be0762741f9bb051231959218ca551a0af4e7d13009c3ee0901ab7cbc258ea4c

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XDLandsLauncher.exe
Size 2.6MB
Sample261017-ph7cbaez5n
SHA256 be0762741f9bb051231959218ca551a0af4e7d13009c3ee0901ab7cbc258ea4c
MD5 d60b4b7e40e26b9a163a0aa3cc27f386
SHA1 c657056e18c501eac49e87168d9074d4a2800395
SHA512 10018bcf70e5e0d502da0df19bb1e99ce53518534aa2d2e3a47306e7b9aa188b3632411fb060dc6a7d78d9c94bbba522588eae3f21f7e3d44e7af3b3a8aa8a4d
SSDEEP 24576:8agSq5Q1EPMtaqCcuzXW3EKOtVOpyaBD2N7J4dCXzRKX4EcJAD1RnQqKI17ejNDc:8Cq5cfYqCA6qdYNrJON3huVY1
TLSH
T1B7C58D1123FC411AF5F3AB78997552609BB6BC96BB38C78E0694616D0E76BD08DB0333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5744	XDLandsLauncher.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XDLandsLauncher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_356636515\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_356636515\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_1050961792\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_1050961792\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_356636515\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_1050961792\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_1050961792\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_821878799\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_821878799\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_1050961792\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\manifest.fingerprint	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	XDLandsLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	XDLandsLauncher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\xdlands	XDLandsLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\xdlands\ = "URL:XD Lands"	XDLandsLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\xdlands\URL Protocol	XDLandsLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\xdlands\shell\open\command	XDLandsLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\xdlands\shell	XDLandsLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\xdlands\shell\open	XDLandsLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\xdlands\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\XDLandsLauncher.exe\" \"%1\""	XDLandsLauncher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3908	msedgewebview2.exe
3908	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4928	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5744	XDLandsLauncher.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 4928	5744	XDLandsLauncher.exe	88
PID 4928 wrote to memory of 3636	4928	msedgewebview2.exe	89
PID 4928 wrote to memory of 5868	4928	msedgewebview2.exe	90
PID 4928 wrote to memory of 5868	4928	msedgewebview2.exe	90
PID 4928 wrote to memory of 5868	4928	msedgewebview2.exe	90
PID 4928 wrote to memory of 5868	4928	msedgewebview2.exe	90
PID 4928 wrote to memory of 4568	4928	msedgewebview2.exe	91
PID 4928 wrote to memory of 1368	4928	msedgewebview2.exe	92
PID 4928 wrote to memory of 1368	4928	msedgewebview2.exe	92
PID 4928 wrote to memory of 1368	4928	msedgewebview2.exe	92
PID 4928 wrote to memory of 3488	4928	msedgewebview2.exe	93
PID 4928 wrote to memory of 3488	4928	msedgewebview2.exe	93
PID 4928 wrote to memory of 3488	4928	msedgewebview2.exe	93
PID 4928 wrote to memory of 3488	4928	msedgewebview2.exe	93
PID 4928 wrote to memory of 3488	4928	msedgewebview2.exe	93
PID 4928 wrote to memory of 5500	4928	msedgewebview2.exe	97
PID 4928 wrote to memory of 5500	4928	msedgewebview2.exe	97
PID 4928 wrote to memory of 5500	4928	msedgewebview2.exe	97
PID 4928 wrote to memory of 5308	4928	msedgewebview2.exe	98
PID 4928 wrote to memory of 5308	4928	msedgewebview2.exe	98
PID 4928 wrote to memory of 5308	4928	msedgewebview2.exe	98
PID 4928 wrote to memory of 2592	4928	msedgewebview2.exe	99
PID 4928 wrote to memory of 2592	4928	msedgewebview2.exe	99
PID 4928 wrote to memory of 2592	4928	msedgewebview2.exe	99
PID 4928 wrote to memory of 3908	4928	msedgewebview2.exe	100
PID 4928 wrote to memory of 5012	4928	msedgewebview2.exe	101
PID 4928 wrote to memory of 5012	4928	msedgewebview2.exe	101
PID 4928 wrote to memory of 5012	4928	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\XDLandsLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\XDLandsLauncher.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5744.4312.2656029212817897950 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView /prefetch:4 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdd0425fd8,0x7ffdd0425fe4,0x7ffdd0425ff0
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1776,i,4971543647708967505,1749539416321630054,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1776,i,4971543647708967505,1749539416321630054,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2404 --field-trial-handle=1776,i,4971543647708967505,1749539416321630054,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1776,i,4971543647708967505,1749539416321630054,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090 /prefetch:1
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=1776,i,4971543647708967505,1749539416321630054,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=1776,i,4971543647708967505,1749539416321630054,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=1776,i,4971543647708967505,1749539416321630054,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4424 --field-trial-handle=1776,i,4971543647708967505,1749539416321630054,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView" --webview-exe-name=XDLandsLauncher.exe --webview-exe-version=2.7.21+74b75833f5108d8c685e49ae739df93446885de7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4260 --field-trial-handle=1776,i,4971543647708967505,1749539416321630054,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a5bd982e0c4cb28397f6b53895c4e63bc91e2090
    3⤵
    PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.css

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\app.css
Size 34KB
SHA256 312e205b36b629d03872214be7508203aba56648883bbea0daf322982bdc6907
MD5 302354b418b1ad00f587e6e2f7cd84ab
SHA1 213b092208b99bf3bf2303ecc79daa1649daf612
SHA512 6b277387c06907987e0dab95774b55f24970b7e317099b673afa40c22c48994c9a7c8a751fd658df6f81535e26df300a702a08977751c6e6ffb3c2cfb03b2a00
SSDEEP 768:bFr6cS65MTyW7FViyNVdYt8O6kk22X2p5wiWsBcxvO:BrSaM2W7FViyNVdK8Ojk22X2fTWsBctO
TLSH
T1E6F2527213142229B557E79CFB97D78EA66C7103B201027C6D963048C3CE2BA967ABF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.js

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\app.js
Size 60KB
SHA256 929885f7483710e5ae617e105ae5d30baf58f70ea3a27ffbfd1f57dac34918db
MD5 3f9056b1b7a3cc8f85a1855f22b36f79
SHA1 e51efa03dfbbbb6ef85f66437da9f17302313349
SHA512 6f87fa94bfdb2a88f5b7b158ebbba8b636b9d66a0b6b9c4225250661afb5714692c06c9f782c638a2eb37eb83b2b99cd369ee14a067df69012f39c6d55f7fbb4
SSDEEP 768:OG4pYj2blEJOwQJ2ZYZ3xI1Gy8bUEEV/I01h1Oi8R:dwdE0JHZ3xBPEVgMjOi8R
TLSH
T12253E937A06915377571C2BE970BA01AFB35315733818529766CB8482FEE824A3F9EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

camp.webp

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\art\camp.webp
Size 87KB
SHA256 263d58d943d39a0ee84efca68ed1f9fe37b1763d6059c94e22e5977aa8857bdc
MD5 9442c7d136d463134b13cce1bb226dee
SHA1 1aa35d86f46c45ea5d2f4d84b37b1fedcda7b19b
SHA512 4d346cdeb561cefcf66400181e7acb39267e40c645b71f17d830d5d5e7cdddb46e27091ed7ad80c66193d35d95f069d2e2c7b1dc68bc856eb3273e2b094cc644
SSDEEP 1536:wOAF/hwP3AIUw6xu1zpX7lfit6lT7FBtGwW0gSCm3QpRFWibU5jIDtSjaNYTWstd:YF/m3AID6xu1JJqtWXFBhgHyibfkT6+9
TLSH
T197930296457A77228E1081B43F7DE6A414476B891377E399E420FC769267E3E402CBE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cover.webp

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\art\cover.webp
Size 14KB
SHA256 03cb76b2da3d7c0a4f7083900d3bf2dee302700d09705aa64b379506f16d19f3
MD5 ae5910d5f10490eb70b63be1e9f6f789
SHA1 7e70e72ba6c363940abd0dd017c8485c6b71048e
SHA512 18c2f48dc3a87339a336c479e4af2bcca09dd648b3c7052f72927074e881c364b1de160f56c1c235407381a5aa4c8481ef055aa580e189d0475350bc546f5c7f
SSDEEP 384:uMqP3/NfWkGmZoqVB2ff6sU+eKCmJZmxktXmCUQWs+KMZ4UrbGJSFbcLZ:uj/0VmZhbUU+eKCGGQ1Ur86GZ
TLSH
T15062E17CFFE6B0E373A960BA9542A22F3034468C7C7BEB4EB3250DA100A491B3D5C158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crew.webp

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\art\crew.webp
Size 54KB
SHA256 178fa8fcb620a3e8847831178aa13ce1ba5742eb7f8fb1bbdeccfc4baca5b93b
MD5 0f5c9015848a22cd9cc9f1aebf56827a
SHA1 f1c2135445d3719c95cf51cb5f6e0269b2b45485
SHA512 cacfd7044b661a2f50d5d28119c24742d1bb6443cd2e1554240c77db9ff0f5b5a158a47d5de085a538a3124e3ed9999ccfe909f13a252d9c18a49df9896f17e4
SSDEEP 1536:uZeq/oNgwvlXvsAbddTTPyKNqAHLZlnhP44jleaJ:yUnllHHFND1/A4lt
TLSH
T1814302DD415EEE31DC63505529EC31B89B734FBBA07484AE0076BAE2E3DED3A8845B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

expedition.webp

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\art\expedition.webp
Size 84KB
SHA256 5d03b567ce4a945b511d500594303de41e2fb602643d29569d32d56bf4ad1ee8
MD5 4ef1ea45dc393f799acb4933e47bb85b
SHA1 708a7453e49277fbb039814a76c0c81fe94e965e
SHA512 434694a2b02c4dd63bc5f4382f9eeb471ecfa063ba7aaf3d980e1e7cb8b213f469fba6872925c9ceccf4362f72bad183d12943ea996c8b3817c22e21e9abb91c
SSDEEP 1536:BNbkt7nBUiNAQifKarcEebBtwyykuONwsBxShoQOeHrDXRdn1b52HaMEi09RZQ3P:B6tG4ufr03MMwsB5cHJdn5526o09v8jr
TLSH
T18D83023C0E31FA17E4FE536320A978747D62E4884C24F362335EBC9256FD74E8A86849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\art\logo.png
Size 43KB
SHA256 70f133751fa8eae1071ece241cc01e88f95470e8b8dd2fbc9bdf4f9bccd87bee
MD5 a1b99b01f5bebc822e675605f5394331
SHA1 590b3f784ba67a28f58100a094506fc6994c519b
SHA512 d0f584e845fb0abecd178925b831247d0d5fdbc912e0326534a66905e707509e76044791523b38c9e67e3250d79e155e71950ae4936b92c0777a56a478ad4ac0
SSDEEP 768:5Jo1row9oBbXEjiKnDczlsHjwBAZ48Q1CZZcAaSqoOUD7w7/t7gH8NCDQYF:fonoBb0j7vD0r8QgH9O0MJ882
TLSH
T14313F18F08EA4BA3BCD44D30590FA1A1B67E1E17113959F5C4EE61AEF0F8BBE54218C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tower.webp

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\art\tower.webp
Size 88KB
SHA256 bfb8fe4e389aee791f8234c59301a060d8973b356b0f3c44d978a869a2bec3c7
MD5 a26c7358299f41e37fbd76e0014a0540
SHA1 9c7ace0b5233e1a74e7ea098635fc36b81c8857c
SHA512 bf927b7edc9e1fde5925fc7e705f9a0e4c7d22d3c41854aef7df69c426ceef40cd2670c36cc1f22c0685e5de57a7b640714e41cb795b8775518559783683d410
SSDEEP 1536:vppdKif+abKHbwdc22MinnzrBQsPqQwc0UdpBgkZysaucVd6+PZKzgs:Rnr+uK7wdfvinzNQDoekZy/mW2
TLSH
T1639312BA1F2ACCE91B70D0E46B52522BE6362A562CB1F7340DF2056DC9001186E7AB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

town.webp

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\art\town.webp
Size 93KB
SHA256 367db25519987a7b176c89d89569f66593a0ce4a98f152e727261e864e17fbdb
MD5 c93824d0c28c2d0476d4e97391897ae2
SHA1 9151a39af7322f7682f89b87e68b1c43cb38e821
SHA512 ec14d5b8708294dfaae16e331a03f6c17729083613c73e0af833494d97ccd8e40ce7a847040b65219a0db604278537d7ac4845b4d308e2e01e6943103dc30606
SSDEEP 1536:S/R+b0dzbr3y1ra2gbtLdoxOhuhbhSQOb8RL7U6pp00GvNkMA6x+lB7d1Twq:SYczbW1rgbtLdVo3Spbc7UfvNXx+lB7F
TLSH
T15C930247062B985CBAE7C0DF1A9DE790B7D2E03E41455CD38CBB444260A3B59575C3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

big-shoulders.woff2

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\fonts\big-shoulders.woff2
Size 34KB
SHA256 698f9960927e7b5a0c38e5bf388cd0a6e42d855062fe70366cf5057664e39401
MD5 e1ffd66080516249eb3fc5866dca36dc
SHA1 caf8e2fb637c82f8328a720a7bd37cdf465b3807
SHA512 7905422752de786817c8c8d9aadc2e4bf327c901cf21ed6ac730dd89d3a8a42ed393c5ddd8a70ab2b09dc44a025aa9a3f8f1edade71485ad70ff0b7730b92c7a
SSDEEP 768:UkPuW5tv6B6xWEhEBuHhkngI9SavW0684h6812dTqo/g56ZaZ5:XPoB6/8dgI9Sae0b4hKTqoxZe
TLSH
T1F0F2F1401AC9AB8C8D324D7D5BF34A6DE0D3B3973BB9518BA0A6358617F396CC139290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

instrument-sans.woff2

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\fonts\instrument-sans.woff2
Size 29KB
SHA256 2ee17598a98d8a59e4df8152d015bec9ab8e4d5672cc0ab42bef806b568e3971
MD5 fa41c43a3d8e68fafc0ec15acca8b6fd
SHA1 adbdfd9a78699a96a9705fbeb3470c2c653dedf0
SHA512 936da7cff6f59919a72f564c6f1d3b78e1a3be000fb1ca712abea3266687846d53c25dcf1d1b78221c985d4e96dda91ced26a221d85e4521e3d661c71affa216
SSDEEP 768:eHpJRc2xEL2BUo6ulIYw1wXomue+I4oOf8oSY6fg:gp62Uo6kuOYmuTaOfwYmg
TLSH
T1CCD2F18A71F9A1F874695DE0B8EE9B54BF8EE3221AE7745610D10781D6E13083BBCC35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\XDLands\ui\21-8df102432b6c01e\index.html
Size 15KB
SHA256 f69a8d9e456c6ac64e5a0d2e3725f54ef5d88ef7a846ec9557dedf838dd28426
MD5 744baebac82afb8b47c1b2b985b0580e
SHA1 4187ab9d310097d14e0209434d2047ccd02f90af
SHA512 7d4b9e6fac4ca43e6b84f344c7ea8c85f6bd4059f8eebba0675fe75729f30a4e1e8b82510b143eb54c9b493b1b7e21c13375204d59289487e9811d01872c8c49
SSDEEP 384:mUnB22hZSsVZVjttrGLBr+Vg7KnaoZhH4FCRLzP42/o4g9FPVP02bMfzrOsPuOzt:ZbPiiVgwsF24U
TLSH
T16562B860A0E8693B0073CAD9A696A795FA96E10BDB4F524476EC17E34FF7D24FC0B011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\XDLands\webview2loader\x64\WebView2Loader.dll
Size 190KB
SHA256 3426dcc55fdfb8b5e7ac623cf33b4ccf283fbf68a0c5a65bddfdb4d749a8abee
MD5 f1426c839cbf0e9a4eae7c67916cedff
SHA1 60cdeba80ce6357d9598947bd65f2db31e5efa2c
SHA512 392d172f8e960a2d18d18175813e091c27d12065db06c4fcaabb6429bbb1306a3087fff33e51bf9226759b34d454109c11a310711ff9f7c6f9d8f78164b661f3
SSDEEP 3072:hJoWXgNjIFnTf75x2v/KUUbPXGUIufAuzA2dTZnaZED3JU9jfbKuFjaS3:LKI175Av/KLB9zz3nyED3JU9DKC
TLSH
T142145D06B3E940F6F976D67C89A38A46F67278110710AAEF0360473D5F2BBD49A3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e05b42a-a384-47e9-96a6-0ce78bf34067.tmp

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\4e05b42a-a384-47e9-96a6-0ce78bf34067.tmp
Size 3KB
SHA256 a533a4755b31e2540318bea4cc72f7523e698c5829a0bb13b560be3c0de0aac7
MD5 0cf41fca35d15ab647e6e18517b45b75
SHA1 c0f910e23d5e01a3f558e511554856737fe86f48
SHA512 9bcad00fa8dafb2aec5c5d4d6235f7dd363d2ed2cb43ecd21e24b9784cb282b0d63270c2275cf83c945a3c1ec0e518758831ecfa6d3134766ae1c77f3d07ebfc
TLSH
T197719526A9B4AA374DF3EA05B9863B07A7A89067F4953F99D6ED0F0C01D73C80342C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7366637fb4a0187a1f4df7b726ff6ba48ddca4576f2c791347ab185299decdde
MD5 c1bc9e7bcc9280bc8a4d12f77c70b469
SHA1 8125f7f2e1d2e63c8503ab54e2e7731a730f5b06
SHA512 ab72467282c0745056f0db5dd23437a85d2bdfc160102afe4a7e63a651a36075eb58648c32ad358ba1afaa97d2125c66e21f80eab6507d9388b7e22b95fa5380
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3a17b943b5af680c18adfad243b95de24f4ad137c745f7b7d5aad712d587fb55
MD5 5d821ab4ac412c636a9782b865c5c04e
SHA1 514d866cb8111935be015c043c7b3ab1290b3e27
SHA512 888b3738bb5e8328b0946656b9f26210ee6faf7e1e6ccfb28d6fc58740351fd95c4bdaa1a2cea292231c107353c49fe928777bc37955746fc8635be599566ecd
TLSH
T122D024133F710174C010333311437D0D0511C11F500541015C3CC51F5F041D00D43C53
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0dbaaf29-6f34-4462-a924-2396fd7486c4.tmp

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\0dbaaf29-6f34-4462-a924-2396fd7486c4.tmp
Size 6KB
SHA256 8f1701105b9a40c9ef272d571cf66280aa3efb819579b7ce7a336392a96c6a22
MD5 0d442fe80179a3070e15f533e790ed88
SHA1 b0ca1070b9227486f68f35bbfbff8132b2370d28
SHA512 5502d9f6718134594388b16cf5e5c76e33f3ac09e142c282737013fb6d7439904400774bef88f4858d9887364664bdb4095b5d3d71dc5d73ffed81d04f742ba8
SSDEEP 96:steXdkzMBb9RTkzo5h16ZswJs7/x+6MhmuecvfFS1ejevyK+gy28XM1C7K:styqyiokJsV+FTf8QjIVYG6K
TLSH
T17BD184025E28697B4CC6F319BA69BA07E2F9A03274D51E58F7F8462C08DB6DC6307D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8780b5bd-bbc8-41d8-bffc-2e93d6086786.tmp

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\8780b5bd-bbc8-41d8-bffc-2e93d6086786.tmp
Size 6KB
SHA256 dc81de8be6d97e67a4bb29ee9421fd11f41f3a75b98a9832f8aa79d72d9607f3
MD5 e04df118558a6a045d290fd77d69b3cc
SHA1 cf90299d8104cffcef636a96c3f5aef9842446c2
SHA512 4d9a7cf6d7cb0dc869d984ed69eddc916fd175c324e3543fca1b6f9ce526838cb14e3780417ef8e5e66c964eecdc922b8fcc720c4f4e7cd9d707630fe5c5f401
SSDEEP 96:steXdkzDGBb9RTkzo5h16ZswJs7/x+6MhmuecvfFS1ejevyK+gb28XM1C7K:styq0iokJsV+FTf8QjIVpG6K
TLSH
T1A4D195025A28697B4CC6F619BA697B03E2F9A03270D51E58F7F9462C08DB6DC6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 214a19f981b74337b21419113144d2f05b3db18d809c8e3d3a4b2a2eb39c0baf
MD5 424b9096a15d08630184951d2012e7e2
SHA1 a054acb72d86a789d2277aeb9012db3f8cd1aa5b
SHA512 2df9052ecdee9ceecff8e93d79fcc100dbe6866c0e11e6d7a4521ebd05185297597cea62807ff039fb320d19c0ddcfebd7782cf8e5aad87cd470cb4ca01327d3
TLSH
T146A0021491C200EBC309177420C145513370582243570B5550E125B48CD9391A9B2002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 69b41cc472b8efb4654184871567d815e93c5ceb53447b0288ccd066ea4c36a0
MD5 fac188322a0398796513641766e1c28e
SHA1 c52855caa39f0ae340ab463f02c75b124b612c78
SHA512 572e30811e736a473d419e84d21cb4e0b3c2327058b4bb83e98691a53baf69049fe7e39c104e2b4eaa15c716ec89e5ae8d77b7f7fed42cf2e90e3ddf50ad55ff
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

440ba2fe-dc2b-4bd2-a6b2-fec46d071b5a.tmp

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\Network\440ba2fe-dc2b-4bd2-a6b2-fec46d071b5a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Default\Preferences
Size 5KB
SHA256 c0d013f7b006132c908b4ba561d1143802174ba6c70d23acf0101fea3df2a1f0
MD5 78aa89ac5319c312f61ca48f99661f76
SHA1 d364ba6e354679593a13752907f0ea4c6c22a130
SHA512 beb9a9b2b5c3b1f9c0e7e6f9cb70ec3ba07a581b177d4d9458b69811a63726d2b47d06f9dd4eb96d0c2a7ab45cbdbcb7ca09f34f44dd8e7e1e743fc86a2f3846
SSDEEP 96:reXdkzMBb9RTkHdo616ZswJs7/x+6MhmuecvfFS1ejevyK+gy28XM1C7K:ryqyioxJsV+FTf8QjIVYG6K
TLSH
T172C195025A286A7B4CC6F309BA697A07D2F9A43175D52E58F7F9462C08DB6DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\Local State
Size 1KB
SHA256 49390eea189a70ddb811512df8691b380436c7ad547a22398d13003eace0b8f9
MD5 ac52efda35a1abc25e677c5d8c0cf974
SHA1 446dd58f7fdec4ba82c4073ff94a55a2983443e5
SHA512 96a607c3963d398537efc7ecbc4847589ae3e38dffff20f1ec2f1fd95be1e3deacb3b3602883ab9061159164bab25857a0f3de8712faa4839575e459182b176e
TLSH
T1292142B2D8E46B376D82770631977B5B6F64A0A791504E4422DE4B1801E728C8256C36
MD5 SHA1 SHA512 TLSH

Submit Download

a2ec6b9b-3bb2-4f81-96e0-7b6cbe1b8c80.tmp

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\a2ec6b9b-3bb2-4f81-96e0-7b6cbe1b8c80.tmp
Size 3KB
SHA256 0ebca9185388e6647b60f32be92e9a8c2bb054c5824b68e3491ec5eefef36dd6
MD5 8f4087ac14f9cf3a52dc31ea31dde469
SHA1 910c06db7f2d518ee6e6e4acac0d431cc9703053
SHA512 e27741bd4eb1ce1d0ecf859f9d2305fa2e8db9a0f426e87c3e837f43fd46afa9f1b9d8d5118900a83906714121fc4c0619580cc05254dda49c8d359b4b881891
TLSH
T1B1616476A9B4A63B4DE3AB0578C62B07A7A5A063F5953F95D6ED0F0C01D73881341C17
MD5 SHA1 SHA512 TLSH

Submit Download

d5bb6208-d621-4ee5-b3a4-03069919bf07.tmp

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\d5bb6208-d621-4ee5-b3a4-03069919bf07.tmp
Size 15KB
SHA256 bbd40c5f00d9ee2d2b606bd0bb7ff65450901b74092a7414ad98cc2387b6bc65
MD5 3f8cb12262c4dc6a7a6ab137cb858308
SHA1 779122988fe76e5ca1acb044da139b2556f5821d
SHA512 c18cc3723ab57402d846a8e5b2626a80ca928a94200e80759eb9971fb7ff207d9b1dd20bfb8820b3277fd0dc40c5c7fe203bfdb1c11f291bd234a885e05f058d
SSDEEP 384:f+OBqImmJvGBLx3NaFMJFNNBSQKb9EcQBosPg6rb:ecvGtlNxy9jQHf
TLSH
T15172AE7A18B56B272CE7D70ABECA2747CB617193C0E57AD5DDEC8F0E01AB1840382D46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8bdb92e-490e-4d70-9690-762df377a6ae.tmp

Path C:\Users\Admin\AppData\Local\XDLands\webview\EBWebView\f8bdb92e-490e-4d70-9690-762df377a6ae.tmp
Size 2KB
SHA256 697a9e348bde3050f0bdd9e2b2cadd22927afcc9666b8549efa75345898b437d
MD5 022bc0b1317ad4685baf8e5c9e95a461
SHA1 dbd332ed7db9096e889c666e636bd004f7d67414
SHA512 414986ad90d03fb3c36cd1504750415c0bbf56a0a64e502129b3bc7991adc91af87514d85d9d98fdf496faf86b8c5c4bef0d903b5a982514ce6c2a5c58ff0eef
TLSH
T1E751C773AC64B73799E3AB0479CB3B139A79E0A2B6912F5196DE0B0800D778C1342C77
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_1050961792\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_356636515\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_821878799\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_854549887\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2592-412-0x000001F302ED0000-0x000001F302EFF000-memory.dmp

Download

memory/3488-145-0x00007FFDF7020000-0x00007FFDF7021000-memory.dmp

Download

memory/3908-423-0x0000028DACFF0000-0x0000028DACFF1000-memory.dmp

Download

memory/3908-420-0x0000028DACFF0000-0x0000028DACFF1000-memory.dmp

Download

memory/3908-421-0x0000028DACFF0000-0x0000028DACFF1000-memory.dmp

Download

memory/3908-422-0x0000028DACFF0000-0x0000028DACFF1000-memory.dmp

Download

memory/3908-424-0x0000028DACFF0000-0x0000028DACFF1000-memory.dmp

Download

memory/3908-415-0x0000028DACFF0000-0x0000028DACFF1000-memory.dmp

Download

memory/3908-413-0x0000028DACFF0000-0x0000028DACFF1000-memory.dmp

Download

memory/3908-419-0x0000028DACFF0000-0x0000028DACFF1000-memory.dmp

Download

memory/5012-451-0x00000150091C0000-0x00000150091EF000-memory.dmp

Download

memory/5308-366-0x0000025D6DE20000-0x0000025D6DE4F000-memory.dmp

Download

memory/5500-317-0x00007FFDF7F80000-0x00007FFDF7F81000-memory.dmp

Download

memory/5500-316-0x00007FFDF6A90000-0x00007FFDF6A91000-memory.dmp

Download

memory/5500-328-0x0000022DE8FB0000-0x0000022DE8FDF000-memory.dmp

Download

memory/5744-6-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp

Download

memory/5744-9-0x000001FAD28D0000-0x000001FAD28DE000-memory.dmp

Download

memory/5744-12-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp

Download

memory/5744-3-0x000001FAECB50000-0x000001FAECD12000-memory.dmp

Download

memory/5744-18-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp

Download

memory/5744-0-0x00007FFDD535F000-0x00007FFDD5360000-memory.dmp

Download

memory/5744-5-0x000001FAEC890000-0x000001FAEC93E000-memory.dmp

Download

memory/5744-214-0x000001FAF0240000-0x000001FAF0768000-memory.dmp

Download

memory/5744-13-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp

Download

memory/5744-1-0x000001FAD2130000-0x000001FAD23C4000-memory.dmp

Download

memory/5744-10-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp

Download

memory/5744-237-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp

Download

memory/5744-231-0x000001FAEE270000-0x000001FAEE2C0000-memory.dmp

Download

memory/5744-14-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp

Download

memory/5744-2-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp

Download

memory/5744-11-0x00007FFDD51D0000-0x00007FFDD5B74000-memory.dmp

Download

memory/5868-43-0x00007FFDF7020000-0x00007FFDF7021000-memory.dmp

Download