86653bcec5854e7c4c4a51eb62777559d8c476831757ea042b16fe931680844a

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SmsM-v2_Slayed.exe
Size 4.3MB
Sample261023-h2watscd73
SHA256 86653bcec5854e7c4c4a51eb62777559d8c476831757ea042b16fe931680844a
MD5 f7255af4302c36347cb8be3d841e855d
SHA1 4f181b54ceb062742caf6e9fc29324d2254260a4
SHA512 4d01436c7a0b1cb26249be151007a2b23ed744ff5d511c616be5d52742e3896f25d83d4e309a6bc681d16f49eef3abd69980d7b088942398133de04cd2b21527
SSDEEP 49152:MhPJOd3hOVHloU2gce/5FpuTmsZBS+3XwiklnxuzI:SPJOO2EXA7G
TLSH
T10B268D2323E84126E6F76B39D4712260EE76FC17AB3ADA5E2465411D0E73B90CA75333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5560	SmsM-v2_Slayed.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SmsM-v2_Slayed.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_649327583\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_649327583\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_845181498\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_845181498\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_649327583\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_649327583\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_649327583\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_845181498\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1305807536\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_845181498\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1305807536\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1305807536\protocols.json	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SmsM-v2_Slayed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SmsM-v2_Slayed.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5560	SmsM-v2_Slayed.exe
5508	msedgewebview2.exe
5508	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4576	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5560	SmsM-v2_Slayed.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5560 wrote to memory of 4576	5560	SmsM-v2_Slayed.exe	89
PID 4576 wrote to memory of 3708	4576	msedgewebview2.exe	90
PID 4576 wrote to memory of 5992	4576	msedgewebview2.exe	91
PID 4576 wrote to memory of 5992	4576	msedgewebview2.exe	91
PID 4576 wrote to memory of 5992	4576	msedgewebview2.exe	91
PID 4576 wrote to memory of 5992	4576	msedgewebview2.exe	91
PID 4576 wrote to memory of 3512	4576	msedgewebview2.exe	92
PID 4576 wrote to memory of 6024	4576	msedgewebview2.exe	93
PID 4576 wrote to memory of 6024	4576	msedgewebview2.exe	93
PID 4576 wrote to memory of 6024	4576	msedgewebview2.exe	93
PID 4576 wrote to memory of 5684	4576	msedgewebview2.exe	94
PID 4576 wrote to memory of 5684	4576	msedgewebview2.exe	94
PID 4576 wrote to memory of 5684	4576	msedgewebview2.exe	94
PID 4576 wrote to memory of 5684	4576	msedgewebview2.exe	94
PID 4576 wrote to memory of 5684	4576	msedgewebview2.exe	94
PID 4576 wrote to memory of 2996	4576	msedgewebview2.exe	98
PID 4576 wrote to memory of 2996	4576	msedgewebview2.exe	98
PID 4576 wrote to memory of 2996	4576	msedgewebview2.exe	98
PID 4576 wrote to memory of 5600	4576	msedgewebview2.exe	99
PID 4576 wrote to memory of 5600	4576	msedgewebview2.exe	99
PID 4576 wrote to memory of 5600	4576	msedgewebview2.exe	99
PID 4576 wrote to memory of 2240	4576	msedgewebview2.exe	100
PID 4576 wrote to memory of 2240	4576	msedgewebview2.exe	100
PID 4576 wrote to memory of 2240	4576	msedgewebview2.exe	100
PID 4576 wrote to memory of 5508	4576	msedgewebview2.exe	101
PID 4576 wrote to memory of 4844	4576	msedgewebview2.exe	102
PID 4576 wrote to memory of 4844	4576	msedgewebview2.exe	102
PID 4576 wrote to memory of 4844	4576	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\SmsM-v2_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\SmsM-v2_Slayed.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5560.2660.3949519305438790674 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView /prefetch:4 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdbd8b5fd8,0x7ffdbd8b5fe4,0x7ffdbd8b5ff0
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,14952916037031393226,18339777826137613187,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2384 --field-trial-handle=1756,i,14952916037031393226,18339777826137613187,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2428 --field-trial-handle=1756,i,14952916037031393226,18339777826137613187,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1756,i,14952916037031393226,18339777826137613187,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1 /prefetch:1
    3⤵
    PID:5684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=1756,i,14952916037031393226,18339777826137613187,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=1756,i,14952916037031393226,18339777826137613187,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4568 --field-trial-handle=1756,i,14952916037031393226,18339777826137613187,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4416 --field-trial-handle=1756,i,14952916037031393226,18339777826137613187,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView" --webview-exe-name=SmsM-v2_Slayed.exe --webview-exe-version=1.0.29+103d6aed9fdf514a1c7230759ef86b0b196fe986 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1756,i,14952916037031393226,18339777826137613187,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:41f804075bf0ddc24f2bca35d45eed933f411bf1
    3⤵
    PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smsm-logo.png

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\Ui\1.0.29.0\smsm-logo.png
Size 1.6MB
SHA256 b587e76cd60f60fd6f635aaf757af0b4a5ea00da8d4e7b98c1f448d5ade54f56
MD5 eb7f2a78270fec8f7b5fc30ddb29d9cb
SHA1 3a494874d72b0b6e5e2125cb8272fa43dcb7054c
SHA512 18ca72f3996dd480d74ef5383f51c04936a99e253d014f05ea3e8cdc348cc1563cce42e6b2c064bc2c8ccac60d23a26fd723b561c0465c07e6b6fce7e0955e02
SSDEEP 24576:tTcsb7D5NoiYWc5iuazy12vQ8DKZ7dS+N7YgEgrZCiKJNlnzVGpmUmMVIMrv:hce/5FpuTmsZBS+3XwiklnxuzIw
TLSH
T1DD7523F275378681D1D7D17EE41A3A314F3A2156ABC5002194FED2F761B8AC8863BB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.html

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\Ui\1.0.29.0\ui.html
Size 79KB
SHA256 912101213baca352805452f261cf0a9bcc14f1a63429d7783e82d83abbf67c51
MD5 1e90a97f0225c8ad26be7279f8d48062
SHA1 2f595dac30424690298b1e8f1b58ac3766373494
SHA512 93def24e65a4aa37367c48b890e860d0ef53b2154d7d434d660a6dcaafa05f0cf2b724dba1280c4e47fe5fa32bbcd58769ec56a0154306d66c14e25b4c682b6d
SSDEEP 1536:2UM0NwoA00rUwZ/6Ezhz0vC/twyVfVjUMHyudNGQ:ZpoZ5ZHQ2tOMHLdNj
TLSH
T1E283F9B3316500311A67D99FE0D7638DF031D813DA07F120BDAD56618FC7DA2AA2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2Loader.dll
Size 190KB
SHA256 3426dcc55fdfb8b5e7ac623cf33b4ccf283fbf68a0c5a65bddfdb4d749a8abee
MD5 f1426c839cbf0e9a4eae7c67916cedff
SHA1 60cdeba80ce6357d9598947bd65f2db31e5efa2c
SHA512 392d172f8e960a2d18d18175813e091c27d12065db06c4fcaabb6429bbb1306a3087fff33e51bf9226759b34d454109c11a310711ff9f7c6f9d8f78164b661f3
SSDEEP 3072:hJoWXgNjIFnTf75x2v/KUUbPXGUIufAuzA2dTZnaZED3JU9jfbKuFjaS3:LKI175Av/KLB9zz3nyED3JU9DKC
TLSH
T142145D06B3E940F6F976D67C89A38A46F67278110710AAEF0360473D5F2BBD49A3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cfdac51-b78d-4f8b-ad84-8fd1a707f158.tmp

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\9cfdac51-b78d-4f8b-ad84-8fd1a707f158.tmp
Size 3KB
SHA256 e61a9cdde514cce4cdb9568f32fea0158fe2d20cbfc7ef55f11b5135226a5973
MD5 279f538ba482edc7958dffbf087bde6e
SHA1 d15374fa9b0c27c266b624b3a1cb9febc4b7fc85
SHA512 92b18db0a36f532eaaa47891c8c4bc6c689d68a6ccce4f6e58038bbbea0755bf5da655edb9464c53944838873d6229e786fe563196c797d65f47415af22350d7
TLSH
T18161963769B4AA3B4AE2EA49B8867B16A7A65023D5913F95C5ED0F0C01D73981341C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5a6a668a107c759512a5906abdd8d42095316be59b665d3a94c892ea5e43574c
MD5 e1308a0ad2bd2cd2bc76478ea80091b1
SHA1 0320545ec913e356f79e6b7f7f88628101bee578
SHA512 4853fc03724288b85fc80ed6e76655bd540b0e375f8674d645d2f8ef22991bacc3b52bf9bafc88519ca5b1a6af6215a63cd6a013cf7dfff51530a4086f17857f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 248662852d67262e766d5604770107032ca18cc688e799a9ea2b2c6d3808a387
MD5 094ad0610692283faa9ee070a28f631c
SHA1 d1c07ddd3e96f312937d6d22f4575c89ab24359f
SHA512 f1c1028b293538ddb18057bb4b1312292bd3ba2faf3437f45b900706d340aad1c954ccfa2b909b2d441a51059e750fb8390593983f0dd095167c169d774f6ca0
TLSH
T1C7D0121632120134C414303B5113A30C1842D10F424AC0086428CA1D1A440580907441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

5d21fe70-06a0-4923-ae7c-79300dcfcde5.tmp

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Default\5d21fe70-06a0-4923-ae7c-79300dcfcde5.tmp
Size 6KB
SHA256 33067adedb713d4fcd21b0d3ec9e2d6494ea551cee31cd19005a1e6b61b07bd2
MD5 2e3771a7f58181ff2627d5a08af8bbcf
SHA1 6528d5531db3d0759e3b1bedbe2e17fae563ca7c
SHA512 0da56adae313fd59b28ce53eb22b3172dfcd6708c490d2b0be9e55c40f28e0e505a43087da03898317349d78d74feb16a422e2d1edad2a989bdb8a17fcfea0a8
SSDEEP 96:stQ/doaLlgtb9Pkxvo5h16ZCzs7/x+6MhmuecAe011ejeQK+ga+28XM1C7K:stE1GMvoXzsV+Fce01Qj0o+G6K
TLSH
T164D1C7015E64797B8CCAF149BA39BB12E2FA507260D41E58EBFC461C08DBADD6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

681e4c77-40ee-4849-b5a8-7349c8ea9aa0.tmp

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Default\681e4c77-40ee-4849-b5a8-7349c8ea9aa0.tmp
Size 6KB
SHA256 aaa56f81ed861c65df0e72866955585c62310829bdee7ff731dd5eee7f29c6d7
MD5 4738b6afea569e9fa58918e5247a0e5c
SHA1 d30bec9cd2d818afe1d6942ba49ee7f24eabbfcc
SHA512 4bc25b1b3a922c359eadb7704f9eeaab0d85c16af114ab8249dacf398054043b5f090df2b2e6196010db23fb2adec7b8b3f95dc7029a277f91ae6d1940c40b1e
SSDEEP 96:stQ/doaLlnGtb9Pkxvo5h16ZCzs7/x+6MhmuecAe011ejeQK+gX+28XM1C7K:stE14MvoXzsV+Fce01Qj0V+G6K
TLSH
T134D1B8025E64797B8CCAF149FA29BB12E2F6507261E41E58E7FD451C04DBADD6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d11b1ac-071c-474f-9679-928ac717de9c.tmp

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Default\Network\9d11b1ac-071c-474f-9679-928ac717de9c.tmp
Size 821B
SHA256 59ce2cf03310ccc41d0a0177de2c3df51f37b2799025a98b57c9d6752f712913
MD5 d36ddd83d3723faf430b5b1feebfa0e6
SHA1 17f6913b4cb608f9b6bf6112673294013366799d
SHA512 7a9eb60da60070760a270bc20efc64d4040c710a86f43bca1a4c5526851e57d408982610ded0b7f35c503361dad9658ba90a65ce58c7c864d2e4730f97825f71
TLSH
T19D01CEE2C3E486BD8D5103F62A253863CF1E081802283C56CAD5AFCB53E1075830446F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\Local State
Size 1KB
SHA256 6913fdf907e31d74d0d62c453b4fb974e0573892b25b2951e643163d17dac43b
MD5 7f9e3f5a99d99f6856d0030d1b8aa5df
SHA1 b3dc34d6c4743d49ac89a7a57c3c1253ca2b3085
SHA512 85fd13342567b0f013d4d5ab4a802d19520e26ba07af021dcc829b8726179555e0f0f3b7c43a137d48d3a5c89603ee2abaad428bd20be70f82b423ccc7a57bfa
TLSH
T1742165B3A4E45B37999172DE3007FB675E335067C1608E0091DF471802EB59C9A2AC33
MD5 SHA1 SHA512 TLSH

Submit Download

bab5b7aa-cd0d-454f-96d2-59a9ea7a64ea.tmp

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\bab5b7aa-cd0d-454f-96d2-59a9ea7a64ea.tmp
Size 2KB
SHA256 947d868a296d99bba11f2d7622e1ba326eac3c55eb6fe9992f7e9aa0a472634f
MD5 2869756a439866138ef9114f4a7334b8
SHA1 39a6c21a7287130c4dfa54eee1d0d09610c84e3f
SHA512 7ff6f0c921450dbe5585074366b347c7a392ef155992e0fc7f9301b16338adc1a25aa46d961bfa5d1076b019fcecf93c11fac6a20004a71f6f9fe7c1618c6fbf
TLSH
T18551A7736854AB3B86E2AA8D784ABF23CE3791A2D6611F5095DF0B1C01DB65C5701C37
MD5 SHA1 SHA512 TLSH

Submit Download

cd6963b7-4add-4500-aa13-771918b8e270.tmp

Path C:\Users\Admin\AppData\Local\SMSM\SWYF-Installer\WebView2\EBWebView\cd6963b7-4add-4500-aa13-771918b8e270.tmp
Size 15KB
SHA256 3299f514d5dbb813ec52fb7dfadc71f6c33bd3f8d666894d3c1694cba0c54a45
MD5 8dfa3aa68bd60753daec638eef5f4a91
SHA1 271786db8fa8aeb280b0117737d821ac501330c9
SHA512 605a1345d1eefe2c18647d49c6ffa7066261c2a9aab2af55d7b173d37d01215d1a76de159cf295f3d14b1b37db519024869fbbc191a84572d4e18cedd6d5bbb1
SSDEEP 384:r+OBqImmJvGBLx3NaFMJFNNBSxbXslv2g6re:ScvGtlN6clvga
TLSH
T1FC72BE771CB55B272CE7C949BA8D63478B35A293C0D07BD9DCED9F0E022F4440352806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1305807536\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_1849511679\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_649327583\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4576_845181498\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2996-289-0x00007FFDE4490000-0x00007FFDE4491000-memory.dmp

Download

memory/2996-288-0x00007FFDE3EC0000-0x00007FFDE3EC1000-memory.dmp

Download

memory/5508-387-0x000001BA80CA0000-0x000001BA80CA1000-memory.dmp

Download

memory/5508-388-0x000001BA80CA0000-0x000001BA80CA1000-memory.dmp

Download

memory/5508-389-0x000001BA80CA0000-0x000001BA80CA1000-memory.dmp

Download

memory/5508-390-0x000001BA80CA0000-0x000001BA80CA1000-memory.dmp

Download

memory/5508-391-0x000001BA80CA0000-0x000001BA80CA1000-memory.dmp

Download

memory/5508-392-0x000001BA80CA0000-0x000001BA80CA1000-memory.dmp

Download

memory/5508-381-0x000001BA80CA0000-0x000001BA80CA1000-memory.dmp

Download

memory/5508-383-0x000001BA80CA0000-0x000001BA80CA1000-memory.dmp

Download

memory/5560-10-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-220-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-239-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-8-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-7-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-6-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-0-0x00007FFDC307F000-0x00007FFDC3080000-memory.dmp

Download

memory/5560-9-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-5-0x000001B8FA1F0000-0x000001B8FA3B2000-memory.dmp

Download

memory/5560-4-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-3-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-1-0x000001B8F75F0000-0x000001B8F7A36000-memory.dmp

Download

memory/5560-133-0x000001B898530000-0x000001B898A58000-memory.dmp

Download

memory/5560-12-0x000001B8FD6E0000-0x000001B8FD78E000-memory.dmp

Download

memory/5560-11-0x000001B8F9FE0000-0x000001B8F9FEE000-memory.dmp

Download

memory/5560-19-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-22-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5560-2-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp

Download

memory/5684-132-0x00007FFDE4380000-0x00007FFDE4381000-memory.dmp

Download

memory/5992-131-0x00007FFDE4380000-0x00007FFDE4381000-memory.dmp

Download

memory/5992-238-0x000001C89FD20000-0x000001C89FDF3000-memory.dmp

Download