f658d45db1ad0b0732634e8512e6e012c6769a3bc4cf6a73751bba7f2560b0f4

Analysis

max time kernel
40s
max time network
27s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 14.8MB
Sample261030-2ejhasfv7y
SHA256 f658d45db1ad0b0732634e8512e6e012c6769a3bc4cf6a73751bba7f2560b0f4
MD5 02fd018a3b3e4e0279622f44b351584b
SHA1 cf55338d9b9ecf32537e0238f208b543b05ad4d0
SHA512 bd2647865cb3d09116204c6d327c4b9215615e67314fb48bf363a3be4c9dd2d3616b5468d018cc8e69901ebc6b04fd93e72ac17739e07d1b20fa8e35a1540ef4
SSDEEP 393216:RlyNhPJ8Gqe1EZd/4LVsAURjOLq+20EqMe6qF:Rly98CAuKDNOFs4
TLSH
T132F623F3A4A821E5F7538A71E357335B1B445035ED1B8A49268F38831D23CDBDA4AD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5176	Loader.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Loader.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Loader.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5736	Loader.exe
5736	Loader.exe
5176	Loader.exe
5176	Loader.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Loader.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{02E2BE97-B991-4DA7-8007-B782D6383FCD}	Loader.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{5381A1A0-E157-47E6-9C66-80702F11F3DB}	Loader.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Loader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Loader.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5736	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe
5176	Loader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4444	msedgewebview2.exe
200	msedgewebview2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5736	Loader.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5736 wrote to memory of 4444	5736	Loader.exe	89
PID 4444 wrote to memory of 1852	4444	msedgewebview2.exe	90
PID 4444 wrote to memory of 1336	4444	msedgewebview2.exe	91
PID 4444 wrote to memory of 1336	4444	msedgewebview2.exe	91
PID 4444 wrote to memory of 1336	4444	msedgewebview2.exe	91
PID 4444 wrote to memory of 1336	4444	msedgewebview2.exe	91
PID 4444 wrote to memory of 5104	4444	msedgewebview2.exe	92
PID 4444 wrote to memory of 2628	4444	msedgewebview2.exe	93
PID 4444 wrote to memory of 2628	4444	msedgewebview2.exe	93
PID 4444 wrote to memory of 2628	4444	msedgewebview2.exe	93
PID 4444 wrote to memory of 1792	4444	msedgewebview2.exe	94
PID 4444 wrote to memory of 1792	4444	msedgewebview2.exe	94
PID 4444 wrote to memory of 1792	4444	msedgewebview2.exe	94
PID 4444 wrote to memory of 1792	4444	msedgewebview2.exe	94
PID 4444 wrote to memory of 1792	4444	msedgewebview2.exe	94
PID 5736 wrote to memory of 5176	5736	Loader.exe	95
PID 5176 wrote to memory of 200	5176	Loader.exe	96
PID 200 wrote to memory of 264	200	msedgewebview2.exe	97
PID 200 wrote to memory of 2760	200	msedgewebview2.exe	98
PID 200 wrote to memory of 2760	200	msedgewebview2.exe	98
PID 200 wrote to memory of 2760	200	msedgewebview2.exe	98
PID 200 wrote to memory of 2760	200	msedgewebview2.exe	98
PID 200 wrote to memory of 2780	200	msedgewebview2.exe	99
PID 200 wrote to memory of 3592	200	msedgewebview2.exe	100
PID 200 wrote to memory of 3592	200	msedgewebview2.exe	100
PID 200 wrote to memory of 3592	200	msedgewebview2.exe	100
PID 200 wrote to memory of 1944	200	msedgewebview2.exe	101
PID 200 wrote to memory of 1944	200	msedgewebview2.exe	101
PID 200 wrote to memory of 1944	200	msedgewebview2.exe	101
PID 200 wrote to memory of 1944	200	msedgewebview2.exe	101
PID 200 wrote to memory of 1944	200	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Loader.exe --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5736.4596.7149735692844602832 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView /prefetch:4 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffb99155fd8,0x7ffb99155fe4,0x7ffb99155ff0
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --webview-exe-name=Loader.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,10760377149145541563,8564851222296300185,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --webview-exe-name=Loader.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1748,i,10760377149145541563,8564851222296300185,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --webview-exe-name=Loader.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1748,i,10760377149145541563,8564851222296300185,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --webview-exe-name=Loader.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3408 --field-trial-handle=1748,i,10760377149145541563,8564851222296300185,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57 /prefetch:1
    3⤵
    PID:1792
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe" --updater-restart
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Loader.exe --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5176.764.10139218045077656554 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView /prefetch:4 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x50,0x198,0x7ffb99155fd8,0x7ffb99155fe4,0x7ffb99155ff0
      4⤵
      PID:264
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --webview-exe-name=Loader.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1808 --field-trial-handle=1812,i,10635474387241029932,7045956433474483501,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --webview-exe-name=Loader.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1812,i,10635474387241029932,7045956433474483501,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --webview-exe-name=Loader.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2368 --field-trial-handle=1812,i,10635474387241029932,7045956433474483501,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView" --webview-exe-name=Loader.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1812,i,10635474387241029932,7045956433474483501,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:16438239f53c16d9d077c87af0577c8fc38f0c57 /prefetch:1
      4⤵
      PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon\manifest.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\downloads\Sheldon\manifest.json
Size 34B
SHA256 46b8dec48392a470becb0fbb529e03899de8755520b2da62009d3a3c2219ebe5
MD5 9d13e7e79a0d4c188b66d069c41953bf
SHA1 bd752c0ee2064c7122eed3fcbcda8b97ea810d63
SHA512 d6278eb25ba962f9e4d6f752ce94b02482cb68bf45e4598f5d04d9261b6020151f5d22a742f143af4f755cefe9f7948a6827cf13763238bd6e05bf5582b26578
MD5 SHA1 SHA512

Submit Download

5073316a-8dc7-45f5-a852-61b313b2a514.tmp

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\5073316a-8dc7-45f5-a852-61b313b2a514.tmp
Size 2KB
SHA256 baf1160173f85a4c9e59fc14b212cf35485259a0a2ff8d1e62b2401a065dd9bf
MD5 92ab40eea89f884bc772193d0b481e2b
SHA1 213b651c23f265d0f707b62b2b1d2e45e4ebdbc0
SHA512 dbe6a72bec9a2863339f9e7be1e597488e5fa0a0f57c7095e951de8c6b58193778110d291e0e20735cb8a6346539e1460d0dd01843b8fb5a9c80247ea2947e54
TLSH
T1E6518333AC14EF3689E2CA15B98B7A26DF3A91A69AA15F5499DD1B1900C251C2341C3B
MD5 SHA1 SHA512 TLSH

Submit Download

5e2dc0a4-1f56-45bf-95f7-51bcc3f69cc8.tmp

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\5e2dc0a4-1f56-45bf-95f7-51bcc3f69cc8.tmp
Size 3KB
SHA256 fcfd890401c1c44a57aedaaf5ff4d4a419b0f32ab7fd6ac58f7fde1fe1f369bc
MD5 fcf1cfc03f009e73b00f9b6ecf3214aa
SHA1 4d5268d9827c67b05b1c5957af05c5d3867c12c0
SHA512 8fa4c81745ba765879339910d539161e51870dc9e92e29b4043e1e9daaaee3dda24e4057c0030a46c67f11b6232f19ed90bf5859c03bb6f51a4d1ce95bbdc3b0
TLSH
T1F881B722A874EE379DF3DA06B9863B07AB655163D5D56F98CAEC0F1D01C72891341C27
MD5 SHA1 SHA512 TLSH

Submit Download

6ca88bec-3044-4874-8495-79ac21949808.tmp

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\6ca88bec-3044-4874-8495-79ac21949808.tmp
Size 3KB
SHA256 98e50a493caa7c234adbd0cd17ceb197fa7d94e8ba70a9ed2b71d3c18a1c46ab
MD5 69e3f058e8a79809a1a07085070dab6e
SHA1 f8124559e2e6191739c67dc220cd30278551bb56
SHA512 68ee90b214daf256f6d69f1d01e984da0d056dbaecdfaad56a9368eefb618526d247621dcf9d5d57730f61da34ca40a46b53649463abe2ad798e2b8183f79ad9
TLSH
T1B481C626A874EE379DF3CA06B9863B07ABA55163D5D56F98CAEC0F0D01C72891381C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bf2b2d20cbacc70fa9e0463aeb36e149f00b1203b0d8ff98b5f482e1a338a464
MD5 78b8679ddc96b624a2b99fc52c30fa6d
SHA1 6ddf0f0c49f06aea8c44135c6a133e24046fb2f8
SHA512 64d9b14887805e5bd3ed92db9bd1fc98da5799f0f35047b4a3a2eb2c8a0e36ea8e1f665c41045e8a175f0e72744af98cdc1aac60a81fe47680fa8ff20b3ae8f6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6fe68b7aa542cc5678d6714318de23f6d02a1b0fb7d9ec84691d193d868a1b54
MD5 42cbfc2e61530970671ce6ed3e1617c0
SHA1 d99e6851b6fb33f1ae1ffd6658dc9d45382fc401
SHA512 27c90c826847f74364141d1c78f0bd7ae536ff81bb64844c45680dd253e746221f6748b96365546580653e9308cbd3830de8bee28a259d3767117d34f416bf33
TLSH
T17FD0121A76420574C0102573111375090500C18BC00651546438AA2D1B484541A02441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d5860b7298082ded8584f4a6b3c72fc1e2f62c42496a7dba9437727cb8497061
MD5 452dbed9d0f6c88ac791e3b6338511f8
SHA1 2abd2a7e98f5b6e3f2d443e6e648f80eaa00ba58
SHA512 add02ca75bbdc2f5574e8905b77509059e951bc80866f955e65840472e4f0a2694c6907230e55edb390c1a240aac5d067a8d89019b3ea6d440d74ddb701d9119
TLSH
T158D0121A7A420174C0102672111275090600C08AC106525464389A3D1F484541A42441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

43b89ec1-5a21-4a8b-8016-7aba7c6a554e.tmp

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\43b89ec1-5a21-4a8b-8016-7aba7c6a554e.tmp
Size 5KB
SHA256 6129693fce4a4eb9aedabb82b2ae59acacef189c796912b9f230c394c6571ec1
MD5 3548539af5424a70e251baae0c75540a
SHA1 af033a1abc8e67b98ac5a2da2cab10ce2130c6e1
SHA512 c121d2bd9d37565015fa040fc0673a50683cfe822239fe04fc436db9e43b2f2f2b154aba94b72b02b1f3f80f309c3ac33e2915e7e235811bd488cc9dc749ab24
SSDEEP 96:stJ/dp+Ij9EbDEkfzdo5h16ZZs7/x+6MhmuecmjemK+gv28XM1C7K:sttT/Oo+sV+Fij+dG6K
TLSH
T10AC195025E28A97B4CCAE619FA65BA03D3FA602274D55E58E7FC462C04EB5CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 8140e15c496b845d17c2bc5e5015abfe4e5eb520b1f5aa776c55e8a2dfaf08c8
MD5 dec608ecbfdb30363bba282c50488b9a
SHA1 dd5026427473b9b68a2a5872a69c4d911ad39fc9
SHA512 34f102f68f204c442b0c6dd96c07d00b1a79d9ee4bb576cdcc088eaee1b50a980bdf1ce5a3d14322c01bdaa3af74104559f20fa7f039288cbcad9e681f65f673
SSDEEP 3:LstlNllkll/lc:LsX3lEtc
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8299fcfc0fc22a7682df815fbfebcd5e0bdfa2511263aa461813a2dc341d4070
MD5 6b7a429ee90fb321989be70af8055245
SHA1 17c22489af6b0fb3871625a389147ce847aeb2aa
SHA512 cc69519027886523e1401e4b683791f754ca069eb271166758823a505399e09c2a3af6e3a2c0ed8162ec5aace286f7de067cd532ab66f1dac4611e5b6fd05f7f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 6acdbaf4bc9eb116eab7daead96d5e77a7595dcd488ad24fc99614e2de42e8e5
MD5 c57c9aa4569d021d2ed74e5f39438ba7
SHA1 76dbd9aceeaedce379b87cb28556dde514ce6851
SHA512 1782c561742750ecb68e77f083fae175e576cc0adfa4466b9fe182e9e62485178fa844c39bd433c55380e66b080cdf7a915164c2dd793acf8b8da6f242bfff19
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Extension State\LOG
Size 317B
SHA256 ad78bba0322d01ad2a41354e7cf51ee8fa8ff6755ba0507fb0602c3756f278ce
MD5 123d26878ea930478d5d095d0e5f683a
SHA1 ab5e7938ecff5716e027704e23b764885a41a735
SHA512 3ed92059f734ef97621e2781b7269f9b004953860fcc5beb20597a77f8f96485dbbfc8cd8f66e5f466102fdfcbe034ed230ac7abf3fe7b00dda07be207a0e447
TLSH
T1EFE08600495ACA3A589A9CF78AB3035ECFD67009B58137CA0F1DD5D43296049A695792
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\History
Size 164KB
SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
MD5 a52a55fd35156c4962d5056465aa9d95
SHA1 c22a74097d6717d550758cf6f7ac16c3a4bce1e8
SHA512 2683277a6451aec89c9e40cc554ec5d16f22cb44c12ff404ea6c13acd8306552861b279f9a4e6aea3b715ece2e0f1969ff4c37f4c2e4b67336c4aa07d0a2adc7
SSDEEP 96:MBaLqL/uejzH+bF+UIYysX0fxQp97sXEHt/DfLVVVN6zRk/E0:MBGqL/tH+bF+UI3iWGVsXWNVVV63
TLSH
T10FF3EA1E5F643722CDBD923668E745B3597CF03F876326856CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 42f19eba65f6e61b5cd1108b5e2147b52165c5c022d9129f495183fd2e470ba0
MD5 b3b37f0b0cad65792f703075f3689652
SHA1 bc30313ccfdd19e3a1bc04d89dd7e23cd14197c8
SHA512 2d6553c93bfb74a0795e384cecef3785964bd802c765eed3b09db6c13c0c4a4b149d24452ccb02a6e01166deb36fe445211618435886b60f5f3a4ebd5b30c3e0
TLSH
T17AC022B1902DA0F6102909390A84BE80BE36B270508358ECCA5286AB61400768187012
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a85e7c5a-36b3-4a3c-83d3-43c66ecc27c1.tmp

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Network\a85e7c5a-36b3-4a3c-83d3-43c66ecc27c1.tmp
Size 188B
SHA256 7446a87736532a5718ee524b266815e61275dadcce18a506459a13f687b3518b
MD5 e020d1fd5960130ebe5912c9da64c0ca
SHA1 5693fb50ed49ba15c2cc0ac170501b9338bc4555
SHA512 0c6f8d9a01830749588fa353f949651c68fc1bea77773c1b30fdf356349195c43bbcfbf44a9395df96cbc73baa1dd2f905810a0665082e4f20747dcc8aaddaa4
TLSH
T15FC0226100A9E8F71028053109846E14EF36B130004274E99953023B71400665213533
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Preferences
Size 5KB
SHA256 6c752199634edfe1a0441303c790f76acfc4f7e63c18c10b4d9e691ab03d1df7
MD5 f164eae35a399c61f4e8894bb4029276
SHA1 bd8694f85fe042f100d96232577ea248f0aa283b
SHA512 7830b1bfa2ef698f3a12e5d15d4d7c8e0c6204759e909b6a02161e04488a4e72bd95059e468170e865e726676346864c9fc813b138beddc2c0c79e2f1bc478d4
SSDEEP 96:rJ/dp+IjWb9Ekfzdo5h16ZZs7/x+6MhmuecmjemK+g7I8XM1C7K:rtTJOo+sV+Fij+xg6K
TLSH
T159C186015E28B97B4C8AE619FA25BB03D2FA603235D55E58EBFC462C04DB5DC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 58a073f490cd1580d65b2fc145c408d2d24d410b2497ba3afd86d9004efc28ec
MD5 213040273fb95d619c222c3d245ffacc
SHA1 e2279f15fa5acec8ca2212aa4e5af91491450b7f
SHA512 94570ce36b2cab5a4bfcf73a67df646943d9d603c8a001b5d5640973dc0d580de675d023754b1ca5c0d00d2645cc2f37be28168bec2afbb4ff34c6d7619b5559
SSDEEP 96:vBi3Plf/ROo1pkF5d1Bii7VaTEv9V5h5pg5+e0OwLFbV+LLcIKcICaG:g3vJa9luSGL
TLSH
T150C1A7A7496CC575AF448BEBD8387ACEC9A600DF98C9881A86D3C54C06C1EFD21DB495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 6ec1e987b60b6eaf8dfb54b450e1008863db81a4846e0373ee7af4a83509cad4
MD5 795a6594a1e3f90e0498f55713d586f4
SHA1 5085ab8a92c74bcdd2cc45cd9b4325d41c688d40
SHA512 57001984f47e7fb5b9c356f20ccd2bfaa3b5d8991f15b4ed28adfcb0404ea7241ebf12c49dbcad466ab299c4f6d43bab995ba3e8d8632c03209cc2c636d917fb
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Site Characteristics Database\LOG
Size 345B
SHA256 a0249d8a7b63ef039c2b303531e45ddec001f4cd7c2ecfab4d9644d91a8b0028
MD5 7c17d8be6c390c25b714675c3f3b6210
SHA1 a2822efbcc50863ea24e53aed8285a291d1890cf
SHA512 23f237293a01f697e2e259b714301d8261d726b7832b9ebe85d2ebe567ad00b4df0de95ab4fac72854a07fce900047aaba7451427beea6ad9a58bdb7ce603910
TLSH
T1B5E0D8205ACBCB3B05875CFA55739359CF92B005F99616A65E18F2C4228A0487292652
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 953f8dfb288b63acb85a017f5c576aedb29dadf74be91d1b18c9af94ad5d1abd
MD5 f92cb8b9e076fff744d97c99ed3c9c80
SHA1 615c74637abce5c483ed3c37b4a054e5b1d6a481
SHA512 04eefeb0c6a5ef534f6604b5b01006b7e557aa7407b6091aca3959b9fc82d97a59e0355d355f2213abef2fe5f1f961509473b2bb988dac30fcea7fba5798d584
TLSH
T110E0867089C6C73A08C6DCEB45B7536ACFA0A409B7C237CA8F18E5D8368614866B1693
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Visited Links
Size 128KB
SHA256 7b3b88281e9e6ebc3dde9fd199db53ae1e430112c94597370a5bbc8726651a3f
MD5 ca188eccf3f7b905852991970cdf306a
SHA1 8373a45d7ea321c2c35c0edb4afa93eddc6ada06
SHA512 26b98deaf20195f85a943967484b446a62e2cfd8737c756329a5e8745db3eddcda890236a875633bd8d4581396cc638cb57bcdba6c71739ec56abd26c0a10011
SSDEEP 3:ImtVVYt:IiVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\shared_proto_db\metadata\000003.log
Size 392B
SHA256 38ca6dd8bfd92c584484004a1c1361a883956bfd46140f8db8d5c9599b0d4cc9
MD5 e0e82269a892b0ca6ea55d710f5f3877
SHA1 c8fd227ca4a461ceeb7f86faedb6ec15d351bd68
SHA512 85446b70d1d19d7f57f199bd7252c38dc8499c1ed980c355301fbfacca1d6bf0d5c52768fcfdfd83b7563013e672b65be497a28fc36ae06d889b09b9540b6068
TLSH
T16EE01216F314C440E15ED63E647A97225375E4515FB8ED4F4C3B91182F725451D477D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 6fc32a9d1c154c04ebe735a8b175d097b2805197010febd6bcdfcfd4102fa2ca
MD5 8be6f4ea88c139d1407dc1e1606fbd5a
SHA1 2c0bfee9bd62b542bbe38b99b41a6d17ac8f8dc1
SHA512 928bab5db9e8d016f07034220dd5d3710c54cada8fb87ea253a6728e2c790f965fa56ce0f106e6f8642c6db9768eaaa1c70400ac2869544592e6e0dbe06390d1
TLSH
T151E02610B84AC67F44969CF704B343D9CF65740AFE811F8B0F05DAC825CA08D76A62D3
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Local State
Size 1KB
SHA256 f91bdada08fe1dc75c0ac320fc1562592f617bf99a10ce8f1b0b9836d54a6842
MD5 e40a7e55bc3f4bfe2e452d7a48882a13
SHA1 a4361b1c188c67738befe6f2515572e3dd78b88d
SHA512 c0a3a5515ff5e90bc2df18f8a5d5a7c6ec3aeb92b8566970cd04ba79f74b65656472c55d9cba287ec778bab8d4c9ae13f83871cc9ae172fcbcaa99d23e33bfea
TLSH
T1CC216572E855DF32ECA1D7167687BA5B6F21517BC1A0CD0490CD4B2901D210DA2A6D37
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\ShaderCache\index
Size 256KB
SHA256 6adcfc884ab3d19a894d3a307880f40f9e6d8b8dbb51374643469113d656c711
MD5 5b9d51b97b78f8e9c787b82a9797fe15
SHA1 2e5b4a10214511ed4da39b06c9470fea6e53d444
SHA512 0731db4a2cf2f101700783d8b327dfc81c1f1922988fc2863b160fef58ce6abb9845aa16013168f459a87c81d639933a448431e7602552b11538ab8629002f4b
SSDEEP 3:LsOllllklkXl4F:LsUlP4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

cfc8799b-69af-4f31-a4b8-9b4744349f63.tmp

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\cfc8799b-69af-4f31-a4b8-9b4744349f63.tmp
Size 15KB
SHA256 f13debc19b8805deaa010c08982df3caa7dcdbc10cca2700f99122a72ccfdf33
MD5 c9054d9622e7b47fb6cb1042564334f3
SHA1 bbdbc832cef9ef6845d087c13fdb3c6251218a50
SHA512 006e8bffc91745ae6b40b054f31a385c79cc315640faaa37975b864266685522523944454e1d895d7e06495260ce9b2aba15d3e49dcf1f079f55fd454c2b1d8a
SSDEEP 384:O+OBqImmJvGBLx3NaFMJFK3NBSsgmws/ESvg6rA:LcvGtlNK7cS98
TLSH
T15B72AF672C65AE272CEBCA0ABA8E7347CB7462A3C0D47BD8DDEC6F0F005A4541351916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4860163-f589-428c-a3ae-61a13f2577ca.tmp

Path C:\Users\Admin\AppData\Local\Penguu\Sheldon\temporary\webview2\EBWebView\f4860163-f589-428c-a3ae-61a13f2577ca.tmp
Size 3KB
SHA256 f871ca3b248db428a0e13b990bf17b6b090c56a2de3d987fb82b82ee86e684fb
MD5 a9afc752a8b30d5321da687bd808cfaa
SHA1 c129876a89612d4deeaa19cc811d222df9e702ff
SHA512 64a9e236a9b23822ab1cbc2661116e325bb5819c54edbd7aef07e6cacf1e2fda1f2a1921c0c7b69351f7113fbd95f542ea85b7d1295771d26a39d836216c52de
TLSH
T111618423A964EE3B8EF2CA05B9863B16AF655127D5D17F98C5EC1F1D01D32982341C2B
MD5 SHA1 SHA512 TLSH

Submit Download

loader_new.exe

Path C:\Users\Admin\AppData\Local\Temp\loader_new.exe
Size 14.8MB
SHA256 f658d45db1ad0b0732634e8512e6e012c6769a3bc4cf6a73751bba7f2560b0f4
MD5 02fd018a3b3e4e0279622f44b351584b
SHA1 cf55338d9b9ecf32537e0238f208b543b05ad4d0
SHA512 bd2647865cb3d09116204c6d327c4b9215615e67314fb48bf363a3be4c9dd2d3616b5468d018cc8e69901ebc6b04fd93e72ac17739e07d1b20fa8e35a1540ef4
SSDEEP 393216:RlyNhPJ8Gqe1EZd/4LVsAURjOLq+20EqMe6qF:Rly98CAuKDNOFs4
TLSH
T132F623F3A4A821E5F7538A71E357335B1B445035ED1B8A49268F38831D23CDBDA4AD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-341-0x000001BE4B720000-0x000001BE4B879000-memory.dmp

Download

memory/1336-95-0x00007FFBBBDF0000-0x00007FFBBBDF1000-memory.dmp

Download

memory/1792-126-0x00007FFBBBDF0000-0x00007FFBBBDF1000-memory.dmp

Download

memory/2760-477-0x0000029D159D0000-0x0000029D15B29000-memory.dmp

Download

memory/5176-344-0x00007FF6DE6C0000-0x00007FF6E0DE2000-memory.dmp

Download

memory/5176-343-0x00007FFBBC970000-0x00007FFBBC972000-memory.dmp

Download

memory/5736-12-0x00007FF6EE870000-0x00007FF6F0F92000-memory.dmp

Download

memory/5736-226-0x00007FF6EE870000-0x00007FF6F0F92000-memory.dmp

Download

memory/5736-2-0x00007FF6EE870000-0x00007FF6F0F92000-memory.dmp

Download

memory/5736-1-0x00007FFBBC970000-0x00007FFBBC972000-memory.dmp

Download

memory/5736-227-0x00007FF6EFCB3000-0x00007FF6F00CD000-memory.dmp

Download

memory/5736-8-0x0000026E89F40000-0x0000026E89F41000-memory.dmp

Download

memory/5736-0-0x00007FF6EFCB3000-0x00007FF6F00CD000-memory.dmp

Download