111de6b5328738de1dda6c952b4637c561003ace7e5557e3873f9004af9fc963

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
holdem.exe
Size 18.1MB
Sample260813-s9phcssxcy
SHA256 111de6b5328738de1dda6c952b4637c561003ace7e5557e3873f9004af9fc963
MD5 e424f5af1b16659f7533904fad4aac71
SHA1 d1e6cd60b7558b6e574c5821cf9c3dfbd982c160
SHA512 21ee793b8757b5348990c76ab014fd4cc2c9cfa110d6cf352096565923cf9474a3373126f0522aa4193725d70d498a5ae8d058fcd06f7ca81e33d30647abfd76
SSDEEP 98304:hwpnXGTRd/m5/PqPbezb8UAbn1nAtLUXC6NNR9CgERswg5d8+zrxpsCawOn8K0Yb:KhGX/bPqNUjZwO8kxMNt
TLSH
T157170811BA5F696CD05AC87083064A730E2174DB0A36BABF51C456393FADBF06F39789
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	holdem.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1116378201\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1116378201\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_651467949\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_651467949\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_651467949\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_651467949\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_651467949\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1116378201\crl-set	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3284	msedgewebview2.exe
3284	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4600	holdem.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5228	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4600	holdem.exe
4600	holdem.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4600	holdem.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 5228	4600	holdem.exe	88
PID 5228 wrote to memory of 2768	5228	msedgewebview2.exe	89
PID 5228 wrote to memory of 3112	5228	msedgewebview2.exe	90
PID 5228 wrote to memory of 3112	5228	msedgewebview2.exe	90
PID 5228 wrote to memory of 3112	5228	msedgewebview2.exe	90
PID 5228 wrote to memory of 3112	5228	msedgewebview2.exe	90
PID 5228 wrote to memory of 2844	5228	msedgewebview2.exe	91
PID 5228 wrote to memory of 2136	5228	msedgewebview2.exe	92
PID 5228 wrote to memory of 2136	5228	msedgewebview2.exe	92
PID 5228 wrote to memory of 2136	5228	msedgewebview2.exe	92
PID 5228 wrote to memory of 5976	5228	msedgewebview2.exe	93
PID 5228 wrote to memory of 5976	5228	msedgewebview2.exe	93
PID 5228 wrote to memory of 5976	5228	msedgewebview2.exe	93
PID 5228 wrote to memory of 5976	5228	msedgewebview2.exe	93
PID 5228 wrote to memory of 5976	5228	msedgewebview2.exe	93
PID 5228 wrote to memory of 2560	5228	msedgewebview2.exe	98
PID 5228 wrote to memory of 2560	5228	msedgewebview2.exe	98
PID 5228 wrote to memory of 2560	5228	msedgewebview2.exe	98
PID 5228 wrote to memory of 3284	5228	msedgewebview2.exe	99
PID 5228 wrote to memory of 1948	5228	msedgewebview2.exe	100
PID 5228 wrote to memory of 1948	5228	msedgewebview2.exe	100
PID 5228 wrote to memory of 1948	5228	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\holdem.exe
"C:\Users\Admin\AppData\Local\Temp\holdem.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=holdem.exe --webview-exe-version=0.1.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4600.5728.2525640073403263970 /pfhostedapp:491526246f9517effa0a2219037987db05266e6b
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView /prefetch:4 /pfhostedapp:491526246f9517effa0a2219037987db05266e6b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffcea555fd8,0x7ffcea555fe4,0x7ffcea555ff0
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView" --webview-exe-name=holdem.exe --webview-exe-version=0.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,13313231715011736798,11171272916494946807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:491526246f9517effa0a2219037987db05266e6b
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView" --webview-exe-name=holdem.exe --webview-exe-version=0.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2124 --field-trial-handle=1772,i,13313231715011736798,11171272916494946807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:491526246f9517effa0a2219037987db05266e6b
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView" --webview-exe-name=holdem.exe --webview-exe-version=0.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=1772,i,13313231715011736798,11171272916494946807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:491526246f9517effa0a2219037987db05266e6b
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView" --webview-exe-name=holdem.exe --webview-exe-version=0.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3476 --field-trial-handle=1772,i,13313231715011736798,11171272916494946807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:491526246f9517effa0a2219037987db05266e6b /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView" --webview-exe-name=holdem.exe --webview-exe-version=0.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2796 --field-trial-handle=1772,i,13313231715011736798,11171272916494946807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:491526246f9517effa0a2219037987db05266e6b
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView" --webview-exe-name=holdem.exe --webview-exe-version=0.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4480 --field-trial-handle=1772,i,13313231715011736798,11171272916494946807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:491526246f9517effa0a2219037987db05266e6b
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView" --webview-exe-name=holdem.exe --webview-exe-version=0.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4488 --field-trial-handle=1772,i,13313231715011736798,11171272916494946807,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:491526246f9517effa0a2219037987db05266e6b
    3⤵
    PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e8d029e6af1f8ef4d7a651d580a7917050ddd6b0587120707909db053b6b3d2b
MD5 4a4410a951dedb895d6da9a5b76ef210
SHA1 ea8c34c2e5fcd9457827efda3680a71da0a09fce
SHA512 bca9b893d90884991a362c8eee320930cb5eebe8270050339b06413fb1ddfedd69f571a322dd33dc3d7d8d02e9a7d459b39e08ebd7ef2411f349257e3bae27c3
TLSH
T1E4D0122272020238C81035330402A1481D01C51F404D80015438D91D6B040740902481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 928e0a61f61e72c879b94dd7821d30f7fe0211741c839c380672ad9006d80017
MD5 39c747fd9ab6c5541399b5861f188f99
SHA1 92b06f6cccc16eea405b4a09db50be5866d59cf5
SHA512 a0f2b6c4c14d2575eb4d72ee69cdc783b9c4e348f53caffbe609880f6370a4f902d677e47dabbf693da797d1b03fa1e16264b73ef02ba27c354555aa45fc5315
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8d8abf0b-faf2-458d-944f-7c57332a3136.tmp

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Default\8d8abf0b-faf2-458d-944f-7c57332a3136.tmp
Size 6KB
SHA256 9d79bc44d36bf7129e5985f6f3a6dd2bd1c6d9306b9b83676b5dc1928897c5a5
MD5 5ca2576ca742da0b5b13e80db11a2c92
SHA1 330d5d773ff1e191fd77aea01f720003c3a2dca8
SHA512 d59c64fbc9723a45d23aceac8f0785917a7d998326a8c98aed6664c0fd43c06acdf13f42d913e0f28f280c84fb672da2023ee73a19d0c7d8c15fce1df1037f13
SSDEEP 96:stQ/dZXvJ00b9skjo5h16Z0ms7/x+6MhmuecJcMS1ejeMK+gQ28XM1C7K:stEXhSkonmsV+FdczQjQCG6K
TLSH
T1BCD17401AE247DBB8CC6F509BA397E16E2F5547274911D58EBFC862C04EA6DC730790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7dc5d0cd0c9647e07edf693d1ccf7f1e1e8da9855aec9c8c83694b3312cbb72c
MD5 e8d3925e7191153a1662b319c149dc1d
SHA1 dc4520e14297e770e281e3925e1507495bd6e72e
SHA512 78cc1b7856a09c151be7ae5cb86f57cf5b5ff911b4a8d93a3ed4b718049ae735ad5995efefa129df13d985dd5b08dc391adc3e3a5a790c4cb2f8e70cf3715b44
TLSH
T175A0025949A15596E1305B7620D102A07330CE2E5203071186F85468DD753448512435
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bc200b762e3196411c7725102270623e69e700463ea108b3e0a29536772f8b85
MD5 2b15466bcd9227eaa88443c0576963e4
SHA1 cc85fd6eaa303f86f4605cde6aefd7d4dda319b1
SHA512 4a976d38633da78603277d78c51514121bd431dd5763ed16ca60038117ac1a054a8bcca6b7995fd188fffdd31d42da094817493dd5273996da3c8a8dc0cb2d9b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ad9b8.TMP

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Default\Network\Network Persistent State~RFe5ad9b8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Default\Preferences
Size 6KB
SHA256 3ae1ae384f7a153d9c9c4cd4a030b9e0840eea82cd634d31b3bf89bfb3666dba
MD5 babf160a37e9c66b79589446994c4f68
SHA1 58b3203ced5e9323531ebce3e6bdaad425d58c4a
SHA512 e8999c789f57b81e1efe3d4005757eda73fe6ff73c8abc01f1415d4ea29b0fefd51bde5a55e19577cd149c9fee6cedd7e7f34d8514d6d689065da7ae753d19a2
SSDEEP 96:stQ/dZXvJ7G0b9skjo5h16Z0ms7/x+6MhmuecJcMS1ejeMK+gyJ28XM1C7K:stEXh0konmsV+FdczQjQ2G6K
TLSH
T1F9D17401AE247DBB8CC6F509BA397E16D2F5547265911E58EBFC8A2C04EB6DC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Local State
Size 15KB
SHA256 b1b8a947e086d6c4b90d405b5558e674d9ab9a4f9d98b1a028a50df68ddbcbfe
MD5 39de9dff6bc12349b233cebf75f7acfe
SHA1 ba4791a976cbac830b5fffbad8127083bd46a363
SHA512 15afdf4076f9425afa17954e8f6f16f6ff7ab2f03304dc09050771a0ad31d0e789836b01c2e75ab4daa9b73d0b48e63f34a550bbe0628aba98723969baed18eb
SSDEEP 384:e+aQikB+z/xvxjg/qhEwNBSJxqFpdP9z/:p/UxvxjgC+bSnPF/
TLSH
T1A7729E2B9579BE23E5F7E9007A5D5B4BCBB898B291C26E784EED5F0906C73981301C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Local State
Size 2KB
SHA256 7e94b9904012e69a39383cfbe24a642f7035533a33a54abe3c2e9aecf901d777
MD5 1ce1b9d2274caf58a907f27045d78c02
SHA1 69d5920d40a6402f67e99e640a4ee8d60d51a966
SHA512 9724293d59661da54821637b5dffe605245c34ace06480c16c970f7de0263d5ba8b4297bc9873ac1908167022014e963de0435d3a8461166971af0c7c4e0720d
TLSH
T175517533F924BE77C9E2AA447A5B7F13CE3590A29A522F50EADD0B1801D764D2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Local State
Size 3KB
SHA256 57bac696e1375085551cae70e1fb2fcfbe22c493aa5ef683042679412f42d9c8
MD5 056b278bb9e31b68dcf05d177d496c70
SHA1 97f5a9617bec356e5631196a0548b562abd639ea
SHA512 d698a99fbbe69de768978b88b2e33feef6e25d6be30ef8b6d675e3655f6c45c2685344a87c88cc69fbe82aa921cfc1dacbc129fb6080ce1cdc60a8f9ef6b334a
TLSH
T189616333A974B9378DE2EA0479867B16A7A55063D5913F64DAEC0F1C01D738C2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59b1b2.TMP

Path C:\Users\Admin\AppData\Local\com.holdem.app\EBWebView\Local State~RFe59b1b2.TMP
Size 1KB
SHA256 91754b0f41d80faa903dbda253762b9f31395e9c3957918ddc171e269b8bb6c6
MD5 5a3e372d427c7c849ea764e383935c3b
SHA1 aab8115e68f6218a55189232e9bc89a84b279759
SHA512 8d02168731b5b3c8a2679157898d74e60cf151141c027d5b39580c29d9c2428e5b786c5ca9996b0c19a87cda82d2e9b3d4f46d7a809425a6e859c1b43929bc62
TLSH
T1DB214073F5A46F72ECD2B905365BBF479E20606682514F00B6DE4B1802E224DA66AC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1948-296-0x000001B4B5D20000-0x000001B4B5D4F000-memory.dmp

Download

memory/2560-243-0x00007FFD0BCE0000-0x00007FFD0BCE1000-memory.dmp

Download

memory/2560-242-0x00007FFD0C820000-0x00007FFD0C821000-memory.dmp

Download

memory/2560-260-0x000001A9C9FC0000-0x000001A9C9FEF000-memory.dmp

Download

memory/3112-19-0x00007FFD0C650000-0x00007FFD0C651000-memory.dmp

Download

memory/3112-179-0x00000241AFD00000-0x00000241AFEC3000-memory.dmp

Download

memory/3284-281-0x00000158B0850000-0x00000158B0851000-memory.dmp

Download

memory/3284-276-0x00000158B0850000-0x00000158B0851000-memory.dmp

Download

memory/3284-272-0x00000158B0850000-0x00000158B0851000-memory.dmp

Download

memory/3284-280-0x00000158B0850000-0x00000158B0851000-memory.dmp

Download

memory/3284-279-0x00000158B0850000-0x00000158B0851000-memory.dmp

Download

memory/3284-278-0x00000158B0850000-0x00000158B0851000-memory.dmp

Download

memory/3284-277-0x00000158B0850000-0x00000158B0851000-memory.dmp

Download

memory/3284-270-0x00000158B0850000-0x00000158B0851000-memory.dmp

Download

memory/5976-101-0x00007FFD0C650000-0x00007FFD0C651000-memory.dmp

Download