8faf9ebc7b5171ee5000d464d68a69c1119b883eaae4cbed3d748ae27b2bdb94

Analysis

max time kernel
900s
max time network
902s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spotify.exe
Size 22.1MB
Sample261104-y3myvavset
SHA256 8faf9ebc7b5171ee5000d464d68a69c1119b883eaae4cbed3d748ae27b2bdb94
MD5 4d7c9c1744b7b64a00378737eaae90ab
SHA1 23fa160139867030d3d2969896b096f363756c47
SHA512 6678007d5cde7998e67c85496936ee59abc7cc31759f961c217f3c5028f68982b5b1aa69df7b9102fd3950a7d8c0e8ed24574ec6c7be434e74c36c748181e248
SSDEEP 393216:Vn+Evc2RADK1zusLOdwPszfZ5Bqeu9qwEE:V42R9z1KdwPC5Bxu
TLSH
T17C378D03F96254E8C1AAC175866A6233BB71BC49473137EB1B90AB203E76FD06F79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1488	msedgewebview2.exe
5700	msedgewebview2.exe

Executes dropped EXE 1 IoCs

pid	Process
2832	znx_inject.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Spotify.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	msedgewebview2.exe
1476	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2004	Spotify.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1488	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2004	Spotify.exe
2004	Spotify.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2004	Spotify.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2004	Spotify.exe
2004	Spotify.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2832	2004	Spotify.exe	89
PID 2004 wrote to memory of 1488	2004	Spotify.exe	90
PID 1488 wrote to memory of 3784	1488	msedgewebview2.exe	91
PID 1488 wrote to memory of 1032	1488	msedgewebview2.exe	92
PID 1488 wrote to memory of 1032	1488	msedgewebview2.exe	92
PID 1488 wrote to memory of 1032	1488	msedgewebview2.exe	92
PID 1488 wrote to memory of 1032	1488	msedgewebview2.exe	92
PID 1488 wrote to memory of 4220	1488	msedgewebview2.exe	93
PID 1488 wrote to memory of 4928	1488	msedgewebview2.exe	94
PID 1488 wrote to memory of 4928	1488	msedgewebview2.exe	94
PID 1488 wrote to memory of 4928	1488	msedgewebview2.exe	94
PID 1488 wrote to memory of 5700	1488	msedgewebview2.exe	95
PID 1488 wrote to memory of 5700	1488	msedgewebview2.exe	95
PID 1488 wrote to memory of 5700	1488	msedgewebview2.exe	95
PID 1488 wrote to memory of 5700	1488	msedgewebview2.exe	95
PID 1488 wrote to memory of 5700	1488	msedgewebview2.exe	95
PID 1488 wrote to memory of 1476	1488	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\Spotify.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\znx_inject.exe
  "C:\Users\Admin\AppData\Local\Temp\znx_inject.exe"
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Spotify.exe --webview-exe-version=1.2.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --remote-debugging-port=9222 --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2004.5800.15061752694950137310 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView /prefetch:4 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffbf4475fd8,0x7ffbf4475fe4,0x7ffbf4475ff0
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=Spotify.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1712,i,4875263915779974878,11973750085792150737,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=Spotify.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1712,i,4875263915779974878,11973750085792150737,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=Spotify.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2328 --field-trial-handle=1712,i,4875263915779974878,11973750085792150737,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=Spotify.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=1712,i,4875263915779974878,11973750085792150737,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=Spotify.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4168 --field-trial-handle=1712,i,4875263915779974878,11973750085792150737,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5372

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

znx_inject.exe

Path C:\Users\Admin\AppData\Local\Temp\znx_inject.exe
Size 6.7MB
SHA256 e09d8cf2169e25f61d7c1e54194af32f28f92b47eb6d3befa5371fdf69b521f2
MD5 ed6f831ff32342fe9cbe807129f0b871
SHA1 fe98bff78a4d6c51defcfdd1a87b07ab07a59c0d
SHA512 77be834f8a3af7bae54fbc518cfefa932e9b83a8db6fa5bdf4635d064d7c5c4d72c77fe93987de32c1272249a15dbfad80225bec3d60970066f82f68b642c322
SSDEEP 49152:3zQdfaIKYjwfcO+0+81TRug6VrI/Lsg4wusUlq1csq9dmyrmggyx5MaAKCK5KwZE:3Udjry+81uPIq9sy6g9ZMwTE
TLSH
T1B5665917EC9918E9C1AED13089679112BF71BC494B2123D72B80F6243F77BD4AEBA354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

114986ea-bc15-460d-b899-f740b29fc007.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\114986ea-bc15-460d-b899-f740b29fc007.tmp
Size 4KB
SHA256 2d7589d091e5875b3d48dc7977b3acc8b9475ecf2a2fb7ceac2689cbe7138148
MD5 2d619d82de04693523d27c70b6f38255
SHA1 e047a1568bec005530a5e2256951abb29550e35d
SHA512 5e83c891321b3771a3d1034d565b5e871a1f0518c5ef149449090e54c67997c0ddd05bdaefc81010556ca3bc42d6c2337e887ed1acdc6197ba5f873ee52cb1cf
SSDEEP 96:oNkGS3fHv+cic8kh/cI9URoDoto+57XBdAN62C9ZsD36xZK0ZZnTpJJa:oNBS/vreoDUhddA+9ZG3sZTg
TLSH
T13991B532E8A5A93B9CF29B40BA477B86EBB04163A4812F94C9DC0F0C419779D1342C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26422a35-7a66-4234-b4ca-7821cc3f9025.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\26422a35-7a66-4234-b4ca-7821cc3f9025.tmp
Size 3KB
SHA256 a51f0e863d9faeacfc10de8ebd6c5f320cd395317e42492a4b0c11008f9f91ae
MD5 eaac43618b6c4cae06f92f12fd183c48
SHA1 12bc84adf5dbe6aeb9afda89e40c1cbb5877aef8
SHA512 befeac5f0c17b3a95614e07cb2b822607a90ce7282e78a129aa55900d7467363b6384e35efd855606afc9066e4890507c19e50eb36f89c100072f24794696b0d
TLSH
T14C617733A9A8AD3F5DF29A14B9463B0AE7A55027E5813F95DAEC0F1C00E739C1381C17
MD5 SHA1 SHA512 TLSH

Submit Download

48b6317f-419e-463b-bb9c-6f9cbf0bb680.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\48b6317f-419e-463b-bb9c-6f9cbf0bb680.tmp
Size 3KB
SHA256 e745a6a75252a254c8e4daa77edcb9c6c02a30e2aec1f5edb96bc4a2f948d30a
MD5 67365517bbc7881f00e280b9f9e3c292
SHA1 34c1a2d24803328aae8781107b4d8a406d94670d
SHA512 0c7404f6033e6e47e970b66f8a2d02948eacec4d1eab72fdb608cd79caae0200de338a710ec6ab9f8a9582d6f03f95d8e2af47a4f400b2b0b85945af45008384
TLSH
T124716432A9A8AD3B5DF2D904B9463B07ABA55067E5813F91CAEC0F1C01E72981382827
MD5 SHA1 SHA512 TLSH

Submit Download

52d833fe-6aa5-4943-bd22-cda7ec666089.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\52d833fe-6aa5-4943-bd22-cda7ec666089.tmp
Size 3KB
SHA256 3aaee23790c3fe1febd01d283820066323f0b1246a7e25addcb68a0c883fd233
MD5 92bb805674ff28cbc8b4c3db98ffd306
SHA1 273c1f9a06a060f2ad0ac01f240c8c201cdd8901
SHA512 e10ed270805bf7a0d5b76f90bc645c68fa2d51aec2d718d4ecdbc35124e5efab0feed314aea448a188e57a93d878f508c9266a2a0d897a598a46d99310e3a4ea
TLSH
T19E717632A9A9AD3F5DF2D904B9463B07EBA55067E5817F91CAEC0F1C01D73981382827
MD5 SHA1 SHA512 TLSH

Submit Download

53556132-6a6e-4d4d-9fb0-97db0406cc76.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\53556132-6a6e-4d4d-9fb0-97db0406cc76.tmp
Size 2KB
SHA256 885d1eec98c861d47b03371648059e054f4c44525f7a406479ab47c2000a0f51
MD5 db4fab6fe5f9499286539b7543d281fe
SHA1 f257b59991c3867873558315e4eadc7b36ec29c3
SHA512 696968b235d1ac7c148e3b95114d34e5950a824f1a76d7ca2808fc9738b6f2ae42c953f1a57b9bc2e4b5ffdef413294c73fdb8603a4d96fe37869b40d3a871de
TLSH
T166517433A998AE3BA9E25A14BD0A7F16DE7550A5E6522F509ADC0B1800E725C1382C37
MD5 SHA1 SHA512 TLSH

Submit Download

74f71f64-4e44-47a7-9b36-98eac324640b.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\74f71f64-4e44-47a7-9b36-98eac324640b.tmp
Size 4KB
SHA256 8d9814e268921d4603edde529ee6d955cf2410afa82fc11990dc4eb9ddcc1f15
MD5 7a19af8e788f39375d57ed7b1487720e
SHA1 be565506a0647c01b2c087abddd53128ff8bc92e
SHA512 ceb108d97a36fde255c88ae4d8238b03ddf1c24d62f404ae12d8d0e84074b31f02767b070a0edc5e4d5eaf1ab1af1c46d31d72c3a42253c3beacc383fb03d72a
SSDEEP 96:oNkE93fHv+cic8kh/cI9URoDoto+57XBdAN62C9ZsD36xZK0ZZnTpJJa:oNl/vreoDUhddA+9ZG3sZTg
TLSH
T1CDA1A532E8A5E93B5CF69B40BA477B86EBB05163E5852F94C9DC0E0C419779D1342C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5f00c77b31f1237d8ae395cae304eaef8f17b9437da1c0b980f445e3133dc879
MD5 fa9d46eb033c3acd7d5ac13e15e80692
SHA1 3c41a729ebe87b9d9fd164dde7194fb81b68b73d
SHA512 c7589d74007e39bc0c3bedc518956f5a4d36f532590e17d96a4c8e5ea0c4315307b4cedf776120d0d7cf2ea2a7985772515203bfeb2d1b99cf7d0386cc4feefc
TLSH
T162D0122232020178C02021330892724C2560CD0B440541425C2BC75F2E040D44A17841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5436c336fd7f896d4c41baa196d44241f0d5ccc0cd73139978b57f3a54ed58b6
MD5 4337b82bf0977e8340aaa46fd61b3809
SHA1 239670e3b9e531c8387a90bd2a8d524b08218e0f
SHA512 1d6bc1c046a29741de91033539baf0f526c11f5fdd2b028306d9c6846b9baea3f7b0e78863b19e04524448d231ff8ba8adf8e15e51ec8d56a2b0c4fe53ae6b55
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 15991b4f8715a0b82f99cc7fc96bb1c2ed9b724b2df26ae736cfc474607772d2
MD5 faff3b3495ce20d6e6188f9f280b9e78
SHA1 2e9f83c6dcb3603d47ec5f474c86470cedbf6b4c
SHA512 b018e7daf33049898968f0598828f632d0e7bfdd2e1c4b2c6720c96e05abe8cff003f45fc259b4cc92763b4e9bcf8bb59d1bcfc5e4b18ea354c24089dc53582e
TLSH
T151A0023441984002E65807B1D0D6528073394D1043634746D9B204BD8D717C45665100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8d80ed84c365df5b308dcd0d77a5f08fe278d4c81cf7795b41185627dfec6e67
MD5 f06d8a831eac96308c55a22a3abcb784
SHA1 31524dbf59c0afa5e22276b0877943dba509e3c7
SHA512 343498a90be6e4c62ed44b59ce02d0c34ca13f9c5d4b8568b6c3c1babc36126f3fdc69b0c838715a1b2a3bd1af964cd9844761a2cfd3148b95d60eb9d4bf49e2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Preferences
Size 5KB
SHA256 327a049518f8d02cbcfa89033baf1fcf352eebff566c2709aecf2c45703be849
MD5 4a07b13c1bba07addce9b3e480b6f11c
SHA1 7dddfd6eb0c40052c0d254b2d4a246a7aeddb42e
SHA512 dfe661ca1172ca339aa3ed2d65a3f97e972171d15ea25ff3dcef7c669e194bb6c90ea35a1947fcfa9814cce549e21844c71116c608f4efe642dbbc6bf20cb8f7
SSDEEP 96:r3/df3xub9Vkvdo616Z0Zs7/x+6MhmuecJqX1ejeEK+gq28XM1C7K:rPZcoo6ZsV+FdqXQjsMG6K
TLSH
T107C184025A68797F4CC6E508FA397A1BD2F9503175D52D58E7F88A2C08EB6CC331790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9e7b968-5892-4ae6-8aeb-db4d525f8dab.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\b9e7b968-5892-4ae6-8aeb-db4d525f8dab.tmp
Size 6KB
SHA256 4483b55c106f60a5997bbd12f5eb5de0618bcf06abe4b4498d458c3801dc5ea7
MD5 2e6b5544a9fc24566cbefa53c7101be9
SHA1 3bf5103589d3e0d2e55a10916509f5c8646f6fd5
SHA512 810d6b358a3f38f3e259b8e60b6827eb89f333723c027fb67b409f1368ebf3b1601113be6e3c975b0f4932ede8efe183407a53c4db39d3347a7340aab69cefbf
SSDEEP 96:st3/df3xub9Vk+Ao5h16Z0Zs7/x+6MhmuecJqX1ejeEK+gd28XM1C7K:stPZckonZsV+FdqXQjs3G6K
TLSH
T154D1A6015E68B97F4CC7E519FA29BA17E2F5503161D51E58E7F8462C04EB6CC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce84730d-feb0-4d17-9c9d-cd0bb33ac4d4.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\ce84730d-feb0-4d17-9c9d-cd0bb33ac4d4.tmp
Size 6KB
SHA256 404de6a2b710cd50a655277285660c98ea541e386f697ec93ce5c41aabd53c4d
MD5 b96150f3f465cd61af65c62ae85d54a8
SHA1 95c127019a577b1d82850b1f9b3887b07583162d
SHA512 1426838192ae395560b175a2f40553f853ec3ef52d4f83dd6a8b77308f08a88bf4db9f0cb6f96114401be7e799064561d5f439036060597063eb5a4736e9a9b5
SSDEEP 96:st3/df34Gub9Vk+Ao5h16Z0Zs7/x+6MhmuecJqX1ejeEK+gs28XM1C7K:stPZ+konZsV+FdqXQjsCG6K
TLSH
T10CD1A6025E68B87B4CC7E519FA29BB17E2F5607161D52E58EBF8462C04EB6DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Local State
Size 1KB
SHA256 c4617ec267664b3ee76f4cdc8868c1cd8884795d9af6ef5101ccf8223a3ea61e
MD5 94a8ac07af17971cb5285de1fb4bc177
SHA1 0150c48764ecfd308bdc496ef332e9f422741263
SHA512 f79536f873b06e0269e0b64a33075024cebacdec51cce7cabe423243dd18f00bb24d419ba1357f180552b59b66354e0153b6533f1aa41193166794b1c1362368
TLSH
T120216273E9DD6F3ABC9136113207BF4BAE7010AAC2418E406ADD4B2C00F725D67A6833
MD5 SHA1 SHA512 TLSH

Submit Download

ae7c6ffc-745e-45db-bc1f-0a8a18e09170.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\ae7c6ffc-745e-45db-bc1f-0a8a18e09170.tmp
Size 4KB
SHA256 d101c66803490367073e49956473f1c10f373508f2b0f38e720d4d7b084f19e9
MD5 31ad28ff49739ffc9e1e596ffeae348b
SHA1 813df745cec5525515838c322523bde355a3aa78
SHA512 ccb22b17139e8f97100edeed5a1e731b1b1aa2f80b1b1e7cc08cf222f2226844b89a96dfcf3a1ad615a77ff4b634cfeed2d0b1c93b9908cdaecdd3ffd3e701b6
SSDEEP 96:oNkEYe3fHv+cic8kh/cI9URoDoto+57XBdAN62C9ZsD36xZK0ZZnTpJJa:oNz/vreoDUhddA+9ZG3sZTg
TLSH
T1F1A1A632E8A5E93B5CF29B40BA477B46EBB05163E5852F94C9DC0E0C419779D1342C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.json

Path C:\Users\Admin\AppData\Roaming\db97a7b8\app.json
Size 603B
SHA256 a1d78f7de83fdab989a707230995a7b976bbf5609b48a20b64ada62cb83f39f2
MD5 d29c2bef3b9e53474c28722509954b58
SHA1 ce18d7158bca267d881a746bc02055525794a4a5
SHA512 9f098bd97c40b1b6c456e5c91a1836d2431be265f20e30c0bb8f88b68c1c6fa9d5ed9141b6504064d13fa970cbe89fb55ccc3af1d8deec233773a84645077a48
TLSH
T10FF02204C2A5487700DC8A3A887E612367104DB7065A3D2DF622CD2C2F4E62B37F8CD8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1032-32-0x00007FFC157D0000-0x00007FFC157D1000-memory.dmp

Download

memory/1476-296-0x000001F784600000-0x000001F784601000-memory.dmp

Download

memory/1476-295-0x000001F784600000-0x000001F784601000-memory.dmp

Download

memory/1476-294-0x000001F784600000-0x000001F784601000-memory.dmp

Download

memory/1476-293-0x000001F784600000-0x000001F784601000-memory.dmp

Download

memory/1476-292-0x000001F784600000-0x000001F784601000-memory.dmp

Download

memory/1476-291-0x000001F784600000-0x000001F784601000-memory.dmp

Download

memory/1476-287-0x000001F784600000-0x000001F784601000-memory.dmp

Download

memory/1476-285-0x000001F784600000-0x000001F784601000-memory.dmp

Download

memory/2004-1-0x00007FF6F3B60000-0x00007FF6F5188000-memory.dmp

Download

memory/2004-199-0x00007FF6F3B60000-0x00007FF6F5188000-memory.dmp

Download

memory/5700-116-0x00007FFC157D0000-0x00007FFC157D1000-memory.dmp

Download