36650aee175abefe6e2bc3dceb1d41e2de2efc5162d186bf18149c952f6cba02

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe
Size 1.3MB
Sample261026-s8texsbd76
SHA256 36650aee175abefe6e2bc3dceb1d41e2de2efc5162d186bf18149c952f6cba02
MD5 b0b194dda9ceef69043449dc4bb31e91
SHA1 437c35aeedc2b2da3b8e0887c10acb9365cec295
SHA512 73ca0619aeca6ff3ac0caf7b2d357cb14d6d360d6245a2dd07ff7f4a54f39acac9232ba4ed557c115550923788e5ce21945af1bd799c6eb5aad023e3eb92bbcd
SSDEEP 24576:O7j6FUZ+02J4dCXzRKX4EcJAD1RrQTX+xYD:iQh3JOTxY
TLSH
T15655E71533E8515EE4F3AB7599740D60ABB6BC977B3AC34E0196116D0E2ABC2CE60373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery trojan

Malware Config

Signatures

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
behavioral2/memory/2900-1-0x0000000000990000-0x0000000000AD6000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Loads dropped DLL 1 IoCs

pid	Process
2900	2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_2085571770\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_1363140980\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_1363140980\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_959135621\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_959135621\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_2085571770\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_2085571770\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_1363140980\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_959135621\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_2085571770\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_2085571770\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5692	msedgewebview2.exe
5692	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
828	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 828	2900	2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe	90
PID 828 wrote to memory of 4388	828	msedgewebview2.exe	91
PID 828 wrote to memory of 3736	828	msedgewebview2.exe	92
PID 828 wrote to memory of 3736	828	msedgewebview2.exe	92
PID 828 wrote to memory of 3736	828	msedgewebview2.exe	92
PID 828 wrote to memory of 3736	828	msedgewebview2.exe	92
PID 828 wrote to memory of 4264	828	msedgewebview2.exe	93
PID 828 wrote to memory of 240	828	msedgewebview2.exe	94
PID 828 wrote to memory of 240	828	msedgewebview2.exe	94
PID 828 wrote to memory of 240	828	msedgewebview2.exe	94
PID 828 wrote to memory of 2340	828	msedgewebview2.exe	95
PID 828 wrote to memory of 2340	828	msedgewebview2.exe	95
PID 828 wrote to memory of 2340	828	msedgewebview2.exe	95
PID 828 wrote to memory of 2340	828	msedgewebview2.exe	95
PID 828 wrote to memory of 2340	828	msedgewebview2.exe	95
PID 828 wrote to memory of 6020	828	msedgewebview2.exe	99
PID 828 wrote to memory of 6020	828	msedgewebview2.exe	99
PID 828 wrote to memory of 6020	828	msedgewebview2.exe	99
PID 828 wrote to memory of 1004	828	msedgewebview2.exe	100
PID 828 wrote to memory of 1004	828	msedgewebview2.exe	100
PID 828 wrote to memory of 1004	828	msedgewebview2.exe	100
PID 828 wrote to memory of 2944	828	msedgewebview2.exe	101
PID 828 wrote to memory of 2944	828	msedgewebview2.exe	101
PID 828 wrote to memory of 2944	828	msedgewebview2.exe	101
PID 828 wrote to memory of 5692	828	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe --webview-exe-version=0.0.0.0 --user-data-dir="C:\Onyxx Studio\browser\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2900.4504.2485940649789415547 /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Onyxx Studio\browser\EBWebView" /prefetch:4 /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Onyxx Studio\browser\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe7c885fd8,0x7ffe7c885fe4,0x7ffe7c885ff0
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Onyxx Studio\browser\EBWebView" --webview-exe-name=2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,8413403404375438879,8462237417549206647,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Onyxx Studio\browser\EBWebView" --webview-exe-name=2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2124 --field-trial-handle=1760,i,8413403404375438879,8462237417549206647,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Onyxx Studio\browser\EBWebView" --webview-exe-name=2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2508 --field-trial-handle=1760,i,8413403404375438879,8462237417549206647,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7
    3⤵
    PID:240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Onyxx Studio\browser\EBWebView" --webview-exe-name=2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3496 --field-trial-handle=1760,i,8413403404375438879,8462237417549206647,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7 /prefetch:1
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Onyxx Studio\browser\EBWebView" --webview-exe-name=2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1760,i,8413403404375438879,8462237417549206647,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Onyxx Studio\browser\EBWebView" --webview-exe-name=2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=1760,i,8413403404375438879,8462237417549206647,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Onyxx Studio\browser\EBWebView" --webview-exe-name=2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=1760,i,8413403404375438879,8462237417549206647,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Onyxx Studio\browser\EBWebView" --webview-exe-name=2026-10-25_b0b194dda9ceef69043449dc4bb31e91_glassworm_icedid.exe --webview-exe-version=0.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4552 --field-trial-handle=1760,i,8413403404375438879,8462237417549206647,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:3f63aaf11070b185e24a1b7fdee4e14e943868c7
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BloodyLoader.html

Path C:\Onyxx Studio\.ui\BloodyLoader.html
Size 52KB
SHA256 56579959aa8608e2acb9fc9b66346dcece63cb6f24bbe0cd97836e0850feccce
MD5 3cea203e2afcf0dc9cb34276b7a30961
SHA1 0990b88d8748e1ac752228a02366f080da008085
SHA512 5364f464d5b197dc8844997469cfbed5aef31bc2a4e06ddf904e8075047f1fd80480c4c7dc0c96e8a3921643e6c36a2a4e99a7e8d60d00a0394daef25bccb799
SSDEEP 768:jByk3BF8sFSk27zUxg4d+cTYVVUrxRwkJDkJ9WW5z7KPItqJ:5HD5+FExRwkJDkJYwtqJ
TLSH
T16F33A85AA5BB0536752355A92BEB472633759003D00ECA193FEC12988F8BBDDD9633CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1298d8ff-acf5-4c7c-b90f-6e001c2634d0.tmp

Path C:\Onyxx Studio\browser\EBWebView\1298d8ff-acf5-4c7c-b90f-6e001c2634d0.tmp
Size 3KB
SHA256 d2e1df2c623a73b11c1ddd84caada9461fb3aac9efb24a8392b962ed4813e951
MD5 e60873fb028bbfc0ba2284f421b6ca9c
SHA1 c528d473995b73ea152b180677cbd446abc3c44d
SHA512 16ed223785780b191acf28c0241ce8ac98607d838d30444f97c1f85659e8351b02d41bcfd9fb94f05292e6cc76231fdbb27415608001a8bfbac59b8477021667
TLSH
T11861A3766964AA375DF6DE14F88A2B07FFA65163E0813F54D6EC0F0C00E72982342C17
MD5 SHA1 SHA512 TLSH

Submit Download

27648356-5717-45b7-87fd-a15fbdffe912.tmp

Path C:\Onyxx Studio\browser\EBWebView\27648356-5717-45b7-87fd-a15fbdffe912.tmp
Size 15KB
SHA256 ee4c2dcd4ec7429d21e8f73f274715d6bfa9fa090376aac9242e1f6c5984e848
MD5 23d77f4bf214f933bc7669b8efcb2521
SHA1 ae1f15a52a8abb2d293c9ead3a2633b4e3456350
SHA512 a8cae71ec1a17f66ce58b7dc941bc539638719148fe3751bedd1daffee657b9554c3e4a0d8c2512352e795faea7c1b167bef8967533a73e5c524decceda2cfe0
SSDEEP 384:E+OBqImmJvGBLx3NaFMJFNNBSlLprNjqfmg6rX:VcvGtlNStqfwL
TLSH
T11072AE761C666E372CFAC909BE8E2747CF76A293C0907BD4ECEC9F0E416B4541352916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78d39778-55e4-4b10-93a5-1091d1493f60.tmp

Path C:\Onyxx Studio\browser\EBWebView\78d39778-55e4-4b10-93a5-1091d1493f60.tmp
Size 2KB
SHA256 dcd6ed9d976143227fba5beb8093d906ac9910064a9a33b13cc83f940106c744
MD5 932c22606fda9db12aab16f63d77cb0d
SHA1 9e9f44c07008ed7ccf9be6118f6d0d3fdac82430
SHA512 643df78ae3f65ef52b140b3160c0f6b69914a1d1b6205495d659686f2aa87e910a03748a8577bedb85e2fb11e9dff59869f6dd649c4bdf7817c7ca547aa2d2da
TLSH
T10B5163736814AB3799E69E18B94F3A13DE7A9192A6522F10E6DD0B1C00E765C2342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Onyxx Studio\browser\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 138d23fe0bb4f6dd7de138c496e4083af191d736fcfbc2c973b793bfb32c502c
MD5 76d78073ed396ec75791660b54aa7848
SHA1 2ae1e20581efd7acf0eff4bf247e92da5787405c
SHA512 0cd71d6babc7e5002d695b6052ce795e2dab68a126ed616935c6668959a369692bc0a4688aedc889e517073fb683be37ba659274f792e6a86bcb00543ee12563
TLSH
T108D00414D7415010D01355315014CF504101540070050F000070105535434145407D30
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Onyxx Studio\browser\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e29708006da1d6c4192577417d1dc0327d0a49452df4e37babb7c88b8eda11c1
MD5 01e022191a57403f3e834b455facf778
SHA1 e59638742cc7e9903d5a043b2729fe1906a9b22b
SHA512 3ed859b9b8e049b30dc90afe469650dd6b1d2f7b3b90c933e49c8d8f5e4abc1ee8524c9d914442518d57f26499e5236ab92dcfa342e89b593a8cd73b25b8bc05
TLSH
T193D01216B7424134C02325331002AA480401D10B900945005438956E3B054641D07C61
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Onyxx Studio\browser\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

227a8dc0-1b5f-49ff-9329-3028f2c3b0c7.tmp

Path C:\Onyxx Studio\browser\EBWebView\Default\227a8dc0-1b5f-49ff-9329-3028f2c3b0c7.tmp
Size 6KB
SHA256 5c37d542f78d3fd070436769489efb9f7490a9f51fa97f34130a4940eb9f4023
MD5 930ba70ed3237e140b246b2f0e5e79e1
SHA1 edc1984ad2138d9491e6ed8f17650191402fdc69
SHA512 ff92c997292873d154a8c46108d43e638d539e3a8e24652b46419de90d8ef8ec350e3b8b2bcfc9f7e8cf8793e2aa14c495b003cdc29471b35228b68226d4f76f
SSDEEP 96:stk/dTqPGQb9MukEo5h16ZIos7/x+6MhmuecCtJO1ejehK+gWub28XM1C7K:sto9FuvotosV+FaJOQjvsubG6K
TLSH
T161D185025B24797B4CCAE519BE25BB12E2F6A07261D51E58FBFC462C04E76DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Onyxx Studio\browser\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 92d04684336884469dd4dc789499f6d557e14c228b3ae7b60d7910a65c307f63
MD5 a7d331abe8be002cb10893904433b219
SHA1 06830ce92f63bab770157a3026aefc9124977ce8
SHA512 e24a9383c4d9315fc5c0e3905a3e8e65a5699f2285f97e8cc030a0cc36e3749d20af00e792246623b5b61ccc277885565f7cb2aeb06cce52c54cab09466d83cf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Onyxx Studio\browser\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Onyxx Studio\browser\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

585d3d6a-740c-4a99-b952-01eb910ef94b.tmp

Path C:\Onyxx Studio\browser\EBWebView\Default\Network\585d3d6a-740c-4a99-b952-01eb910ef94b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Onyxx Studio\browser\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Onyxx Studio\browser\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a9650afc-b6e5-46b0-b32b-a4861c579583.tmp

Path C:\Onyxx Studio\browser\EBWebView\Default\a9650afc-b6e5-46b0-b32b-a4861c579583.tmp
Size 6KB
SHA256 5e7201a325b7018e0915d4699464f8bc56f71ca139779d1e025e8b184ba828d5
MD5 9eb7c80f752307e1444ef992366007c6
SHA1 0232d89a1f0e45a01ce58f10b8508bcc12dfaf47
SHA512 1ae83c9a03f198a479b98c8e2df23be4c16fe3ac42a9237bb976b9ffeb7a09b1e678e02d7bc39aa13c1fd3f1a07c983ae7602cce3ede0860df0dfee2cc7c8734
SSDEEP 96:stk/dTq4Qb9MukEo5h16ZIos7/x+6MhmuecCtJO1ejehK+gUZ28XM1C7K:sto9HuvotosV+FaJOQjv+ZG6K
TLSH
T135D185015F24697B4CCAE519BE25BB06E2F6A07271D51E58FBFC462C04E76DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Onyxx Studio\browser\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Onyxx Studio\browser\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Onyxx Studio\browser\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Onyxx Studio\browser\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Onyxx Studio\browser\EBWebView\Local State
Size 1KB
SHA256 901e21ab076a83ce955812e3ec3a475900f6ac32c3aa21ee212e2f0c98fb1f4e
MD5 a0257c0de7788aba138df969770b06d7
SHA1 f45bfff7e86808543666ec19d357b55da90903c7
SHA512 a6100f364743334365290b355490fd7cbe5c667ec912d84c04284df981b7449cdb2943cd8896f3a08894b3d2184fdeac2300a60f89fa5ec243909d5add9fee8d
TLSH
T1BB2195F298A45B336CD5AA55B00B6A0BEF7311AB91114E04F1CD472D01E619CA62BC37
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Web.WebView2.WinForms.dll

Path C:\Onyxx Studio\runtime\Microsoft.Web.WebView2.WinForms.dll
Size 37KB
SHA256 cc3d2937c350a4f5e20399855bcab4fe695a395308feb2ed67394faa6a1ae849
MD5 256624e11fef500d49e0f421138884dc
SHA1 155e5a0e2d501e6aa4069d8662a757a7a9fa9066
SHA512 a2d1a7d9bebc6455e0e9ec76a08b8f5c97752d4129c00eb8383a8cc7767a9dc8803d81f5c751f1ed5f3c3787c5e63fc715dfd1323584a1274b32f5d954d92681
SSDEEP 768:yLQNb2vIYymJ22Mss+5ZQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxi:yob2vLbZQ+ZDgcEST3p4JjrjaeFSUyaG
TLSH
T12F033B4087ECC517E6EB5FB8A9B491610BBABEC37DA2D3980D84B1D90C73BD055113AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Onyxx Studio\runtime\WebView2Loader.dll
Size 159KB
SHA256 c66e4a92fdc7a216118e43b7a5024ea2200e8c43f9310bf20d96a0084f82c5bc
MD5 0243cb84351c92ddea3fc0334f3a52ae
SHA1 d80c01c98f0ed8af1be111abefcbbf6c9f3938bf
SHA512 74314c87eed82b1c9415462be3259a6626599047a18821cadc73c0c0c62cbd54948d6311ad4de9955fc2d4f2098ccb17aebeee8929ac2741bafc38ceb51a9585
SSDEEP 3072:d94EUQHTN8gVEeemaXpNbVf7W5AOVU9dPTwnhrEtJe6ub9VY/3A:3dzeDZNbbVf7W+cnhEtJC3H
TLSH
T194F35C57B3E500BBE1B7C234C9634A56E776B8115B609AEF03A4427A1F13BD0AE3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_2085571770\manifest.json
Size 102B
SHA256 4a918873dddefc4e395c8a9f8580c8f03c9a37512eb7da6e6454730be756fdac
MD5 bbd743ed25bbba94c85d6d7310c4fd45
SHA1 d19550c1895576761ab76f3ba9bb813511002bd8
SHA512 070aad3473150ba7388e2305f3d5dff14c69a4b468609fa38e1411e575d271d63cc1bf4083d63372b4d244ee5031bd40933f5f68f041c9650999509666e219e1
TLSH
T1B0B01220EC10B4B30004436C0C6CC3C073272F032C4079180DE59F84E90E9DBE071529
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping828_959135621\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2340-141-0x00007FFE9EC80000-0x00007FFE9EC81000-memory.dmp

Download

memory/2900-26-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/2900-12-0x00000000036A0000-0x00000000036AE000-memory.dmp

Download

memory/2900-30-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/2900-0-0x00007FFE7CA4F000-0x00007FFE7CA50000-memory.dmp

Download

memory/2900-1-0x0000000000990000-0x0000000000AD6000-memory.dmp

Download

memory/2900-23-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/2900-22-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/2900-226-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/2900-21-0x000000001DBB0000-0x000000001DC5E000-memory.dmp

Download

memory/2900-19-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/2900-6-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/2900-10-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/2900-13-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/2900-33-0x00007FFE7C8C0000-0x00007FFE7D264000-memory.dmp

Download

memory/3736-56-0x00007FFE9EC80000-0x00007FFE9EC81000-memory.dmp

Download

memory/5692-341-0x000001383A9B0000-0x000001383A9B1000-memory.dmp

Download

memory/5692-343-0x000001383A9B0000-0x000001383A9B1000-memory.dmp

Download

memory/5692-351-0x000001383A9B0000-0x000001383A9B1000-memory.dmp

Download

memory/5692-348-0x000001383A9B0000-0x000001383A9B1000-memory.dmp

Download

memory/5692-350-0x000001383A9B0000-0x000001383A9B1000-memory.dmp

Download

memory/5692-352-0x000001383A9B0000-0x000001383A9B1000-memory.dmp

Download

memory/5692-349-0x000001383A9B0000-0x000001383A9B1000-memory.dmp

Download

memory/5692-347-0x000001383A9B0000-0x000001383A9B1000-memory.dmp

Download

memory/6020-276-0x00007FFE9F170000-0x00007FFE9F171000-memory.dmp

Download

memory/6020-275-0x00007FFE9EB20000-0x00007FFE9EB21000-memory.dmp

Download