9264e7b3f8c9025c2e5f27e46556faed269b9505f44fea617046f335a9006257

Analysis

user interaction
yes
max time kernel
36s
max time network
37s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/10/2026, 14:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hangar-installer.exe
Size 2.3MB
Sample261018-rq7ddsft2w
SHA256 9264e7b3f8c9025c2e5f27e46556faed269b9505f44fea617046f335a9006257
MD5 3176b708f8254561e6838a12d2b6005c
SHA1 a5c37980cb2296504b7bd0dfb5fce046605f2e0c
SHA512 26a7017f8137efd5a149b7460033f0fd13b24ebf696b97be3a4f719ca39e30a0affc83772e2975a29ac56d48f9450ca1ccf06490c991a8e31a6593939d46833a
SSDEEP 49152:YI+A1B+2P9dc6i99xgFv/yF5zS/yc0vXv8KpizN6Ll4VXo3GiwcrpEgE6w8+yX7H:YIZnVdcriFv/OSL+QBylSY3XrfH
TLSH
T104B5332467D2CA7BD98584B273A2CF6BAECCB40321786782424DD27E35D4394897F7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4396	skybound-hangar-updater.exe
4024	skybound-hangar.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SkyBound Hangar Updater = "C:\\Users\\Admin\\AppData\\Local\\Programs\\skybound-hangar-updater\\skybound-hangar-updater.exe --background"	skybound-hangar-updater.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	skybound-hangar-updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	skybound-hangar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4944	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4612	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	skybound-hangar-updater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	skybound-hangar-updater.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hangar-installer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\skybound	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBoundHangar.cx\shell\open	skybound-hangar-updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBound.CatalogFile\ = "SkyBound Encrypted Catalog"	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBound.CatalogFile\shell\open\command	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBound.CatalogFile\shell	skybound-hangar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBound.CatalogFile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\SkyBound Hangar\\skybound-hangar.exe\" \"%1\""	skybound-hangar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\skybound\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\SkyBound Hangar\\skybound-hangar.exe\" \"%1\""	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBoundHangar.cx\DefaultIcon	skybound-hangar-updater.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBoundHangar.cx\shell\open\command	skybound-hangar-updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBoundHangar.cx\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\SkyBound Hangar\\skybound-hangar.exe\" \"%1\""	skybound-hangar-updater.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\.cx	skybound-hangar-updater.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\.cx	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\.cx\OpenWithProgids	skybound-hangar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\skybound\URL Protocol	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBoundHangar.cx	skybound-hangar-updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBoundHangar.cx\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\SkyBound Hangar\\skybound-hangar.exe,0"	skybound-hangar-updater.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\skybound\shell\open\command	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\skybound\shell	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\skybound\shell\open	skybound-hangar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\.cx\ = "SkyBoundHangar.cx"	skybound-hangar-updater.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBound.CatalogFile	skybound-hangar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\.cx\OpenWithProgids\SkyBound.CatalogFile	skybound-hangar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBoundHangar.cx\ = "SkyBound Catalog File"	skybound-hangar-updater.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBoundHangar.cx\shell	skybound-hangar-updater.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBound.CatalogFile\shell\open	skybound-hangar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\skybound\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\SkyBound Hangar\\skybound-hangar.exe,0"	skybound-hangar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBound.CatalogFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\SkyBound Hangar\\skybound-hangar.exe\",0"	skybound-hangar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\skybound\ = "URL:cx.skybound.hangar protocol"	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\SkyBound.CatalogFile\DefaultIcon	skybound-hangar.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\skybound\DefaultIcon	skybound-hangar.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1900	msedgewebview2.exe
4664	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	4612	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4396	5052	hangar-installer.exe	84
PID 4396 wrote to memory of 1900	4396	skybound-hangar-updater.exe	85
PID 1900 wrote to memory of 4600	1900	msedgewebview2.exe	86
PID 1900 wrote to memory of 4408	1900	msedgewebview2.exe	88
PID 1900 wrote to memory of 4408	1900	msedgewebview2.exe	88
PID 1900 wrote to memory of 4408	1900	msedgewebview2.exe	88
PID 1900 wrote to memory of 3212	1900	msedgewebview2.exe	89
PID 1900 wrote to memory of 2184	1900	msedgewebview2.exe	90
PID 1900 wrote to memory of 2184	1900	msedgewebview2.exe	90
PID 1900 wrote to memory of 1712	1900	msedgewebview2.exe	91
PID 1900 wrote to memory of 1712	1900	msedgewebview2.exe	91
PID 1900 wrote to memory of 1712	1900	msedgewebview2.exe	91
PID 4396 wrote to memory of 4944	4396	skybound-hangar-updater.exe	99
PID 4396 wrote to memory of 4024	4396	skybound-hangar-updater.exe	104
PID 4024 wrote to memory of 4664	4024	skybound-hangar.exe	105
PID 4664 wrote to memory of 420	4664	msedgewebview2.exe	106
PID 4664 wrote to memory of 1684	4664	msedgewebview2.exe	107
PID 4664 wrote to memory of 1684	4664	msedgewebview2.exe	107
PID 4664 wrote to memory of 1684	4664	msedgewebview2.exe	107
PID 4664 wrote to memory of 4368	4664	msedgewebview2.exe	108
PID 4664 wrote to memory of 4688	4664	msedgewebview2.exe	109
PID 4664 wrote to memory of 4688	4664	msedgewebview2.exe	109
PID 4664 wrote to memory of 5244	4664	msedgewebview2.exe	110
PID 4664 wrote to memory of 5244	4664	msedgewebview2.exe	110
PID 4664 wrote to memory of 5244	4664	msedgewebview2.exe	110
PID 4024 wrote to memory of 4612	4024	skybound-hangar.exe	112

C:\Users\Admin\AppData\Local\Temp\hangar-installer.exe
"C:\Users\Admin\AppData\Local\Temp\hangar-installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Programs\skybound-hangar-updater\skybound-hangar-updater.exe
  "C:\Users\Admin\AppData\Local\Programs\skybound-hangar-updater\skybound-hangar-updater.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=skybound-hangar-updater.exe --webview-exe-version=1.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4396.1188.4405975076230352518
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc93f9b078,0x7ffc93f9b084,0x7ffc93f9b090
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView" --webview-exe-name=skybound-hangar-updater.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1788,i,12780059952476629665,8499248542648592775,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView" --webview-exe-name=skybound-hangar-updater.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2068,i,12780059952476629665,8499248542648592775,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView" --webview-exe-name=skybound-hangar-updater.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,12780059952476629665,8499248542648592775,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:8
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView" --webview-exe-name=skybound-hangar-updater.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3528,i,12780059952476629665,8499248542648592775,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:1712
- - C:\Windows\system32\tasklist.exe
    "tasklist" /FI "IMAGENAME eq skybound-hangar.exe" /NH /FO CSV
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Users\Admin\AppData\Local\SkyBound Hangar\skybound-hangar.exe
    "C:\Users\Admin\AppData\Local\SkyBound Hangar\skybound-hangar.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=skybound-hangar.exe --webview-exe-version=0.3.2 --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4024.1860.4840063992536135388
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7ffc93f9b078,0x7ffc93f9b084,0x7ffc93f9b090
        5⤵
        
        PID:420
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView" --webview-exe-name=skybound-hangar.exe --webview-exe-version=0.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1828,i,14724138360879608790,9127147093240372089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
        5⤵
        
        PID:1684
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView" --webview-exe-name=skybound-hangar.exe --webview-exe-version=0.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1848,i,14724138360879608790,9127147093240372089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:3
        5⤵
        
        PID:4368
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView" --webview-exe-name=skybound-hangar.exe --webview-exe-version=0.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,14724138360879608790,9127147093240372089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
        5⤵
        
        PID:4688
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView" --webview-exe-name=skybound-hangar.exe --webview-exe-version=0.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3556,i,14724138360879608790,9127147093240372089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
        5⤵
        
        PID:5244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -NonInteractive -Command " $stores = @('LocalMachine','CurrentUser') foreach ($loc in $stores) { try { Get-ChildItem \"Cert:\$loc\Root\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Subject } catch {} } "
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d1dc88c7c71b3b6dea39b6de8b8c075d3a093a61ae2d5019bb7fba0c530b2d9d
MD5 ac04a49e871501c891bb7ca458178780
SHA1 71e7001ad23f2291100fc4c8e47809b9bc63d038
SHA512 1d54dccb3daf15188299640d8541d68d37c7165487c64835c862e08dea18e2d36b2ddb76c1af58864281308e9f0bb6c586dd44b4e4812bf6d19d7711eef37517
TLSH
T1D1412858B6EA0148B3776F5A9BF6A82E483BB9371E06D49D00110E4F0B23B40CDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

skybound-hangar-updater.exe

Path C:\Users\Admin\AppData\Local\Programs\skybound-hangar-updater\skybound-hangar-updater.exe
Size 4.4MB
SHA256 0a280ae06183cbc29ef8cb938d068991df976f6d637b2d3febd23e2802decf56
MD5 fdd2df3dd9d45ce26847cbb847c0f8fd
SHA1 2c0cbbe282377b6b1853e05f5e90056764754d4e
SHA512 7533ffd6802206c8435c3dc9b347d2a20bcddd1cb61f2d7bdcf995e42f6d066537ad55be9a61d14e5bcdc65d14bdcc6a01d0d37d0a9aacdd007295d45a73b658
SSDEEP 98304:kLQrhgK2xSpCixqKwh+lB+hvkQ8/3j7KZe0fJtZNQImYn+b:B+SsD7nfZNhmea
TLSH
T1D8267D07F29081E9C09EC078C39BA637EB72B8CD0925B69F17E45B112F26F906B1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skybound-hangar.exe

Path C:\Users\Admin\AppData\Local\SkyBound Hangar\skybound-hangar.exe
Size 10.1MB
SHA256 922045a88337518ccc7541c58965c5532687fb77e0c195abd68d4e0336a45216
MD5 ece95a29d096c1b4a937b3a407e302f5
SHA1 a599f0234fc7a78b158a47c79c5bef5e01aef948
SHA512 3918b6562c6d55281665ab1c4ffd3f5a04206c1f2f3ff64a660c2506641fbc4b7aaf7172a96a34b6e8f13e92c9a9fe411f9c5825ea267ef890eb2c32447b40a8
SSDEEP 98304:OdssrEVZH5so9Zjf1MXH6MCbrX4E1om7KqtHEPhWJhyniJlfR3ditRZN72oXxfJJ:4CVnBfR3ditRZN72exK41in2
TLSH
T1E3B69E43F6A181E8C09EC4B8835BA237EB32BC8D4525B29F5BD44B112F26F50AF1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jxsmvtcu.5fq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jxsmvtcu.5fq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

01aff590-647a-4b05-9b62-c938b5f6f0a3.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\01aff590-647a-4b05-9b62-c938b5f6f0a3.tmp
Size 3KB
SHA256 447bf4fe3088f10d0cd159db9303fd27f29001d85e46bfc32fcd234fc1d05c20
MD5 3d977bc97dd64f126a97f62f5309c553
SHA1 d3c36f1fa834e9c888aef7d1e809c635150d705f
SHA512 0a1bb138de64808148c11ff10b4e9f0ef02df0af037c4fab3ecab665e0f2e03488fa2e050693cf8c2c6342e24b7ed2686e9c8d5d357831911e446f28aa1f21fb
TLSH
T1EC71BA32A9B0A93B4EE3D940B9C92B0277A56176E1943FD8C9EC0F0D41D76D82351C2B
MD5 SHA1 SHA512 TLSH

Submit Download

869e7a4a-8fa6-4a8b-a5a9-5c8235340cae.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\869e7a4a-8fa6-4a8b-a5a9-5c8235340cae.tmp
Size 16KB
SHA256 9af08f94b7206db2ba469a96ac2d3d2d62377037227889a1484029c36b35cbcd
MD5 41cd3ecfb9606ff5c39773973b85ddc3
SHA1 d49f8770fee04e1394cf8761e1f7c69cf5977f42
SHA512 23cf0253dee287d45a03aee9995438cd95a091e780382bbce697418e307353250775723fa38871a61847b828353453fa60f6608bcb0ebae4b97fc2890510681a
SSDEEP 384:zv+OBqImmJvGBLx3NaFMJFbNbOPFetJhhjhXg6rC:acvGtlNcKJhhjhFm
TLSH
T1EF729C6B18B42E372CEBC649BA8D2783C7646297C0E46FD9CCEC8F0F816B1941352816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1e106e801beb5d01cb7b61396593288a0f9e582b1df131cbedcb34487dc1f1ed
MD5 097cbcd3f0be1d68600584d2f2123f55
SHA1 f4d600f99326ad5b82ae68f6a09943e85cdb7ed4
SHA512 e0ded641cec4e06f8242cd3deff322535da96e3d558aa02aacfc8c32abb66096d1073f423533a3f01b611ddda7a64e4f1993d640a7537eb6ac019eed64a93a67
TLSH
T18ED00475D14134C1F00415330431410D1741457D40010101111415C407411015105300
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 99e8086c6f5bed1666707d5d4cffb31961b79d6e3faf75ae8c1173b55fdbb349
MD5 5a120654b2b0acf35b8f4d268ca50904
SHA1 cabf5cb0a3a9bb868e072a230c33e8a131d0bdbb
SHA512 8b201cb530c4a72bbf8197961e2092aa4f85ecbe76ef53c6c5a91be466f91493573d8546601ad11074a0f68f6706cb25972bd9f58268fbdee854246987e1544e
TLSH
T125D01227B24215B4D01025330413610D1A41C22F80054001642C9A9D1B040501A06641
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

65c2929c-8fcf-44af-a391-5ef989a4cb6d.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Default\65c2929c-8fcf-44af-a391-5ef989a4cb6d.tmp
Size 6KB
SHA256 3fa6b2dfaa3d8bd13db79a1eb7cc55bb6d629900fc8a1ec75e2fe92cfd76df5f
MD5 8e37a3a17e03e92dc20fed6969740909
SHA1 632199cd96283d46f76d6ec814529c48f89b08ba
SHA512 daf6c4b54acd45658db5520373518f37200da11e971fbd475b3a92d94bd6cfc16a94ca9dc725dff5b145be44a7e52673564e72b8b34217c127d74f57a40f2550
SSDEEP 96:stEY05qvI/5fb9NXHffbZ8i0vhEZkthDm/7qx+WVHMSm+uecJeIz1idQjT+g6lAb:stEY0YcXfjZ8paA8/S+WiT/zwdqzlM8
TLSH
T1FED1B9029F38797B4CCBE2197A39BB02D2FA206275D40E98EBFD855C45D66CD231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\Local State
Size 1KB
SHA256 41872037ca815c95932127f03ef3063f7c2d4ac012c04c55431085cd08e3224c
MD5 4c08fdb23b9d43dd4700cde5ffccc82f
SHA1 c007c35ee2ad92b00f8bdad7af55a0424023a79f
SHA512 586abf74818d56a98570d66bf13895a45214c5f945b3da8d4bddfb0496d69c18f37b202936cfc55b12114138d43b88ed3181bace32002dd4c843c5367eeb2f1c
TLSH
T11F219233C8E03E7A29828911B34A7B832E9070FDD2005F4C90DC039A42C78ACC67AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

afc00fa1-f12c-49dd-b5cc-05467f5b58ae.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\afc00fa1-f12c-49dd-b5cc-05467f5b58ae.tmp
Size 16KB
SHA256 888200cc561d70723a5c59c9f8b9ac09e509b8241055a67e1a667f485109e3e6
MD5 3b81e00b98640de7235b5165be08bdc5
SHA1 a09b0df52a5b6071ee42c65e58c590fd1efa0222
SHA512 81e34724972c310fa95a799564dd06d8a3072bbd1fc0a2077f302d118d7df525cb11a3c86bc38cfe6613b369cac00bed9f74f06de0a751a11c4fe923ed948357
SSDEEP 384:zP+OBqImmJvGBLx3NaFMJF+NbOPFetJhhjhXg6rC:qcvGtlN/KJhhjhFm
TLSH
T1C272AD6B18B56F372CEBC609BA8D2783C7646297C0E46FD9CDEC8F0F416B1941352816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c68aa8d4-ca2f-41ff-b0a0-a816378cb784.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\c68aa8d4-ca2f-41ff-b0a0-a816378cb784.tmp
Size 1KB
SHA256 e67f9db22e2b4317c3fc5c1c2155508321d5aac199f778709e0b68c69b8d13d0
MD5 17b7e1982760f0853ca555f3979c99e6
SHA1 d5204d3a00161df0e11dc90811d826420d232ffa
SHA512 82ac6caaecb31eb183aa37cf34621aee1750e6eec357c2d23542c3d370c0bc35e9edab51ba0eb548f5dd8421044e67de045825f7c51a31eb94ddb5836e6bdb47
TLSH
T1F2318572D5F03F761D92965173896B832E6030ADD2005F8851DD479942D399C956AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

ce06b2cc-636b-47d9-b9d7-ab909b0078e8.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar-updater\EBWebView\ce06b2cc-636b-47d9-b9d7-ab909b0078e8.tmp
Size 2KB
SHA256 b930a6e7f9e0c26fad15148ff96512e167410fa72c11ac9c78fdb64acdf649e8
MD5 90649f6f94d7da08808d819dbd38c82e
SHA1 165aa7d86fce4b80e23b68fe39e77aa7398e0281
SHA512 cb75901a3962a26c504b5a51c3f1806b17393d3d0b25a262aeaebae7a18747f4df809e1072f3505d6dadd658a90248e0f3d8309dc5b1a70fb00f305dee964a36
TLSH
T13651E733ACA06F3B4AE386447A8D3F03A67971E8E2502F848ADC0B5D41D759C2302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

3921736f-a91e-499b-97bb-a4332f61aefd.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\3921736f-a91e-499b-97bb-a4332f61aefd.tmp
Size 2KB
SHA256 c014e68d78ff55cc2971d9eba1a76af50fa2d1a3bd2f18ac52bcaff36a7eea9b
MD5 767e36db978be8e89e655942c588260f
SHA1 27f7c8f13d48cc3bdaa64cd4f278496d65e4cdab
SHA512 cee378de40a37d4b92de3daf1302aae9d4c10494ccb7a1e4ec224806547bfbda90250a93f03014c0052f671671d4f42a09421da1ebcb7693bd2e146c9ac29821
TLSH
T19551C873F860BB374A966A44BD4E3B139A3441A195512FD096DE0B0C41EB29D2312C37
MD5 SHA1 SHA512 TLSH

Submit Download

5b6e9035-86d6-4664-a601-d1be75154196.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\5b6e9035-86d6-4664-a601-d1be75154196.tmp
Size 1KB
SHA256 8db0a426a00525f3504d8110a0628180b65d3dd1c375586ec7a2334fcd7f74be
MD5 32208c79a8d35873d43878566033f9d6
SHA1 2fbbaa99b4b9c7e12aaeeee8a45725b62c674e90
SHA512 77e9094a522da2680f7bd219c7d1beae35bf23c68bd8aefa6b1a31f56fee3a8a20a07e388370f47f3d6bc832ba21bb1f07069cb766da259c3091363b8352e6a3
TLSH
T1DE3185B3E4A07F735D857685A74A77976E200166D0605E8892CE4B0C42F72DDA737C32
MD5 SHA1 SHA512 TLSH

Submit Download

7898a5a3-1194-4448-8816-f9e865562f0c.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\7898a5a3-1194-4448-8816-f9e865562f0c.tmp
Size 16KB
SHA256 cc50b39131f18537f67e8b846346ff51e83f723f4da0eed1d78518702003266c
MD5 d97adc6642ee0b2f3b1cb504e1fb0b9d
SHA1 e8222b0544b74cb626855b70061cf20a9bbb334d
SHA512 8f9fe8397943429c021f33d120deccca4a872ad07fae1e2498c457ccbc5ff25be611fd5ce1a36d910a671a46cb64ea6a66889091c39678a715acad5d8bfb3b86
SSDEEP 384:z3+OBqImmJvGBLx3NaFMJFRNbYlKfvMczfWlj5hg6rs:KcvGtlNU8TfWlj5jA
TLSH
T19B729C6B28786B332CEBD609BA8D27478B601293C0E56FD9CDED8F0E516F1D81352D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ecc2bfffaefd492b068384331e1e1c2b9676092c846111429f5a603d5037427b
MD5 adfdb34d265c354e716b6fa2bad355df
SHA1 0d549ab28f3ea96e01bf1e67096c59f616629a12
SHA512 38baf36d895d7adfd38a5c496188da90de34506c390ad7594080d451fbf97bdcde999551637bce889579982eb557be6ff5c74cd1edc9fcc852f06b4dd17cd43f
TLSH
T1D0D0045DD5455004C0351D7150155104130044410111714C001400441D54050101171D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 29fff78353c5d0c70bc9b7d7dde86ff6f49b0e2b821b506788c9bc1a2bb77473
MD5 2964b5435723aaddff4a7e8fb2636603
SHA1 ebc70c24d3daae0a69098ee1ecc37e3b3e93aa9b
SHA512 fa700076ec6ef9c4b2752df714945d5edab2b40f1807c77512768126a9079ba1e71f6965bec1268ac42b8e568bcbe6a06d27715bb692ed53f4fd832592da3c58
TLSH
T151D0121B76424138C03029731003710C1500C10B41059048542C855D2F180A01912956
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 e969c74acfc7c77334e8ae2ef50875b4c6962d52aa6f9e071567a786f140701b
MD5 3950df842b9f8b384c0a6402a249458e
SHA1 f446455d207368cfdac3b7b29c8fbc869e655f41
SHA512 dbd75bb471b423d65b96297bca21e862f8c3d52450485793234f2171b3e71adb8549543ef7408ac91cc80806a84b2c3c880a7f9e49c9b35a3d2eb33ad20bbd3b
SSDEEP 3:LstlNllkll/lHZe:LsX3lEtHZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

c6891d18-928e-4867-b0d2-fa27b28aaf6a.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\Default\Network\c6891d18-928e-4867-b0d2-fa27b28aaf6a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e71fa25c-d6fe-4e34-893d-749ea0f68a3a.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\Default\Network\e71fa25c-d6fe-4e34-893d-749ea0f68a3a.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\Local State
Size 1KB
SHA256 36e3f78bfd9cf19196395448536c0089d8139a62bdc8dc4b21846f935af901f0
MD5 e6f21a165cc9fd74cccdb54719be1afd
SHA1 82bf935512861a1bf757d6e443d3479221c8fcc1
SHA512 a900c9b32a7dba2489958333845f1e9bc410f02fd5058fe641d3f0c8982a80766df710c8342fc97220aec610aa8eaae07f59edda93282d578509c8c0a920be51
TLSH
T149216573D4A0BA7259446645AB4977872E20416590205E8C92CE470D52EB5DD9733C33
MD5 SHA1 SHA512 TLSH

Submit Download

bf452864-42be-4f02-9c68-bcc71193df56.tmp

Path C:\Users\Admin\AppData\Local\cx.skybound.hangar\EBWebView\bf452864-42be-4f02-9c68-bcc71193df56.tmp
Size 3KB
SHA256 9a71a11bfc4c884e1e72134c1fc9491f31bcff5cc2a03db2c11b5f2fe0a278a8
MD5 8f26f12e98d8ef856ace4bbddb403bed
SHA1 1c644fbc2db22fe03248e4f116aea0b56095353d
SHA512 ffc5d641fd858389ef2d1bda82f2863b971777d2734aa099883a1eb3623aec26cbab07e2460259bb15de8a5cc4193816116fbd46e14cca67a66b55349ad33ed0
TLSH
T15171A872A874EA374EE6AA44BD892B12B7654127E4D03FD9CADD0F0C01EB3D82352C17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1684-521-0x0000021A73F30000-0x0000021A74053000-memory.dmp

Download

memory/1712-121-0x00007FFCAEA20000-0x00007FFCAEA21000-memory.dmp

Download

memory/1712-257-0x000001F501E00000-0x000001F501F23000-memory.dmp

Download

memory/2184-102-0x00007FFCAF760000-0x00007FFCAF761000-memory.dmp

Download

memory/2184-101-0x00007FFCAF970000-0x00007FFCAF971000-memory.dmp

Download

memory/4408-256-0x000001F08DE00000-0x000001F08DF23000-memory.dmp

Download

memory/4408-36-0x00007FFCAEA20000-0x00007FFCAEA21000-memory.dmp

Download

memory/4408-548-0x000001F08DE00000-0x000001F08DF23000-memory.dmp

Download

memory/4612-497-0x0000027D78550000-0x0000027D78572000-memory.dmp

Download

memory/5244-522-0x000001D38A0D0000-0x000001D38A1F3000-memory.dmp

Download