1fd150973d6587888c9bf7ae3ceb228228180ec879c7e7d796a074bc37110546

Analysis

max time kernel
148s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/10/2026, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher/nlrp_launcher.exe
Size 608KB
Sample261029-zar8jaex2x
SHA256 1fd150973d6587888c9bf7ae3ceb228228180ec879c7e7d796a074bc37110546
MD5 ad4fe14417ffeca11251d1ae2fb9052f
SHA1 d5cf43989ce89158915e451cb2514e707c8ba5e7
SHA512 5550f670f1d4fc1954043e323a1d642bbff255abe9e37a5ec134aea85c30a10ae25d02236879ee6a5650ca0bf0bfba3876f645ff64ec45937f67dc29d1aa67bf
SSDEEP 12288:dtE8eRGiWtoQpXRjD6vMCIeO9jKJkDlNuNLZYPRaIHWfB2M/dgwwUbbTbfZb6bjl:dtlTwM+JkZNuNLZYpaIHWfB22dgzZ
TLSH
T122D48D10B662D032E565A5F05D2CEFA696B9BC305F6149CB73C04FBA4D206C26B35F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nlrp_launcher.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\New Life Roleplay\game\dist\distribution.json.sig.tmp	nlrp_launcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1964661967\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1637644354\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_568449205\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_400336940\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1964661967\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1964661967\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1637644354\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1637644354\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_568449205\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_568449205\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_400336940\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1964661967\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1964661967\_metadata\verified_contents.json	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nlrp_launcher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nlrp_launcher.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlrp_launcher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\nlrplauncher	nlrp_launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\nlrplauncher\ = "URL:NLRP Launcher"	nlrp_launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\nlrplauncher\URL Protocol	nlrp_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\nlrplauncher\shell\open\command	nlrp_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\nlrplauncher\shell	nlrp_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\nlrplauncher\shell\open	nlrp_launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\nlrplauncher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\launcher\\nlrp_launcher.exe\" \"%1\""	nlrp_launcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4872	msedgewebview2.exe
4872	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1884	msedgewebview2.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1884	2052	nlrp_launcher.exe	82
PID 1884 wrote to memory of 3028	1884	msedgewebview2.exe	83
PID 1884 wrote to memory of 3680	1884	msedgewebview2.exe	84
PID 1884 wrote to memory of 3680	1884	msedgewebview2.exe	84
PID 1884 wrote to memory of 3680	1884	msedgewebview2.exe	84
PID 1884 wrote to memory of 2340	1884	msedgewebview2.exe	85
PID 1884 wrote to memory of 1076	1884	msedgewebview2.exe	86
PID 1884 wrote to memory of 1076	1884	msedgewebview2.exe	86
PID 1884 wrote to memory of 5316	1884	msedgewebview2.exe	87
PID 1884 wrote to memory of 5316	1884	msedgewebview2.exe	87
PID 1884 wrote to memory of 5316	1884	msedgewebview2.exe	87
PID 1884 wrote to memory of 5892	1884	msedgewebview2.exe	89
PID 1884 wrote to memory of 5892	1884	msedgewebview2.exe	89
PID 1884 wrote to memory of 5732	1884	msedgewebview2.exe	90
PID 1884 wrote to memory of 5732	1884	msedgewebview2.exe	90
PID 1884 wrote to memory of 2512	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 2512	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 4872	1884	msedgewebview2.exe	92
PID 1884 wrote to memory of 2604	1884	msedgewebview2.exe	93
PID 1884 wrote to memory of 2604	1884	msedgewebview2.exe	93

C:\Users\Admin\AppData\Local\Temp\launcher\nlrp_launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher\nlrp_launcher.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2052.2724.7966313458063675165
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffb19ecb078,0x7ffb19ecb084,0x7ffb19ecb090
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,3539195926821486915,4667562523528724349,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,3539195926821486915,4667562523528724349,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2232,i,3539195926821486915,4667562523528724349,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,3539195926821486915,4667562523528724349,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3696,i,3539195926821486915,4667562523528724349,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2212,i,3539195926821486915,4667562523528724349,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:14
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,3539195926821486915,4667562523528724349,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4556,i,3539195926821486915,4667562523528724349,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView" --webview-exe-name=nlrp_launcher.exe --webview-exe-version=0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4164,i,3539195926821486915,4667562523528724349,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
    3⤵
    PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1740c340-609e-4fd5-b2b2-103d24ed1635.tmp

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\1740c340-609e-4fd5-b2b2-103d24ed1635.tmp
Size 2KB
SHA256 0de3a5f7b42f6a9b9b40738984b57342e93b7d77271957de791d3f8a70ebbd5a
MD5 187411b08ade63905954b232ad44c675
SHA1 88d10466f9a39358666703afd75100aeb7feedde
SHA512 c0936ad56145dfc9b81605793fc8296708c86c550243c05eef06d124db2d4eb3cb5d1815ec662a88f81d55fe2a511ea5fc32576e2c8cde918433a552add584f9
TLSH
T1EF5186737824BA3799E2CA54BD163F13DE355066DA922F50AADD0B1C01DB25D334AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

234759e5-986a-4931-b4ae-4795d6286179.tmp

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\234759e5-986a-4931-b4ae-4795d6286179.tmp
Size 16KB
SHA256 4f6ebbf48b7419eacc392a773fcc799c3dd278e119927a2975d1753cae711224
MD5 c8a406dfde3e3cbe053e05b0e7204d7c
SHA1 1ccfbe90f646fc4ce33602d30c1d02ef8e7711a7
SHA512 9d5be9ff6f7195964858992821322d9163af01b3e47a5082a43cd6645abfa780faa263e63eb97afd9fbc7feb2f73396bf22464ee24b58679cca1c196f1545777
SSDEEP 384:zM+OBqImmJvGBLx3NaFMJFNNbv65cAeiXSVhqg6r/:pcvGtlNLkXYqz
TLSH
T16F72BE762C75AA273CF6C909BA8A274BCB616267C1D57FE4DDDC8F0E026F1482352D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79ca99a9-2434-4dff-a6f2-a481aed5861f.tmp

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\79ca99a9-2434-4dff-a6f2-a481aed5861f.tmp
Size 3KB
SHA256 3310d2b654a6710140739b67dc7879174abd30087e283c90f2fe854e2efbf272
MD5 d3a21c05fc065447b8d3007ac71aa1f5
SHA1 b65ec0cddd5f9303487d04c3227b9d5686c35c6d
SHA512 9df47f8d256cf0e72e9fb99f248cf547947fd5e466ea96305266156d7cad92f52824eacce5e03e7d8b521728674baaa1235184a9695ce6eeaec478022a0e23ad
TLSH
T1187184326864FA2B5DF2DA40BD823B07EA654027D5953FA4DAEC0E0C01DB39C3346C1B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b8004ea06d70b562f6989eb5de5cd5c7d09ed8f6ee349edf973698009aa94b1f
MD5 8322b8108e5b5cb0afba35b168597eb2
SHA1 f99f4ec5bec3ca044369673bcbfbf67354307f23
SHA512 082e66f29f38d7b782cde2525fb4ef13791557a339f72aaa45277fac10757ca8eefa491ff46b26dca5446b7af3f92a0d9fee1debca22bdeb93985b8d4f0a2dcf
TLSH
T149D0047455141310C04474310510CDC04100CFC045313541301C00C54CD105051431F1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c890152cd98cf4d6fba9bebbca9b141aeb1c201caa22bfc50ac0ee1db302a98c
MD5 f926d6816806d4ca2490cc4f23171e74
SHA1 0d82f1941a6c98ccb9fb8201b0f4aac0809340a3
SHA512 eb1e9d37aff187f11901c35244e09091a0202c1805ec0f9f9208e6b2e531be4fa47450523e1e59ae6becf80cdb3d6732e6e35c35f3f71f40ba3817e6bfb1c871
TLSH
T121D0122636110334C01034330502A9C80400C74B81155041742C859E5E540A01A034E2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

434b335d-4c25-41e4-a8f4-3f276267365f.tmp

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\434b335d-4c25-41e4-a8f4-3f276267365f.tmp
Size 6KB
SHA256 1ea4015b8a2b9478111b0adaab3928df59c208d2cd90e6c6b3f45e6a82b601f9
MD5 cc666eee501f5cd79662453051e681dd
SHA1 6e94ff586bc0405032be760c0721d02804155e2e
SHA512 40473f36b4f58e2097ff7c1ca2a548b41376e97b7d41c1eef58f258935fd382c846201aaae84d47f25955e4259552ee4e2125e96b2284c28ed90f8633eca4cc3
SSDEEP 192:ste0cmy0KfxYZ8pamCX/S+WinxEjwdIRuMC:st7cmyjZXo/VKwcC
TLSH
T149D1A7526E38B9774CC7F7197A35BB12E2FA502265C50E58ABFC861C05EA6CD730780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 5fb9433113ae5e0711ba70de6aa15d0a9f961692b5ce19cf3724ba53941c59b5
MD5 29ef72e483b1de88f7208a3f87c5ee71
SHA1 f486684065938e67a6f87bfcd9e6f912ec835374
SHA512 eb072fca6af2b0a179e6772f702db2e470c3c113cc8d2dc986d10adfe1c49eedafb830cb067b960c71a9d77cf2dcc1d5bdf9b329796c638dc4720b5006f5d3b9
TLSH
T19FA002D585812916D15013B055D512F83B704CA107170E6550B5417DDC9879076960A6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 655dd841774443ae2c1bd1a9194a4ed92a8d19c52bc4f29666d7055baf9d12a4
MD5 b0231fd053ec49cd6a8f964a940ff04a
SHA1 c8f7f5775d447f1388d19c271af945206ca51234
SHA512 62c521b1430741b65e6c5e76100b0adc8a6dbbabc74fefb8a701a5cc26eaf20b165f76bfbb2b9a43b13214a43ca4f6178ab897edd6dad2d21238770b71b61ff4
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 fff6ccf6be1bd344f92a66a3d41ca8c86e302048d4cd4b2a1e5b13d7118b7960
MD5 3e715cdcfd263556bb3e1a01a25f7671
SHA1 3a90c0c873622a988522edb8cd8646dee101b2fe
SHA512 ed35eca3feeccc5e2d47b98c3d8df1fc8248ccb081d3962a14e7fa58012f1953cdfb1215ddb89f12cc12c25ef0a8c3bc1e39d6718d8c38375bed1fb854477c59
SSDEEP 3:LstlNllkll/lb4zn/:LsX3lEtb4zn
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e281a070-c865-4e03-aea3-d53eaf38d499.tmp

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\Network\e281a070-c865-4e03-aea3-d53eaf38d499.tmp
Size 575B
SHA256 8d3b1b458814145bdd015d17def0926c5fad931a19041361e0a50a449ced9b71
MD5 9839ca6665f649a16f449c81683b8717
SHA1 6e50980cc9c784dabcf5a21f075bde6cfb17f1fb
SHA512 3c186357de929dfac064707751906c31dea94b64549f85958f55fb274542d69d334567c007babb97f551d4b009a3592fde9d48bafb06beef23984492545237b8
TLSH
T190F08171C6F449FE856116F41630B92BDF1E040542182D19CDF8DBC797E1475E11050A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\Preferences
Size 6KB
SHA256 70aa5797391bb04e73f1a45aaa9a6a954c6f2cc5b1372167fc19a80ed76c184d
MD5 56904ba1242cddd105e9e4c15c97da79
SHA1 36fc0245d140d4b364e495efb380810f63221992
SHA512 48a7fdcbece633d17e71091cd870ff83e1c5ca11d09b8b85f24ade1a97fec323a0f90d9a6e560b119fb6ac5471f407e92a928f82ce206361bc593ce4c74c2822
SSDEEP 192:ste0cmyKKfxYZ8pamCX/S+WinxEjwdIYuM8:st7cmydZXo/VKwn8
TLSH
T13CD1A7426E38B9774CC7F7197A35BB12E2FA102165D40E58EBFC851C08DA6CD720780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Local State
Size 1KB
SHA256 9c63cf10a05a08e5872268ec467ad907835d2ac36614a03392d2d7e21d2a1260
MD5 1964d6482df6cdcf7b3d5d14afc26895
SHA1 afe9d7fedde666b8a50c67b93849c7af4b63195c
SHA512 4ef773cfbde08b925c6ee49dbaf133f357ce3be7ba0aeca9c0a84b0d11e50c224274afc20364e555cbb4e969077ec82427dacb7d42849a9a79c36bb553ebb16e
TLSH
T1C52165B3D464BB77B8518A51BA127B874E40802AC6508E18A2CD421C02DB3AD367EC3B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\OriginTrials\0.0.1.7\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\Speech Recognition\1.15.0.1\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

f8282b80-2527-44fb-8e27-f91a401ff48b.tmp

Path C:\Users\Admin\AppData\Local\Temp\launcher\webview2_data\EBWebView\f8282b80-2527-44fb-8e27-f91a401ff48b.tmp
Size 1KB
SHA256 742bc9d836b6050f9c26bc6688ecaf19176373a73a26c8c47e2fcec4ff80374c
MD5 a3283e6dfad7c20caa05febaee67de16
SHA1 ce8f4919c9d6451f0632f606bb509f73bc4f8828
SHA512 45c496193d4e41c106fd16e1c0bb3c3a99a4d8f3a600f35ac4da564f51d94a3a55c2040bada34ad2b4183f9ca79372c842c694eacc434eac571d24eb507a33ac
TLSH
T18931A7B3F464BB377C92CB52BA127B878E10402AC2518E08B6DD461C02D739D367ED36
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.CognitiveServices.Speech.core.dll

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1637644354\Microsoft.CognitiveServices.Speech.core.dll
Size 2.6MB
SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
MD5 0ee2b50c85a110689352fccfa77b5b18
SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff
SSDEEP 49152:NodIJ85qaIU7ui8DDR5s8L0Oty8CvFqwsNcrCY2/YUZzQ7L9qhV6O8mOn0k10:gEDRwrcAwDl
TLSH
T188C54C1FA64951E6C07AD138C543550BE2B27C60CB7263CB1BA7038A1FA37E2557FB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1637644354\manifest.fingerprint
Size 66B
SHA256 22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
MD5 5bbd09242392aacbb5fac763f9e3bd4e
SHA1 14bb7b23b459ce30193742ed1901a17b4dcf9645
SHA512 541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670
TLSH
T1CEA0026342648D9FBC1C042BD478A69DCD9115B088492445A925C75BB14203389F49A1
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1964661967\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1964661967\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1964661967\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_1964661967\manifest.fingerprint
Size 66B
SHA256 9136f7c8a30419dc70fbe015784d1e8590a197ba88b564ca26b5a1e918e1b850
MD5 b740181eff7f7b568c83ad9d00213b13
SHA1 b3dcc9b0dc397aca84ca76c9fce3d0b37c7e37f8
SHA512 1d5c62a473a4e07c9e3d3d3900992eb6bf504b014763f7c9b7b0ce7e4b05648a9d69bb30a94b139eee88116767ed8d713f42ac49b8bfb4fcb9a1ffeff516397c
TLSH
T1F2A022C082A000F8C8080002C008008ACA00C00208003F00F080F200030CEA008FB800
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3680-26-0x00007FFB37740000-0x00007FFB37741000-memory.dmp

Download

memory/4872-374-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/4872-379-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/4872-378-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/4872-377-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/4872-376-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/4872-375-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/4872-367-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/4872-373-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/4872-368-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/4872-369-0x00000119B2490000-0x00000119B2491000-memory.dmp

Download

memory/5316-140-0x00007FFB37740000-0x00007FFB37741000-memory.dmp

Download