82e19f28
MD5 022e65528277bc90d050bb374b985445
SHA1 db8ac5666189beb1e3011da9167d68343b681635
SHA512 2408d2b9fb339807f98311ed2baafc7467fe5c58ae0186846441a5731d2198873860accb3427eb0a7f2ce7e3c73f794df63f64f69cdc6d0f819c01be4726f8ff
SSDEEP 384:6+aQikB+z/xvxjg/qhE3NBSv3pPfBh9zA:F/UxvxjgC+otfTFA
TLSH
T13E72AE2755683E2395F7E6057E991B8BCEB594B390C22EB44BEE9F0D06C32981342D47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_285396617\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_301320675\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_338276176\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/52-249-0x00007FFE9C800000-0x00007FFE9C801000-memory.dmp

Download

memory/52-248-0x00007FFE9C7C0000-0x00007FFE9C7C1000-memory.dmp

Download

memory/2732-27-0x00007FFE9BE20000-0x00007FFE9BE21000-memory.dmp

Download

memory/2732-194-0x000001612F1A0000-0x000001612F1CF000-memory.dmp

Download

memory/5544-112-0x00007FFE9BE20000-0x00007FFE9BE21000-memory.dmp

Download

memory/5928-311-0x000001EBB4810000-0x000001EBB4811000-memory.dmp

Download

memory/5928-312-0x000001EBB4810000-0x000001EBB4811000-memory.dmp

Download

memory/5928-309-0x000001EBB4810000-0x000001EBB4811000-memory.dmp

Download

memory/5928-307-0x000001EBB4810000-0x000001EBB4811000-memory.dmp

Download

memory/5928-310-0x000001EBB4810000-0x000001EBB4811000-memory.dmp

Download

memory/5928-308-0x000001EBB4810000-0x000001EBB4811000-memory.dmp

Download

memory/5928-303-0x000001EBB4810000-0x000001EBB4811000-memory.dmp

Download

memory/5928-301-0x000001EBB4810000-0x000001EBB4811000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads