2569595539c28392ba776e0a2ee64ba8086c0251e12e1642933e02ad8ad3423b

Analysis

max time kernel
151s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
omnicontrol.exe
Size 63.1MB
Sample261107-vbrk6set7p
SHA256 2569595539c28392ba776e0a2ee64ba8086c0251e12e1642933e02ad8ad3423b
MD5 b0c07e4699f567efadba426046f50560
SHA1 cd2b2b82634834d3e5a7b756978352b97eabf391
SHA512 fa29adeb60b1d5c4a2f47bb00e412c62e64185fe458c6d90a549576a62855883b20403772405934fb27918e4a03afb45fb411cb1c3b759defe470076cd752a63
SSDEEP 1572864:3EFfXz5KPw671DT9qggmlCm+DL4KXthGb:0z0Pw679BjgmwZ5Xt
TLSH
T19AE7AE157A5F99ACD49BC87083478A734E2130DB0A36B9BF44C452393F7ABF46B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	omnicontrol.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_2133508150\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_2133508150\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_2133508150\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_420404169\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_420404169\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_2133508150\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_2133508150\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_420404169\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_420404169\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_420404169\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_2133508150\LICENSE	msedgewebview2.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4248	sc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omnicontrol.exe

System Service Discovery 1 TTPs
Adversaries may try to gather information about registered local system services.
discovery

System Service Discovery
T1007

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	omnicontrol.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	omnicontrol.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	omnicontrol.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{05CA5B91-B33A-4790-98EB-15BF41BBE1E5}	omnicontrol.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	msedgewebview2.exe
5968	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5700	omnicontrol.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5844	msedgewebview2.exe
5844	msedgewebview2.exe
5844	msedgewebview2.exe
5844	msedgewebview2.exe
5844	msedgewebview2.exe
5844	msedgewebview2.exe
5844	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5700	omnicontrol.exe
5700	omnicontrol.exe
5700	omnicontrol.exe
5700	omnicontrol.exe
5700	omnicontrol.exe
5700	omnicontrol.exe
5700	omnicontrol.exe
5700	omnicontrol.exe
5700	omnicontrol.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5700	omnicontrol.exe
5700	omnicontrol.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 5844	5700	omnicontrol.exe	89
PID 5844 wrote to memory of 1344	5844	msedgewebview2.exe	90
PID 5844 wrote to memory of 4952	5844	msedgewebview2.exe	91
PID 5844 wrote to memory of 4952	5844	msedgewebview2.exe	91
PID 5844 wrote to memory of 4952	5844	msedgewebview2.exe	91
PID 5844 wrote to memory of 4952	5844	msedgewebview2.exe	91
PID 5844 wrote to memory of 3724	5844	msedgewebview2.exe	92
PID 5844 wrote to memory of 2612	5844	msedgewebview2.exe	93
PID 5844 wrote to memory of 2612	5844	msedgewebview2.exe	93
PID 5844 wrote to memory of 2612	5844	msedgewebview2.exe	93
PID 5844 wrote to memory of 5008	5844	msedgewebview2.exe	94
PID 5844 wrote to memory of 5008	5844	msedgewebview2.exe	94
PID 5844 wrote to memory of 5008	5844	msedgewebview2.exe	94
PID 5844 wrote to memory of 5008	5844	msedgewebview2.exe	94
PID 5844 wrote to memory of 5008	5844	msedgewebview2.exe	94
PID 5844 wrote to memory of 1300	5844	msedgewebview2.exe	95
PID 5844 wrote to memory of 1300	5844	msedgewebview2.exe	95
PID 5844 wrote to memory of 1300	5844	msedgewebview2.exe	95
PID 5844 wrote to memory of 1300	5844	msedgewebview2.exe	95
PID 5844 wrote to memory of 1300	5844	msedgewebview2.exe	95
PID 5700 wrote to memory of 4248	5700	omnicontrol.exe	96
PID 5700 wrote to memory of 4948	5700	omnicontrol.exe	98
PID 5844 wrote to memory of 3928	5844	msedgewebview2.exe	100
PID 5844 wrote to memory of 3928	5844	msedgewebview2.exe	100
PID 5844 wrote to memory of 3928	5844	msedgewebview2.exe	100
PID 5844 wrote to memory of 3928	5844	msedgewebview2.exe	100
PID 5844 wrote to memory of 3928	5844	msedgewebview2.exe	100
PID 5844 wrote to memory of 6108	5844	msedgewebview2.exe	101
PID 5844 wrote to memory of 6108	5844	msedgewebview2.exe	101
PID 5844 wrote to memory of 6108	5844	msedgewebview2.exe	101
PID 5844 wrote to memory of 6108	5844	msedgewebview2.exe	101
PID 5844 wrote to memory of 6108	5844	msedgewebview2.exe	101
PID 5844 wrote to memory of 2368	5844	msedgewebview2.exe	102
PID 5844 wrote to memory of 2368	5844	msedgewebview2.exe	102
PID 5844 wrote to memory of 2368	5844	msedgewebview2.exe	102
PID 5844 wrote to memory of 2368	5844	msedgewebview2.exe	102
PID 5844 wrote to memory of 2368	5844	msedgewebview2.exe	102
PID 5844 wrote to memory of 3624	5844	msedgewebview2.exe	103
PID 5844 wrote to memory of 3624	5844	msedgewebview2.exe	103
PID 5844 wrote to memory of 3624	5844	msedgewebview2.exe	103
PID 5844 wrote to memory of 3624	5844	msedgewebview2.exe	103
PID 5844 wrote to memory of 3624	5844	msedgewebview2.exe	103
PID 5844 wrote to memory of 4920	5844	msedgewebview2.exe	104
PID 5844 wrote to memory of 4920	5844	msedgewebview2.exe	104
PID 5844 wrote to memory of 4920	5844	msedgewebview2.exe	104
PID 5844 wrote to memory of 4920	5844	msedgewebview2.exe	104
PID 5844 wrote to memory of 4920	5844	msedgewebview2.exe	104
PID 5844 wrote to memory of 3880	5844	msedgewebview2.exe	108
PID 5844 wrote to memory of 3880	5844	msedgewebview2.exe	108
PID 5844 wrote to memory of 3880	5844	msedgewebview2.exe	108
PID 5844 wrote to memory of 5968	5844	msedgewebview2.exe	109
PID 5844 wrote to memory of 4272	5844	msedgewebview2.exe	110
PID 5844 wrote to memory of 4272	5844	msedgewebview2.exe	110
PID 5844 wrote to memory of 4272	5844	msedgewebview2.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\omnicontrol.exe
"C:\Users\Admin\AppData\Local\Temp\omnicontrol.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection,CalculateNativeWinOcclusion --disable-renderer-backgrounding --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5700.4916.17629079597261294228 /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView /prefetch:4 /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x128,0x194,0x7fff49505fd8,0x7fff49505fe4,0x7fff49505ff0
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1868 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3280 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3732 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f /prefetch:1
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4240 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4420 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f /prefetch:1
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4520 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4888 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f /prefetch:1
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5132 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=820 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5576 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5712 --field-trial-handle=1752,i,9048977716402775223,12311068624921769937,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8339fb4a8befde8c9df0067d6f759226ce09c92f
    3⤵
    PID:4272
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query OmniMouseFilter
  2⤵
  - Launches sc.exe
  PID:4248
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Query /TN OmniControl-MouseFilter-SelfHeal /FO LIST /V
  2⤵
  PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Service Discovery

T1007

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

221f000b-45a6-45e8-a086-52ba44ab93b5.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\221f000b-45a6-45e8-a086-52ba44ab93b5.tmp
Size 2KB
SHA256 8f7fc74885e0fc1b6b152761e7265c9201927ba33700609bc7e5ca9170138443
MD5 75ad3ef262c2b004c744503067d2accf
SHA1 63d26b82656a569069b9c62cc6c46266b0ad22b5
SHA512 7256b9e89f4951d2eeaed30586e0e7180513fb4760bb66d10fbe2b8f4fcdaaeeb38d55e690a4baed0045e63f0391db3882307406e3f721e856ec69c102314e3a
TLSH
T1D65194336C20BA77AEF28704B90B6F27CA35D1619A572F609AED0B1801DB50C6345C37
MD5 SHA1 SHA512 TLSH

Submit Download

909e2e20-2cad-4ecd-955c-23453ebd0047.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\909e2e20-2cad-4ecd-955c-23453ebd0047.tmp
Size 3KB
SHA256 c21817717b6df59ae40564370ef6657299d486ffe0fd5e509eb23f85e34a3bac
MD5 f10e27dceb4bcbe3a64f3acab32181da
SHA1 97ae6ab4179441c2b210d8618f18b58d6f2fc8f5
SHA512 6ad6c98f476cdae21dfda40f24aaf56b059d80a9d1377ae74f9beb2ddf0a7798cf1250733f06026cf7e3c24a95ce50b67decf73a6496809bb2d973ba4ef9c7f9
TLSH
T1BA61A7376970B93B5EF28B05B98A2B1AA7A59123E4863FA5D6FC0F1C01D72881341C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5a079f034dbc73a35fc5bbc653386a25767b9c65e09e7b4356877c7a06a216a8
MD5 644ce50b21c87df0084f2404819a3365
SHA1 618522c04c2e385d4df2579b37a00975af34f999
SHA512 26cf6cce1745e4461c3317d53ce60b63589daf11d63dbb9bc5000c17f9889b57a7edcffaf5c7ce85411334d8b6f0019af845728c5cbc8bc630c3443b603b2b39
TLSH
T12AD0122A36010634C01024334003610D1400C10B810AC0106429995D1B090641D02451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fd3f97c0585e2c025f9b8a0a7c00820b5c054290f15f5998ddaaad66ff127d06
MD5 a3eca44967b077f37b87b23194db1958
SHA1 a08aad830f612dcdb101c40f1002cd8fcaf1a04c
SHA512 254d75c3b55ed1c6637f3d11b397a64100c349c634b2258f404260bc0c916b647017da5bcc2bc19317919f56080e05e62717281445afcf60affdbccaeda8b59e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

94b970d4-697a-4d09-ae7a-f22b31f59965.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\94b970d4-697a-4d09-ae7a-f22b31f59965.tmp
Size 6KB
SHA256 8c57a49b1eb5cf7643bf1b464269b5abf006dab0dd199d2e8d6067663498af1a
MD5 c2c103bfd7533d780505d5adb34ed6ad
SHA1 3e4b28a362adc5a2f72b5e0028174a5ec1914edf
SHA512 bb548f7fdeb392b1a114479bb1d2f17bf00f33a3410fad704d674d38b6111421d5ff3611bbf8c279b5eb38aea0d836040daca7511d2e15b231742f22a64c4bfa
SSDEEP 96:stH/d7N2GVb9gk+o5h16Z0Zs7/x+6MhmuecJ9aXWje+K+gc+28XM1C7K:stfhExonZsV+Fd9aGjWO+G6K
TLSH
T10FD1A5025E24797B4CC7E119BA29BF0BE2F5A43261D51E58E7FC4A2C04DAACC6303D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58343f9e40a5bd9a_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\58343f9e40a5bd9a_0
Size 16KB
SHA256 46083c559fe181f675acd31c4411c3af4cd6b7ed24c8400d5c51523ff449bfc6
MD5 bd26eef9e22b372b26293890bf11ca52
SHA1 236b7010faf8de6ae3fdfd9ac2d9e00c6775fabc
SHA512 9481c7e9ecce3e55cf477145e70bdb675b5e937bc6ddffeb51be722153be074c01ae1eabfd4b6982d40716fe7e71aefe2d26e480bcde7201d5e1ae8c1250ed6a
SSDEEP 384:O/Rdtk69zsMaLy30kYmd+kX4a2RwIOhHobQCA:2ddoMamimd+kX4a2RwIO+bL
TLSH
T12F722028C7007F16C465A93B4A67091A0730E9CCA6A1930F17B4DD36ED8A8EDDF79B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7981b7a3e487ff51_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\7981b7a3e487ff51_0
Size 257B
SHA256 b86ba3fb2c74f13c2c44caacac8363ddebb0b301dd3b0af6301de07a13b607b5
MD5 95204d24df14cbb47a9a4db981bea819
SHA1 42b7874b4222927cc8eb76788b564100b779d5f2
SHA512 ffcb0cf17a742cfdcb10b285eb84d69bb6a81360023ab3fffb8427198c65e1ddd611e9b27eb24f42bcd9895a992e86fcbf90240e0c270816d168c35039c54d6f
TLSH
T1DFD0979F6B32B420C3749DF0CEFA4C5A432305E20048EE10F61088932660A386069924
MD5 SHA1 SHA512 TLSH

Submit Download

8325567a96546cce_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\8325567a96546cce_0
Size 654KB
SHA256 37a5ee8c14e6cf4c787f5a56620a680e1d8d81ac7068207d5400f012114be62c
MD5 a51f5e83259d43ffffe4e75c74c8a1c1
SHA1 dade446977725fe65feb57a6df2ec58625eeae19
SHA512 73e694349f10031665214231c161ccf01c875bc333b8cda4b82fe0212c80946491a8270994208db575b4fc36d449d71e342c825f3912f89bbdd34bb094ef1907
SSDEEP 6144:6lZtAt+4PxI1VZz9pbxH1OFVYcZj0V5nL8CLGsyrEdG8IhtqUBirvAb46Rl8:6ZAl5YfyV/ha8HlTBirvAbbQ
TLSH
T13CE45CAB43101B72C9F21536A24652097731C5E8C1A3B35B6368B49B61894BDCFFF78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3677252bd8fcfc5_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\a3677252bd8fcfc5_0
Size 257B
SHA256 a3312f7edb9b0dae935d1dcb77377ad47405af673bdf4273e1c7e5a65ae53334
MD5 a97f538b598ac9a48f81ae452efdebc3
SHA1 0bfc157dc2b09646fddb4ebfca3fa0fe0925a9fd
SHA512 8f4f4f8ef3810bee9eb69d1130610683862373de60987dee22fa6db06ab20866db32c57564aeb316c15670699a2866f3660a7c04a84f53744490502286484dab
TLSH
T185D0954F03311D05C53CFDB0D7EF55ADD70705C41019D35232124D6127D37655C84508
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 552B
SHA256 03fa4a5f8d9584636ade531d27fddfd5059a8d50679dc60803a73a4532ef3f3a
MD5 c5cb8fe23be3e6543e6ffdcfb7b23681
SHA1 c204a235f83a66dfc6a4a46c53997041c7eecef6
SHA512 16af72913babc9968f49d799ade25777b4eb74bf2bf026966f9e1f5fc2d7c7f30ca1cb3e4a5ae0c51bb10f7dc74f9bc2d587714f314154e8633a9822d5d87025
TLSH
T1C0F0AB1C232E411DCB00467428E0749D37F3095D84BB3F01FB699834816C76953C221C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b45808ff8d8b709c676963b3a8ea3628c91d79c8a5d738c7956c248f8b7dcfad
MD5 44d10b8c26dda8ba88695c8860592c9b
SHA1 1657353a9f6e2902cb09f12fc288ece25151e3e3
SHA512 0ad8e45556f1fc72e643a4230a796fa2ba7e31be6f2fd33e2c2e067da6ca0fb50a8b9fb59bea1cdb1871bc2aacef7e1799b76e5a301606042391be1b16d5c612
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

84c05083-a2cb-497c-8e73-70a9f1b1af0c.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Network\84c05083-a2cb-497c-8e73-70a9f1b1af0c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b9f9102d-d22d-440a-9bcb-c225a6355792.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\b9f9102d-d22d-440a-9bcb-c225a6355792.tmp
Size 6KB
SHA256 e3a1c2544b03e640a0a21cf3829914d70eb3e753869bfff9f4e30f297a084d8c
MD5 d83945d8808c6afff6b512989e0d2a4e
SHA1 542bb7003b3638e8ddc609f5c75caa2b689da71c
SHA512 dbaed47dc9b251316e7921df25641bc0ad6ad9c454094c9af8eaf8d657db2538fef0422df5d744f5e0c064f3674cf227dec14454f6c3331710306d12d97fbf01
SSDEEP 96:stH/d7NnVb9gk+o5h16Z0Zs7/x+6MhmuecJ9aXWje+K+gVn28XM1C7K:stfhixonZsV+Fd9aGjWrnG6K
TLSH
T183D1A6025E24B97B4DC7E509BA25BE0BE2F5A53271D61E58E7FC4A2C04DA6CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Local State
Size 1KB
SHA256 7ec2cf1218c02fffd0e799fcaac26f7d02ac430aafe91fee19dd168d938eaa5d
MD5 c404398e59b4d6de64395b2b37261ce3
SHA1 467c67333682253b05c788a0841fb7ca9a6521c3
SHA512 3cab4fbb6b49ca9f971a820b1d3cbb9ef174dfbbfa447484d63e0038b999fc8daf3ab4348b802e1b7853d894351d0c9822801507d9228e006d44a3bb42dea0d4
TLSH
T1F52168729C607F72BD9053067117BA9B5E21906A81560F4451FE0B2801D714CD66D833
MD5 SHA1 SHA512 TLSH

Submit Download

f68fb515-f559-4cf5-8ab1-996a059dc610.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\f68fb515-f559-4cf5-8ab1-996a059dc610.tmp
Size 15KB
SHA256 f9b25af060dcf6ce03f50f16a59a6f17a92b075aadf90acd429ddfebd5d89ea7
MD5 8c0b89a21779b8f59cbc2fdc7140fca8
SHA1 ab03a82b25571f59665f81dbdee3ffb4b791f3f6
SHA512 9c6612b68f928a4f7ef47bd79e13d7224cbdf2015eefdc85859642b03a3d11b71f99d8bc30bd6fa843bbd7341271b7c471ad1c1e9c99aa5580f02e9ee7e9353f
SSDEEP 384:g+OBqImmJvGBLx3NaFMJFRNBS/Mzlempg6rZ:ZcvGtlN0gEmrN
TLSH
T14D72AE3A28756E773CF78609BA8E678BCB61A293C0DA3BE8D9EC5F0E116E4441351815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ZGF1M9RUB3MERW13TU9.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0ZGF1M9RUB3MERW13TU9.temp
Size 4KB
SHA256 1faa55b41b28dbffbb1aa298f0e0b8a2224fc7786cbdfb8ba33d3a22e90176af
MD5 f1e6f087d92816b8b03f2612724de64b
SHA1 6fe7b9dbdcc5c35e85e17e40606ce6212cd56f72
SHA512 49b4010ade3cc0d40b2a491c02126c2f13bcdd2805ac9731139619862a3591ddda3b3425f13531b86e733e51ba106f51271acad90bb51cd459c6e8d5598d5d6d
SSDEEP 96:t8v9b4zpJzE0zHu8z19c8v9b4zpJ/EWzHu8zXR:t8lbAd948lbAR7V
TLSH
T145A110050BE10B16F2F7AF7254B37685AA7BB949BA040B4F41C643050C62F5878B8F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 023bc5fa6abbff27af732519223d17e59b883294a4b3156b249305056786f4ca
MD5 d013ed77981edb339854918089dcb903
SHA1 57326b77289450c7ca44a094137905968f5c992a
SHA512 5b0d59dd0218bd3828fcef756b12b62f7d08aa24c99423d55116b020ce861abde628823c1d9a1a08e60624790e4e339ece4e3b607073107ee7d12cc26db78c9d
SSDEEP 96:PI8n9bBzpJzE0zHu8z19c8v9b4zpJ/EWzHu8zXR:PI89bvd948lbAR7V
TLSH
T18CA120050BE10F16F2F7AF7254B37695AA7BB949BA040B4E40C653150C62F4878B8F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omnicontrol.log

Path C:\Users\Admin\AppData\Roaming\OmniControl\omnicontrol.log
Size 565B
SHA256 09ac86e5590d7220403ef37397ffcd25a2820a7682f6f3cce4faa7d5a3f0b3df
MD5 aa779131d7890acc6d21590b63ddd83f
SHA1 ce6a7e67608a99ae8aa4fa88215756c6921e2990
SHA512 07b472df97d1fbb67c71d5df373fbd2623da5b3599b17fc082d5e6afc2e248e905a37c8b936d1554909932a7313d44587f86a60d7c7011454602e9983c5a470a
TLSH
T1E0F0E10706EBD12426C9E0EF763A1A05F041B08C3D0E0184B19AC8A4DECEC5D6745141
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_2133508150\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5844_420404169\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1300-394-0x0000013272690000-0x0000013272766000-memory.dmp

Download

memory/2368-397-0x00000213D5D10000-0x00000213D5DE6000-memory.dmp

Download

memory/3624-401-0x00000244DFB40000-0x00000244DFC16000-memory.dmp

Download

memory/3880-511-0x00007FFF67A90000-0x00007FFF67A91000-memory.dmp

Download

memory/3880-510-0x00007FFF68BB0000-0x00007FFF68BB1000-memory.dmp

Download

memory/3928-395-0x000002152AD40000-0x000002152AE16000-memory.dmp

Download

memory/4920-402-0x0000013D11940000-0x0000013D11A16000-memory.dmp

Download

memory/4952-250-0x0000024D05100000-0x0000024D05102000-memory.dmp

Download

memory/4952-236-0x0000024D054F0000-0x0000024D054F1000-memory.dmp

Download

memory/4952-284-0x0000024D05260000-0x0000024D0526A000-memory.dmp

Download

memory/4952-283-0x0000024D05270000-0x0000024D05275000-memory.dmp

Download

memory/4952-281-0x0000024D05220000-0x0000024D05224000-memory.dmp

Download

memory/4952-280-0x0000024D05260000-0x0000024D05262000-memory.dmp

Download

memory/4952-278-0x0000024D05230000-0x0000024D05232000-memory.dmp

Download

memory/4952-270-0x0000024D05200000-0x0000024D0520A000-memory.dmp

Download

memory/4952-272-0x0000024D05220000-0x0000024D05222000-memory.dmp

Download

memory/4952-269-0x0000024D05210000-0x0000024D05215000-memory.dmp

Download

memory/4952-267-0x0000024D051E0000-0x0000024D051E7000-memory.dmp

Download

memory/4952-264-0x0000024D051F0000-0x0000024D051F2000-memory.dmp

Download

memory/4952-261-0x0000024D051E0000-0x0000024D051E4000-memory.dmp

Download

memory/4952-262-0x0000024D051D0000-0x0000024D051D8000-memory.dmp

Download

memory/4952-266-0x0000024D05200000-0x0000024D05204000-memory.dmp

Download

memory/4952-273-0x0000024D05210000-0x0000024D05214000-memory.dmp

Download

memory/4952-275-0x0000024D05230000-0x0000024D05239000-memory.dmp

Download

memory/4952-276-0x0000024D05240000-0x0000024D05252000-memory.dmp

Download

memory/4952-292-0x0000024D05290000-0x0000024D05299000-memory.dmp

Download

memory/4952-389-0x0000024D724A0000-0x0000024D72576000-memory.dmp

Download

memory/4952-27-0x00007FFF68AD0000-0x00007FFF68AD1000-memory.dmp

Download

memory/4952-287-0x0000024D05270000-0x0000024D05274000-memory.dmp

Download

memory/4952-289-0x0000024D05290000-0x0000024D05299000-memory.dmp

Download

memory/4952-286-0x0000024D05280000-0x0000024D05282000-memory.dmp

Download

memory/4952-290-0x0000024D052A0000-0x0000024D052B2000-memory.dmp

Download

memory/4952-293-0x0000024D052C0000-0x0000024D052D2000-memory.dmp

Download

memory/4952-239-0x0000024D05500000-0x0000024D05501000-memory.dmp

Download

memory/4952-240-0x0000024D05510000-0x0000024D05516000-memory.dmp

Download

memory/4952-248-0x0000024D050E0000-0x0000024D050F1000-memory.dmp

Download

memory/4952-241-0x0000024D05500000-0x0000024D0550B000-memory.dmp

Download

memory/4952-244-0x0000024D05510000-0x0000024D05514000-memory.dmp

Download

memory/4952-243-0x0000024D05520000-0x0000024D05522000-memory.dmp

Download

memory/4952-247-0x0000024D050D0000-0x0000024D050D9000-memory.dmp

Download

memory/4952-251-0x0000024D050D0000-0x0000024D050D4000-memory.dmp

Download

memory/5008-106-0x00007FFF68AD0000-0x00007FFF68AD1000-memory.dmp

Download

memory/5008-390-0x000002E25A000000-0x000002E25A0D6000-memory.dmp

Download

memory/5968-569-0x000001E60AD40000-0x000001E60AD41000-memory.dmp

Download

memory/5968-567-0x000001E60AD40000-0x000001E60AD41000-memory.dmp

Download

memory/5968-575-0x000001E60AD40000-0x000001E60AD41000-memory.dmp

Download

memory/5968-578-0x000001E60AD40000-0x000001E60AD41000-memory.dmp

Download

memory/5968-577-0x000001E60AD40000-0x000001E60AD41000-memory.dmp

Download

memory/5968-576-0x000001E60AD40000-0x000001E60AD41000-memory.dmp

Download

memory/5968-574-0x000001E60AD40000-0x000001E60AD41000-memory.dmp

Download

memory/5968-573-0x000001E60AD40000-0x000001E60AD41000-memory.dmp

Download

memory/6108-396-0x00000146F21C0000-0x00000146F2296000-memory.dmp

Download