123a44cabb5bf82c42e62f0f9f605815c2e99fbf7c5de5b85c4559d6856b6a35

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hackerai-desktop.exe
Size 7.0MB
Sample260723-ndfs5acc83
SHA256 123a44cabb5bf82c42e62f0f9f605815c2e99fbf7c5de5b85c4559d6856b6a35
MD5 275279b379baa2a7393f0ca97bdecc85
SHA1 1a1f9ad872a509fa4e1dce15e31240d2827e03ca
SHA512 102d1ed30fc1e89410a4fdb12c5103a035f11ac36e3e2076314314eb86fa8fb1c1aa37abb537de91f65ed5f4d4563a850b24bc74af862ee1ed2af284b8920454
SSDEEP 49152:KXLmEvthFgcraoD6dhYlRtFRyl8EzFFl18CR6janBkJJYxtKfdiQpr0fOSl5WTLK:iHfF0myVVyAmFPu+nf0vmn+
TLSH
T1A5762903F66181E8F05AC17483DAAF33E6E2BCB9092472AB56D47A212F75F507E1D748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hackerai-desktop.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_910278566\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_910278566\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_855296311\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_910278566\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_910278566\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1846600273\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1846600273\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_855296311\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_855296311\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_910278566\LICENSE	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\hackerai	hackerai-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\hackerai\ = "URL:co.hackerai.desktop protocol"	hackerai-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\hackerai\URL Protocol	hackerai-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\hackerai\shell\open\command	hackerai-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\hackerai\shell\open	hackerai-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\hackerai\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hackerai-desktop.exe\" \"%1\""	hackerai-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\hackerai\DefaultIcon	hackerai-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\hackerai\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hackerai-desktop.exe,0"	hackerai-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\hackerai\shell	hackerai-desktop.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1792	msedgewebview2.exe
1792	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
6128	msedgewebview2.exe
6128	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3092	hackerai-desktop.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 6128	3092	hackerai-desktop.exe	89
PID 6128 wrote to memory of 4280	6128	msedgewebview2.exe	90
PID 6128 wrote to memory of 4912	6128	msedgewebview2.exe	91
PID 6128 wrote to memory of 4912	6128	msedgewebview2.exe	91
PID 6128 wrote to memory of 4912	6128	msedgewebview2.exe	91
PID 6128 wrote to memory of 4912	6128	msedgewebview2.exe	91
PID 6128 wrote to memory of 5872	6128	msedgewebview2.exe	92
PID 6128 wrote to memory of 4392	6128	msedgewebview2.exe	93
PID 6128 wrote to memory of 4392	6128	msedgewebview2.exe	93
PID 6128 wrote to memory of 4392	6128	msedgewebview2.exe	93
PID 6128 wrote to memory of 5080	6128	msedgewebview2.exe	94
PID 6128 wrote to memory of 5080	6128	msedgewebview2.exe	94
PID 6128 wrote to memory of 5080	6128	msedgewebview2.exe	94
PID 6128 wrote to memory of 5080	6128	msedgewebview2.exe	94
PID 6128 wrote to memory of 5080	6128	msedgewebview2.exe	94
PID 6128 wrote to memory of 2036	6128	msedgewebview2.exe	95
PID 6128 wrote to memory of 2036	6128	msedgewebview2.exe	95
PID 6128 wrote to memory of 2036	6128	msedgewebview2.exe	95
PID 6128 wrote to memory of 2036	6128	msedgewebview2.exe	95
PID 6128 wrote to memory of 2036	6128	msedgewebview2.exe	95
PID 6128 wrote to memory of 556	6128	msedgewebview2.exe	99
PID 6128 wrote to memory of 556	6128	msedgewebview2.exe	99
PID 6128 wrote to memory of 556	6128	msedgewebview2.exe	99
PID 6128 wrote to memory of 2080	6128	msedgewebview2.exe	100
PID 6128 wrote to memory of 2080	6128	msedgewebview2.exe	100
PID 6128 wrote to memory of 2080	6128	msedgewebview2.exe	100
PID 6128 wrote to memory of 1792	6128	msedgewebview2.exe	101
PID 6128 wrote to memory of 4084	6128	msedgewebview2.exe	102
PID 6128 wrote to memory of 4084	6128	msedgewebview2.exe	102
PID 6128 wrote to memory of 4084	6128	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\hackerai-desktop.exe
"C:\Users\Admin\AppData\Local\Temp\hackerai-desktop.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3092.5604.877715953831227080 /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView /prefetch:4 /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x198,0x19c,0x1a0,0x174,0x1a8,0x7ff96a9a5fd8,0x7ff96a9a5fe4,0x7ff96a9a5ff0
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1880 --field-trial-handle=1884,i,6684074474658511345,17030301392578506910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1884,i,6684074474658511345,17030301392578506910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1884,i,6684074474658511345,17030301392578506910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1884,i,6684074474658511345,17030301392578506910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629 /prefetch:1
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3772 --field-trial-handle=1884,i,6684074474658511345,17030301392578506910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1884,i,6684074474658511345,17030301392578506910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1884,i,6684074474658511345,17030301392578506910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4592 --field-trial-handle=1884,i,6684074474658511345,17030301392578506910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.57 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=1884,i,6684074474658511345,17030301392578506910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:63086b5cd2fdfa84268e18ac6076bd3a0daf0629
    3⤵
    PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fb8294d1952b3ce029ea37f914ed758e90d02b9dfe550d99942a520372e9f670
MD5 656bfdddc2ee482e68daeaf02b6e7b99
SHA1 8e1ad2dc1e8eed5fdb23020fd989766b79501be8
SHA512 ab5d1b8c2567c792a95a7a1659bd19fedb2036bd1ae8c721460f6929d719fce6526b4b5932c5c52db2f5179b1d73bd80158f753b52b9462ec5ac2159cce9a6c2
TLSH
T165D0121377120238C01070731482654D0441CA8B4055C210746A8A1D1A040900A0B453
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 591932b490a7e3e89d0ed5ec22658ba974ef79b4382ed1a4dcba4a8b983d35bf
MD5 6ba8696608263b9ac00e700434258219
SHA1 80e5769106c12725c11c6a2adb7d6193fa0cc553
SHA512 c3bb5e63455a6c0b4b6fbbf262e22f222447046c92d6e833d21bd5d5834eac4c4d1b2016f835438a6ffcf02b8171a3c0ff20000cf81d6e8a868c0a3798e27fa0
TLSH
T179D00411D7111114D040F07514D0455541414DC10071D73030D305040440041410F013
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

49acaf95-1c68-4ea2-a5a5-913489b63be3.tmp

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\49acaf95-1c68-4ea2-a5a5-913489b63be3.tmp
Size 6KB
SHA256 e0433ff8c4b9e803b6b3a437ec6ee22d51983cb7684a1cc0ad25337c25a2806d
MD5 875e05b695e6910632e9f2aac05ac97c
SHA1 ec61d24fb2f1df9f5127956d7117e987c7d2afba
SHA512 c64c8dd1a06994c3df9a8e3ac68e312cdc9c1f9f0523114de73a29189f1b1b7a0a9ffbec91b8e216808f25b132e319f04a35f7126db691374d798b58b582cb7d
SSDEEP 96:stb/dzk7Ob9qkTo5h16Z0ulGs7/x+6MhmuecJ+91ejehK+g8c28XM1C7K:stjpgyonulGsV+Fd+9QjvJG6K
TLSH
T1B1D1A60A5E28697B4CC6E109FA29BB17E2F5507265D11D9CE7F8871C04DB6CD630781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 eac89e6d41d0a42e05f357043e6161f32a4de1b5f990b6135fecd01d69f36977
MD5 baf75445b57d15506e42c69529e249bb
SHA1 fa34c0c24f5e0d5fe5e0977ba44358b860f500c9
SHA512 0e872a9f604f759eeacea524cdb1f3d8d55d6929148553990988c6767e4f6738040c16219fbaddc6be23f78cdf167ae378c4d18e7cf514444e04b60507199bb0
TLSH
T13C0182D309C4CEA3EFA53FBAD4C8FE90364488208D02CF07C09126098E671CA61ABF01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592169.TMP

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe592169.TMP
Size 48B
SHA256 7a651bb71ef2de5b1a2c94976a71152eaaf6cfaede0c0d9f55e6f8533d3d1410
MD5 a847e6b7e9ff4b057802dbb535402111
SHA1 50a3fbfdb99ee95fb7781fe81e80f20f3efb52bc
SHA512 034919043b779217d9c149fbc3a134f49fdb0bbf05d889420e5442bd9ec51eda76581fd3901c436f35b35f2919ac2c584e415e24fecf6626d09fc47d810b2046
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Network\Network Persistent State
Size 356B
SHA256 0c8689708f51242b628e11efd5665ffc694c2036091f91a661ecb5f2f95db0ce
MD5 0830f1d797d63c8b682abf9bf288efd0
SHA1 e7e270b71ccecb2e2878351165d0b60281b42454
SHA512 b845bc46eddcffa668bbbec048790d297d03902e1c62d9f87a7bc50d68fe876d7e1fb165034bb1819542167295c573dab822fbe11c8e16fdf43be849a8db6518
TLSH
T146E068BA037448BE4B66C3B86A28691FCF6D0002432C293A8AE42B6287A24A4D024907
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59de8f.TMP

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Network\Network Persistent State~RFe59de8f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 ce78dc50f44fa7410bde56b9344cb645f17aa10cc6563ca9c4254f97a161b24a
MD5 f7112337b3a0dd60d2d5a3e8a2c7f643
SHA1 4f252eb932ca4e44dc297944128a6ca89a440df3
SHA512 e6eeb07d472ad7872939c7115b0cad581a1dae82a750aebbeb6ae5ceda439a85ba58e280d7c8772cf147e4f72b1e969ad2a20dc9a3f3e707015fa179208069a3
SSDEEP 96:stb/dzkqGOb9qkTo5h16Z0ulGs7/x+6MhmuecJ+91ejehK+g8GI28XM1C7K:stjpmyonulGsV+Fd+9QjvbIG6K
TLSH
T155D1A60A5E28697B4CC6E119FA29BF17E2F5607261D11E9CE7F84B1C04DB6DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Local State
Size 2KB
SHA256 bef30a0fc02602cca0c45289c47454c81fd30f68292b99ae266df10ae5b93dcc
MD5 798f47092f031768665f9a8c4dedb5db
SHA1 4aaa3aefe2088449d3f16b3b93f0d135ddda1b37
SHA512 2bc2390b28809734fd7c3ee36265052e256f4bd8acca428dedee40ad8d8c49ab6b3e0ef4a3d7e391c5c5828cad5ccbdb895039dd9feb0f57d10bcd95a5275cf3
TLSH
T1AA5175776E606677CAE3460D794B3F279A7950E6AA622F5499DC0F0C01C755C2307C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Local State
Size 3KB
SHA256 811474673271c2009c8ed8321336113eaaf76f29992be7088fed34bc861ea968
MD5 dda98a33e11d059781fe03f4a1728270
SHA1 7c454e07e31528efd67195d01a48d60005f28587
SHA512 15f1f851d16904e75e36b7849c30be93c9696240b8c4a14db51e51141fbc98a280b8f936363defd9cf8f66aa7ce145f5159b211ab40eb927dec4aea63cd07f9b
TLSH
T13A71967B6AA0A5378EE38909B8462F16A7A94067E5913F99C5EC0F0C01C76982353C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Local State
Size 16KB
SHA256 8f373e911f6ed15a3a887f364261fc81dbc3dc798bfc53fa24715eeb04affa52
MD5 3a5386c15814cbc7c749e4658e4e7f27
SHA1 609bcfae7b3ae767f807c031acb9a25c35a626a4
SHA512 f738cb43d532e5eb613dee042750998730380699edc93df20053ae7b3364b247518772cfbd2485df64d7f6eebe6776a71f3f7dc3c542b73bef2e6918ac06f5ae
SSDEEP 384:v+aQikB+z/xvxjg/qhEb3NBSHAsXPv3isdqs9zD:+/UxvxjgC+baxX3is8sFD
TLSH
T144729E3B59753D3396F3EA09794D0B5FDBBD84B290C1AEB88AAD5F0806C72981307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58c917.TMP

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Local State~RFe58c917.TMP
Size 1KB
SHA256 c38c41d736f84b0c26169a7621bf7c1ac1773093facfc7e9bef2f4fbd747afdc
MD5 3d0d202456104d7d793c674e241dd612
SHA1 3835db5777b1a124e84a9ed7ac312449fc7d30c9
SHA512 928fa683efb782b32957a68e6f7aa00bc45f61f55f2adfe7ba6e3299a10a907a9b26d73f308664d87d54427563c68f9900c0cd112ed3114a68389c4f01ac683c
TLSH
T10E3172B79AA027739AD2550F3607BF9B5F6840AB92614F04A1DD8F0C02D755CA72B832
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-319-0x00007FF98B160000-0x00007FF98B161000-memory.dmp

Download

memory/556-318-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download

memory/1792-368-0x000001A98CC10000-0x000001A98CC11000-memory.dmp

Download

memory/1792-366-0x000001A98CC10000-0x000001A98CC11000-memory.dmp

Download

memory/1792-376-0x000001A98CC10000-0x000001A98CC11000-memory.dmp

Download

memory/1792-377-0x000001A98CC10000-0x000001A98CC11000-memory.dmp

Download

memory/1792-375-0x000001A98CC10000-0x000001A98CC11000-memory.dmp

Download

memory/1792-373-0x000001A98CC10000-0x000001A98CC11000-memory.dmp

Download

memory/1792-374-0x000001A98CC10000-0x000001A98CC11000-memory.dmp

Download

memory/1792-372-0x000001A98CC10000-0x000001A98CC11000-memory.dmp

Download

memory/4912-26-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download

memory/5080-92-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download