da73fb9be9b7d28c26983ee6d71d9e4930ed920aceef51c3a1d04e6feb25f0ac

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
曼象学员端.exe
Size 11.8MB
Sample260730-tp24dsca87
SHA256 da73fb9be9b7d28c26983ee6d71d9e4930ed920aceef51c3a1d04e6feb25f0ac
MD5 07bb068452e5b517f0e213832fce04c3
SHA1 ecd7b87d1219f6357bdc00871505cc72fab17172
SHA512 707604b5ccf3b8b6d3d7d829915ae37b00e99ccd4d04e9c02e508f2d5b0c7ed170403e987807fa9216f7028013c00989601398c5595f1c59635ad88351d6d018
SSDEEP 98304:ilBlF4XgmUH7z0KypbTrZMOPRYoN9ZX4Xm/IeNM6K31boM38Hnx0lJmp:2BlF4QmUH7z0KypbTrZMIJM6KmYJmp
TLSH
T15CC6F6207A5A996CD19BC47483478AB2097130DB0B35B9FF4498963C2F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	曼象学员端.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_814865157\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_1537992760\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_814865157\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_1537992760\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_650149067\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping244_814865157\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5272	msedgewebview2.exe
5272	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
244	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1464	曼象学员端.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 244	1464	曼象学员端.exe	89
PID 244 wrote to memory of 2256	244	msedgewebview2.exe	90
PID 244 wrote to memory of 3684	244	msedgewebview2.exe	91
PID 244 wrote to memory of 3684	244	msedgewebview2.exe	91
PID 244 wrote to memory of 3684	244	msedgewebview2.exe	91
PID 244 wrote to memory of 3684	244	msedgewebview2.exe	91
PID 244 wrote to memory of 5032	244	msedgewebview2.exe	92
PID 244 wrote to memory of 2824	244	msedgewebview2.exe	93
PID 244 wrote to memory of 2824	244	msedgewebview2.exe	93
PID 244 wrote to memory of 2824	244	msedgewebview2.exe	93
PID 244 wrote to memory of 3744	244	msedgewebview2.exe	94
PID 244 wrote to memory of 3744	244	msedgewebview2.exe	94
PID 244 wrote to memory of 3744	244	msedgewebview2.exe	94
PID 244 wrote to memory of 3744	244	msedgewebview2.exe	94
PID 244 wrote to memory of 3744	244	msedgewebview2.exe	94
PID 244 wrote to memory of 4488	244	msedgewebview2.exe	98
PID 244 wrote to memory of 4488	244	msedgewebview2.exe	98
PID 244 wrote to memory of 4488	244	msedgewebview2.exe	98
PID 244 wrote to memory of 3224	244	msedgewebview2.exe	99
PID 244 wrote to memory of 3224	244	msedgewebview2.exe	99
PID 244 wrote to memory of 3224	244	msedgewebview2.exe	99
PID 244 wrote to memory of 5272	244	msedgewebview2.exe	100
PID 244 wrote to memory of 1892	244	msedgewebview2.exe	101
PID 244 wrote to memory of 1892	244	msedgewebview2.exe	101
PID 244 wrote to memory of 1892	244	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\曼象学员端.exe
"C:\Users\Admin\AppData\Local\Temp\曼象学员端.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=曼象学员端.exe --webview-exe-version=17.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1464.124.15576200716664040310 /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView /prefetch:4 /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffcd6065fd8,0x7ffcd6065fe4,0x7ffcd6065ff0
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView" --webview-exe-name=曼象学员端.exe --webview-exe-version=17.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,7582574467206246844,17302078698749680634,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView" --webview-exe-name=曼象学员端.exe --webview-exe-version=17.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1776,i,7582574467206246844,17302078698749680634,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView" --webview-exe-name=曼象学员端.exe --webview-exe-version=17.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1776,i,7582574467206246844,17302078698749680634,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView" --webview-exe-name=曼象学员端.exe --webview-exe-version=17.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3444 --field-trial-handle=1776,i,7582574467206246844,17302078698749680634,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000 /prefetch:1
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView" --webview-exe-name=曼象学员端.exe --webview-exe-version=17.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1776,i,7582574467206246844,17302078698749680634,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView" --webview-exe-name=曼象学员端.exe --webview-exe-version=17.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=1776,i,7582574467206246844,17302078698749680634,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView" --webview-exe-name=曼象学员端.exe --webview-exe-version=17.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4640 --field-trial-handle=1776,i,7582574467206246844,17302078698749680634,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView" --webview-exe-name=曼象学员端.exe --webview-exe-version=17.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=1776,i,7582574467206246844,17302078698749680634,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fe24bce2efe488bcaf2ca44b263a046a1c732000
    3⤵
    PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 87921b5c81e0542c1aacc37fbc353a448aec056bd21708e9ef958d2fe8ee22a2
MD5 a5d0e63179cb36e3884ed1645fdc8bde
SHA1 98f565499515e8530547f3dbee8ea2ca3368a92e
SHA512 2cf38747a9d58c477c8ebe5965d1ce6d7bad78e7ca8b694ce0446b2c24005b2a07ed2b47786932993660febc94358e3b263ccd5e17ff6dc43181d32ed5d1e17e
TLSH
T187D0121336114634C4102033468375081511C21BC00940166428C52D1A140680923482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8e68383c76beff7c58fc46116c969a770618dd3e59353550939505dc4c6600d3
MD5 ee3e5967e6d3ffccbc38bfef20ab2b19
SHA1 bed114a255d17df36c7a2e8c5885d46284af7dfc
SHA512 dbecfaba61510b71de4b53674fee1d2d516b70798fc08a5d2619e6b821537ad0b5bb937f48301544348d6fa328735275cbb0a9a93a936f895677f5722e451680
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5ebb2fc5aa451ef8af34ec84c13b1121d740f0b27b07a717175c24b7fe9bc7d4
MD5 7c2fdf933a880d72064c2c391f269a87
SHA1 ec9e6bb1dbd5210ea23765501871f871557ba52f
SHA512 2f1ef0133ab2f5acfd18ac9acb3427f69f5959693f79ce732cc0a0c5709b908e87e0475fbcd848e552ffd1ff1aa2bc541307c6dda22059925b5614028d515cd0
TLSH
T151A0025112415012D7854FF656D115C4773688600E172EE3A6981074D8513718217411
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599551.TMP

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599551.TMP
Size 48B
SHA256 d8ccaec96a034c94d3c52b5029136dd136bf2ff387a27c17921504c73d18d005
MD5 ff85435483c4a61e766879083dc5cbfe
SHA1 4a2e04340b9a132ba091d63d4804c45db679cd05
SHA512 f6763c547dfe7b48aa875e07c9ea8132f9530f54a09415c3ec1126816ad62a9448b8a07eb2acd9f6aef0ebc1c83152bc814a3a69cbf92b14944c8ccc040572dc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a86d5.TMP

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Default\Network\Network Persistent State~RFe5a86d5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Default\Preferences
Size 6KB
SHA256 38648ec821aff3c67bc3e4e171ba27d07c4f5fcfd10e28b060ca7e5de21dba52
MD5 98c6626414ad87f956e218274541b21b
SHA1 0100f19fb1237956a5890e8123f16bb280272478
SHA512 e496aceea59ae408c814cf2c39e051056ec0bce999793df2ae59d9d1996507a937c2cd5c157fdf56a6148e6bc9307eedf785fc51d0878aa1b8d8ae64ee15ac4a
SSDEEP 96:stU/dzOhGub9ukko5h16Z0ms7/x+6MhmuecJcs1ejeFK+gcqT28XM1C7K:stYp9jonmsV+FdcsQjfqeG6K
TLSH
T15AD1B6066E24697B8CC7E109BE29BB13E2F56032B1D12E58EBFD461C05DA6DC2317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c9cb593d-8e28-40a7-b153-ea7e9fb5286c.tmp

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Default\c9cb593d-8e28-40a7-b153-ea7e9fb5286c.tmp
Size 6KB
SHA256 15c0653267ae7fdc5e4bed1aab05d05eaa5ca95933b3f3c7115494ccc2ceda14
MD5 407cb3fc718c85b03e153009ab81f0b4
SHA1 950989eb9975003e74b3f178200aae0ce2140954
SHA512 31c53312f52546793f0085e549fd849ce30638a6325feb980453eadf84db1773c3eab9e3e59a2c48a10253050ab7faec47ddf9d22793fb3c564976d064a65dcd
SSDEEP 96:stU/dzO6ub9ukko5h16Z0ms7/x+6MhmuecJcs1ejeFK+gcqt28XM1C7K:stYpTjonmsV+FdcsQjfqoG6K
TLSH
T1AED1B7066E24A97B8CC6E109BE29BB13E2F5607271D12E58EBFD461C05DA6DC3317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Local State
Size 2KB
SHA256 099801864d08ba328a1ab836818d639c5ee39148dadace37c61c1a37c9d248bf
MD5 ca07d8dde4696f86fac11a8071deaab4
SHA1 cacbd2f27d5814aea01f0f0cc7c94a997e556404
SHA512 3799e040554493f9bd4b5c7136043352b867f30a849d18ab7f1cfc87c45c25aa4df9ae94e26cfe53521d8558282b9af8aec6ec5369cc925ef3ce158bcde3c3da
TLSH
T1FF519533F9355B77D6F34709B94A3F238E798062AA522F109ADD0B0801DA69C2352C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Local State
Size 3KB
SHA256 3c51c8fd48cf13477026216dfa1ce96c07c41715cf0a3c9ca47471ab5684ce71
MD5 f4d4fa4ca973676067bf43375c243405
SHA1 5770e35691378af55159457f521ae5c7303e6546
SHA512 b959a03a2972a9313665b3335afe1bfd736fa55ef0d2123b0bc392fe5e95772b21f7d245ae32e77cf031434af3f6b1152dc47cdcacc7b663771f715d68b81fe1
TLSH
T1D361653BA975997B9EF38A05B9863B12ABA54023E9817F54DAED0F0C01D72C81351C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Local State
Size 15KB
SHA256 421fb779dc726932d8a3bcd64d9933b7681a86f50481367b65e3dfb32e46a2e9
MD5 5da73bb6b80f5a9b870e14d1fec3212f
SHA1 9c5d5473e07626a960795e4af0cec5ec8d9274c2
SHA512 badbea0956287b17e8c687a4710a45b9aff7bed2d8503a5660734d3165470925af7beef59adb4cbcaab2b75bd17e0e0cf5bf449f013f7be91f3396010058657f
SSDEEP 384:y+aQikB+z/xvxjg/qhEwNBSNlZRZOqisdZf9zI:d/UxvxjgC+Vl7IqisbfFI
TLSH
T1FF72AE2B94393E3396B7EA05794D179BC7B9847291C27EB44EED5F0906C72D80342C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594433.TMP

Path C:\Users\Admin\AppData\Local\com.manxiang.student\EBWebView\Local State~RFe594433.TMP
Size 1KB
SHA256 9644f761be4869a8daefc26e03a3eb67961d65e81f240b9cc4e200c8cf7ed96b
MD5 e1719ecf74a2c052ce25cfabddd6a638
SHA1 9a3ab0e65342759c30a941690e97d747300af3e8
SHA512 d3dc81983d16d2e6f3584cacfa4d761390d5fcf2319c09379faeef8830ae6b162e5e97c59e59a63bb128c77e0a653c5380f9a8457b4705af69c4af47898e722a
TLSH
T179216273E5360FB3F9B3134AB2067BA35E70407796418F0066DE4B0802EA1CD9666D37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3684-19-0x00007FFCF69A0000-0x00007FFCF69A1000-memory.dmp

Download

memory/3744-101-0x00007FFCF69A0000-0x00007FFCF69A1000-memory.dmp

Download

memory/4488-235-0x00007FFCF6C70000-0x00007FFCF6C71000-memory.dmp

Download

memory/4488-234-0x00007FFCF5FA0000-0x00007FFCF5FA1000-memory.dmp

Download

memory/5272-305-0x000001C197FF0000-0x000001C197FF1000-memory.dmp

Download

memory/5272-307-0x000001C197FF0000-0x000001C197FF1000-memory.dmp

Download

memory/5272-312-0x000001C197FF0000-0x000001C197FF1000-memory.dmp

Download

memory/5272-314-0x000001C197FF0000-0x000001C197FF1000-memory.dmp

Download

memory/5272-315-0x000001C197FF0000-0x000001C197FF1000-memory.dmp

Download

memory/5272-316-0x000001C197FF0000-0x000001C197FF1000-memory.dmp

Download

memory/5272-311-0x000001C197FF0000-0x000001C197FF1000-memory.dmp

Download

memory/5272-313-0x000001C197FF0000-0x000001C197FF1000-memory.dmp

Download