e483f2499eccff905e7b92bc7f766b18082f57dafac482dfe0d0bd955712dca3

Analysis

max time kernel
38s
max time network
44s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XChat-Windows-x86_64.exe
Size 12.6MB
Sample261023-vdc6kae18l
SHA256 e483f2499eccff905e7b92bc7f766b18082f57dafac482dfe0d0bd955712dca3
MD5 c21893062bfd00562b2bd3b22126c9db
SHA1 73ebca05ecfae37326bc1c8c380e0340a64523e6
SHA512 1933b46cb7c9cbcd55778a6ac5eb0a2f9acbf679515aa0ea60bfe8e0739ba78eccab2c4e79bf4a9d2cd90c3681002718efac441a7b52fc80cda3bb0076b6bc7e
SSDEEP 196608:H4MyYDDTgGZvGLDW7a93Uvx3/7Y36veXC4ncnfdn3am+G/mb0/rKABS:rJDngU7aEpkpCicnFnKW/OqOAM
TLSH
T182D61261FE42D0FFD48A01B5E43EF73DBA3692958B2A89C346A94C586CE13B0591335F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 27 IoCs

flow	pid	Process
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe
12	5944	XChatLauncher.exe

Executes dropped EXE 2 IoCs

pid	Process
5380	XChatLauncher.exe
5944	XChatLauncher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XChatLauncher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	XChatLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	XChatLauncher.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XChat-Windows-x86_64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3948	XChat-Windows-x86_64.exe
3948	XChat-Windows-x86_64.exe
5944	XChatLauncher.exe
5944	XChatLauncher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4228	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5944	XChatLauncher.exe
5944	XChatLauncher.exe
5944	XChatLauncher.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 5380	3948	XChat-Windows-x86_64.exe	89
PID 3948 wrote to memory of 5944	3948	XChat-Windows-x86_64.exe	90
PID 5944 wrote to memory of 4228	5944	XChatLauncher.exe	92
PID 4228 wrote to memory of 2508	4228	msedgewebview2.exe	93
PID 4228 wrote to memory of 3836	4228	msedgewebview2.exe	94
PID 4228 wrote to memory of 3836	4228	msedgewebview2.exe	94
PID 4228 wrote to memory of 3836	4228	msedgewebview2.exe	94
PID 4228 wrote to memory of 3836	4228	msedgewebview2.exe	94
PID 4228 wrote to memory of 4156	4228	msedgewebview2.exe	95
PID 4228 wrote to memory of 4880	4228	msedgewebview2.exe	96
PID 4228 wrote to memory of 4880	4228	msedgewebview2.exe	96
PID 4228 wrote to memory of 4880	4228	msedgewebview2.exe	96
PID 4228 wrote to memory of 4716	4228	msedgewebview2.exe	97
PID 4228 wrote to memory of 4716	4228	msedgewebview2.exe	97
PID 4228 wrote to memory of 4716	4228	msedgewebview2.exe	97
PID 4228 wrote to memory of 4716	4228	msedgewebview2.exe	97
PID 4228 wrote to memory of 4716	4228	msedgewebview2.exe	97

C:\Users\Admin\AppData\Local\Temp\XChat-Windows-x86_64.exe
"C:\Users\Admin\AppData\Local\Temp\XChat-Windows-x86_64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\XChat\current\XChatLauncher.exe
  "C:\Users\Admin\AppData\Local\XChat\current\XChatLauncher.exe" --veloapp-install 1.0.1
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Users\Admin\AppData\Local\XChat\current\XChatLauncher.exe
  "C:\Users\Admin\AppData\Local\XChat\current\XChatLauncher.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=XChatLauncher.exe --webview-exe-version=1.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5944.2876.8687643158416471986 /pfhostedapp:4cf6d9444db04617075e7af7cd39e867a4fe82b8
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView /prefetch:4 /pfhostedapp:4cf6d9444db04617075e7af7cd39e867a4fe82b8 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff8c6b5fd8,0x7fff8c6b5fe4,0x7fff8c6b5ff0
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView" --webview-exe-name=XChatLauncher.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1820 --field-trial-handle=1824,i,12167598193312987671,8600968868411442869,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4cf6d9444db04617075e7af7cd39e867a4fe82b8
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView" --webview-exe-name=XChatLauncher.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1824,i,12167598193312987671,8600968868411442869,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4cf6d9444db04617075e7af7cd39e867a4fe82b8
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView" --webview-exe-name=XChatLauncher.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1824,i,12167598193312987671,8600968868411442869,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4cf6d9444db04617075e7af7cd39e867a4fe82b8
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView" --webview-exe-name=XChatLauncher.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3504 --field-trial-handle=1824,i,12167598193312987671,8600968868411442869,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4cf6d9444db04617075e7af7cd39e867a4fe82b8 /prefetch:1
      4⤵
      PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Update.exe

Path C:\Users\Admin\AppData\Local\XChat\Update.exe
Size 3.8MB
SHA256 b933eb7c6aeed71133f9b1978386112972cf223ac989b9d420cd5531cfaf9998
MD5 8fc5a82bab1752fdbd46a9e6df70d197
SHA1 4e32df5c2e8eadfec022a5336fc486799643df6f
SHA512 14ff5e7e401e486dc9fe2f1070d840b4d777aa531afc0f2d6f00b267f6a56afbc7da6d3cf7ab7a01a5fdd611312448e0df99bbd56e77b268a9ea4f8d704156a7
SSDEEP 49152:90z1f+viTnGsRHs8jVrr3TZlzW1qmHVpFkSZDvsp:K+v0ntHsOnaH1vs
TLSH
T14006AE62FF42D0F7C48A01B6E42DF37D9636A2558B6A85C392A94C4C6CE13B09C5739F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XChatLauncher.exe

Path C:\Users\Admin\AppData\Local\XChat\current\XChatLauncher.exe
Size 16.9MB
SHA256 b1b218f33ff360a3699cfd5a0600f3e0e0f8ba0a4195c77cf1b223c0191439c0
MD5 f49c93d5553acee6a3ee565fd353b494
SHA1 57c6f0360d36193ce043f14e75bdd9643f276566
SHA512 82062787db169949f389dff14d08bf0591bd6d44e1b206f36e172de4c572d874beddff06b9c1ed6bdbf158f28a1e39b7594c30960fa17764ef045a33d4411209
SSDEEP 196608:cKxJ1LnDIEUCyurWRdZcQ58XCDLxgadm0:cKxJ1LnDIEUCyfp5UCDFgl
TLSH
T1F607F7217B5A99ACC09AC47483478A725A7130CB0B35B9FF44D892393F6DBF56F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\XChat\current\sq.version
Size 565B
SHA256 1c8d1b63f44fb18da2f4a2ff93fd6dc8dd55b38aa12df61ee1b892eafb6bf684
MD5 db0b9bc624fe171b430cafd3aa363477
SHA1 1baaeeeaa68c2c870adee45e80dd979af7d11412
SHA512 3cc50dcfdbc70e75a6fd01411b5f91929b511fa7f4396bb8eefd095442b22c6d677042257f40228d9be4d1b409fa3c657675afc48f6b7ac66d00a25cdc1a5791
TLSH
T104F0EB90A240E70E86466A6644D94200A7FB7AEE5CC44460DCA94C2D73C92CF8C3FAA5
MD5 SHA1 SHA512 TLSH

Submit Download

XChat-1.0.1-full.nupkg

Path C:\Users\Admin\AppData\Local\XChat\packages\XChat-1.0.1-full.nupkg
Size 8.2MB
SHA256 eb5423f5bcee6d8d14e41fbbdaa99732f175b7fe664894ba1a71c90796dab578
MD5 ad05b2c227dc8603d6dba01b5d9d6c21
SHA1 da136253c39f6789a29f7e8dedf9347d8430c1c4
SHA512 e36d357e24bf35bcc71a8c6e3f98c357e8542ddd8b377383333baecadb22f5b4d55707ee434955d3d8be982a618613b3232776a821a1f747b429d6c7dcfb271d
SSDEEP 196608:4LDW7a93Uvx3/7Y36veXC4ncnfdn3am+G/mb0/rKABS:R7aEpkpCicnFnKW/OqOAM
TLSH
T16696332411F293C6B3EEE6069C38669EE555B83029F7F60BF5C9E3369E06CF147460A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63c50965-1d22-4ffe-ae64-6f1f7fdea0cc.tmp

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\63c50965-1d22-4ffe-ae64-6f1f7fdea0cc.tmp
Size 2KB
SHA256 b5a6a0e5d89953d2ca714b1e884da02f43690818732714c75bb80b9c27c829a8
MD5 8e988de9c013be219938d0bb76e890a6
SHA1 a1989eb1039357451fc68089797bcd6f90dc0755
SHA512 bdd6b7a5f86f2d72f699498a4cf0c553a4fb20485ec3799b0efb30f4b0b65191e7bdfa44cae0a46fa953374d23f6af986c578e8bfe3e5981914a8068ea736ae5
TLSH
T1A7518333AD247A3789E28A54B8467F27DE39509599723F50C5EE0B1D01C3A5D2342C77
MD5 SHA1 SHA512 TLSH

Submit Download

9d809983-9c3f-42a6-bc0b-75d29426ccff.tmp

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\9d809983-9c3f-42a6-bc0b-75d29426ccff.tmp
Size 3KB
SHA256 8c66de17f2dbb8837b7886bdd68760d4d0b5c1919b2e0f0a864f6d793da9b384
MD5 4f5c98a350e5f777618f25072e6bf5fa
SHA1 97b25245d3f9858b0bdfcf91cfe7f08898c775f8
SHA512 3ff1288ef03fce0f43eebb733eac2f88889337ae9a2ecf3aac8ab556f0760b0e764a4db181d2a6f2eb7503ee8ef638c32d09c231d7da7743def0ca919e5f5384
TLSH
T10F617332A974A93B8DF3DA45B8863B17EBA55067D4A23F94C5ED0F1D01C76882382C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 14afd60c07b6f10ffae70019d8197ced5c7c72c76dc70d1e2eae97df00971f73
MD5 ae11f41fa51fc097abca86e1638507b2
SHA1 750da45a47897372c4c9608e5ec986e2c5476ec0
SHA512 acd80aed78f79de681cae277307c0810e973667a80c990e257eb83a8d57ebd76a04a86c732b7f2d1deedefa98d2cdd2c384b233024bf1dcec7ae628dd4a64107
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5d52a1c33f39fc1e42d2f62af3dda3c389ad750ac341a2f2c0a669cb18cfa69c
MD5 bec7d0ea48d14322e4b80db7fc968c95
SHA1 d66f4a06b8de346d647f4e8f4b00ef2b950c52b0
SHA512 7df24d91e4ade09803e2148955de092e64ef3ecdb84911f0e19b33cbf77a464b066167f0967e6b2207e488c4e5ebe39da00851d38974569c2303c19396c0c8b2
TLSH
T1E5D0121333220938C0102073041B61590441C60B404D40006879859D5B084940903451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 5967a1e88ec26ee9e271837117d8b7b9634271d6bc8a2c3db20a210b86c4032c
MD5 3a3a30e3cde8bf8c8d7d38734b5742e5
SHA1 fd21dd979c16f0916a11ee62a8e9e173aefc2e83
SHA512 5ed98df8ac8fe2cc2186c6d0e0f6994a6d8a8fd32f25659d035da5d61516dc6dbb1043332f7ed5e663f6b57363cba89eb8bc9a0c8509f825de4696090faba3f0
TLSH
T1BEB00234465D5585C744D174D5D6A67871351C5401B35B118A7351758415FD35167350
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4393ba4f0f596842268eb2464db72258edc6b94b3f8e151a3ee022188e41b5cf
MD5 dcaa15e91c85a0dec68d8c36e7245357
SHA1 819fd083a956460f4ee44a2df320656c8f19dc15
SHA512 2d19319141f62fc9011ab52771692f7dd8262118dcb1cd59f15189568ee5f9d7574ca11fe7df867215db26b2181dfd5c3e49e5c626c7e294dc729555df9170dc
MD5 SHA1 SHA512

Submit Download

d1a778c3-f352-49ec-9490-5f845c2a67f3.tmp

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Default\Network\d1a778c3-f352-49ec-9490-5f845c2a67f3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\Local State
Size 1KB
SHA256 1cf866d590e581128e8d3f9f8be503386170a578480eecea4f872c3777e93b92
MD5 7b9b0ba19def7355d10fcd3e80e9f62d
SHA1 2cbe1075b6e3f8fa9fe6c8f69de7e57d00157927
SHA512 456c69cbc715ee86a2bad78f17cf1fd92a19a931387dca5fb0d91329d8d795e6fda6f72d7d3af9a4f9b4dcd897e5535a25a6648a7cf75df66f30eef5a48a0c81
TLSH
T10A2145B2DA742B329C92AB866152BF5B9E30119781215F00D0EF4B2D41D354DA26BC33
MD5 SHA1 SHA512 TLSH

Submit Download

c97c3773-d399-4bb1-8607-ea0d1e07db53.tmp

Path C:\Users\Admin\AppData\Local\com.xchat.launcher\EBWebView\c97c3773-d399-4bb1-8607-ea0d1e07db53.tmp
Size 15KB
SHA256 062bca60ee15a2b479f80916ef738e991dddf67fda8bceafcd032358d6b8b0bb
MD5 0d52fc1df197fb9f4934b8e62e4c256e
SHA1 5a931e7e5ddffe4c308851ee088b4f81aca50227
SHA512 a956710c33d65ac73552c9eb83102c58d97ba8442f3a85fe83ca4bd6c58c9126fdf06964f95618cf0d2582a7e600c173ed89f5f2ed11100062b8723f81655595
SSDEEP 384:n+OBqImmJvGBLx3NaFMJF3NBSyzJuAwtg6r/:2cvGtlNhdwX7
TLSH
T13C72AE762C656A332CF7CA09BE8A7787CB616293C4A17BD4DCEC9F1F112B4842352856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3836-46-0x00007FFFACDB0000-0x00007FFFACDB1000-memory.dmp

Download

memory/3836-248-0x0000023CE7E20000-0x0000023CE7E4F000-memory.dmp

Download

memory/4716-133-0x00007FFFACDB0000-0x00007FFFACDB1000-memory.dmp

Download