e058506a68cb5502a0065826c8af65405537eee8cae2b8d924c0079027941fbc

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
athas-code.exe
Size 42.2MB
Sample260814-e17qpafb96
SHA256 e058506a68cb5502a0065826c8af65405537eee8cae2b8d924c0079027941fbc
MD5 11d6f066aa1b79e8e1a2074b12b36d27
SHA1 1946af98265fcc38f42bbb10651711e565f9635f
SHA512 b709fc1866be413709e50b7c1f75bb3bfbc9f296f55ad32f7cb0d60e748a609af0f5c4f765213eedd74c1133d3250383d7e9bdfe560a64c2d50dcf4c17882363
SSDEEP 393216:+TQo2h7ORmBh4S8czmz6RWwDY2iVLi+DpK:+TQo2h78mX4PY
TLSH
T129A73A15BF8AD96DD15BC47082674B265B317CCA0B3666AF4498B2382F7A7F41F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	athas-code.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4732_33835744\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4732_33835744\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4732_33835744\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4732_1970015013\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4732_1970015013\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4732_1970015013\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311551686206128"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	msedgewebview2.exe
5968	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4732	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4576	athas-code.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 4732	4576	athas-code.exe	84
PID 4732 wrote to memory of 5092	4732	msedgewebview2.exe	85
PID 4732 wrote to memory of 4764	4732	msedgewebview2.exe	86
PID 4732 wrote to memory of 4764	4732	msedgewebview2.exe	86
PID 4732 wrote to memory of 4764	4732	msedgewebview2.exe	86
PID 4732 wrote to memory of 5076	4732	msedgewebview2.exe	87
PID 4732 wrote to memory of 5608	4732	msedgewebview2.exe	88
PID 4732 wrote to memory of 5608	4732	msedgewebview2.exe	88
PID 4732 wrote to memory of 3380	4732	msedgewebview2.exe	89
PID 4732 wrote to memory of 3380	4732	msedgewebview2.exe	89
PID 4732 wrote to memory of 3380	4732	msedgewebview2.exe	89
PID 4732 wrote to memory of 5736	4732	msedgewebview2.exe	105
PID 4732 wrote to memory of 5736	4732	msedgewebview2.exe	105
PID 4732 wrote to memory of 5968	4732	msedgewebview2.exe	108
PID 4732 wrote to memory of 4504	4732	msedgewebview2.exe	109
PID 4732 wrote to memory of 4504	4732	msedgewebview2.exe	109

C:\Users\Admin\AppData\Local\Temp\athas-code.exe
"C:\Users\Admin\AppData\Local\Temp\athas-code.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=athas-code.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.code.athas\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4576.4696.6325263145062806182
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.code.athas\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fff0b3ab078,0x7fff0b3ab084,0x7fff0b3ab090
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.code.athas\EBWebView" --webview-exe-name=athas-code.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,5268113019957818522,3342010117154257692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.code.athas\EBWebView" --webview-exe-name=athas-code.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,5268113019957818522,3342010117154257692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.code.athas\EBWebView" --webview-exe-name=athas-code.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,5268113019957818522,3342010117154257692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.code.athas\EBWebView" --webview-exe-name=athas-code.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,5268113019957818522,3342010117154257692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.code.athas\EBWebView" --webview-exe-name=athas-code.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4460,i,5268113019957818522,3342010117154257692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.code.athas\EBWebView" --webview-exe-name=athas-code.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4480,i,5268113019957818522,3342010117154257692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.code.athas\EBWebView" --webview-exe-name=athas-code.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4588,i,5268113019957818522,3342010117154257692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
    3⤵
    PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4732_1970015013\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4732_33835744\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4732_33835744\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f04cc7cd05f531ae3c729b2ddeb28171e65f5f74442a784ad25255d367d90bf5
MD5 2984696c30b81c11c785083360580744
SHA1 60e49d7319436245f3ad03fa9703de75088c287c
SHA512 2267e568dd8d177c16a1885ba3118c8a3f983260bbc372941d843d284da33bf683474d8eb22037e58943902d7f660160a6486d6e22bba48814bd650536b16c25
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 90e7399301133099fb743036c81eedf17dce7b4d761764956243d4a8a4ada9a5
MD5 62f0a840591b76f429dbfbd2a2a7cfb0
SHA1 7c0b3b7022e95d0a3be81360e086b1e72075dcb9
SHA512 cf6d51104242146b3896c52a62addb30234c871b55c18023b3f2a292414120cc16dcbfb9e3860c000f68b8e2732d2e7db2921ecbf96bdf55832a7018b816892d
TLSH
T1ECD02413F3310174D01035334053770C1500C10F4515C001753CC57F3F540544D03553
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 794ec74486e96faec6c85082f9266e229a21e7ecf7af124781534b94fb308a1e
MD5 3ce0d5ff6736d5a41579aa2b81c2d464
SHA1 c71a75abb736f17b4f70a8d6246fba005a0baf42
SHA512 3d3e99af3c09ab52dfe9a137836f9e40cd31cd02263274c3dcbe791a890d8294d2cbe4b645c5fbe74f48afc0109ff21e86ec7728659695462d1a903a861def17
TLSH
T150A002B46A85586AD6A903B054D705633A30CD754A138B216EB409E4CDA03814209501
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5864fe.TMP

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5864fe.TMP
Size 48B
SHA256 21f88623415e2b3218e61a8c6952a2e7f3f353de3bc02739473625caddf5830f
MD5 2e3bbf2e2dcfaab51420c8ff63e66dc7
SHA1 517f29de0cc8df7417ed4775b8449e21175d651f
SHA512 5447f9faf424903ae95f482181c0da9566d737d8c1723f5c5c99477a6adaa8a67b9de1fb0d58cef1916a7c1d424c299ed60f1aefbb2b0b4ed25ea3611f17b49e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe593399.TMP

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\Network\Network Persistent State~RFe593399.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\Preferences
Size 6KB
SHA256 dbad6d7579105d2c9d919c54690f3cf0ec8368cd52fce2e3ed4ddf499df852a9
MD5 8eb6bd14450f45fbbb1f7e34e61cd42d
SHA1 14d96ae8cab5d7b44d9f5c659628df4f7a27ed6d
SHA512 36343a1ab2950a74bcf71ce146a947232d7baa6db09de395dcfb11f0a80931c3287daf0e195280c0583dc37b9cddaf8ee0edf01c334aa171c312faa377234fa8
SSDEEP 96:stm05NqNPb9zfftZ8i0vhE+ktZqm/7qx+WVHMSm+uecJopc1idQjN+gj7zFMOB:stm0TGflZ8palZn/S+WiTopcwdsB7pMC
TLSH
T1C0D196025E2869774CC7F6197A65BF12E3FA506261C40E98AFFC861C08E66CC2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58ac87.TMP

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\Preferences~RFe58ac87.TMP
Size 6KB
SHA256 8c6e76b070bfe152e45347ca4d7d913b0d6814c56e1929dfb876fe4c78c13b16
MD5 29f4efce96681a8231ed7aed4d49e375
SHA1 997cb7a22b230d9f55b54d54ede7646f90b70ea4
SHA512 f4f8167ae1f7ef0e69d5a78e905d72f16b90f4e978bb0f3f07f54273d39a78683e8cf446c3a08aeebe11512c0b19b186310189e13e6895b22093bf48174d4e87
SSDEEP 96:stm05NqNPb96fftZ8i0vhE+ktZqm/7qx+WVHMSm+uecJopc1idQjN+gjNzFMEB:stm0TLflZ8palZn/S+WiTopcwdsBNpM8
TLSH
T1DFD195025E2869774CC7F219BA79BB16D2FA106261D41E98EEFD952C08D66CC220BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Local State
Size 1KB
SHA256 2b4628a45066961c99c54f8c27207b7211c09bda9dd464dd70d0307cdad6f7cd
MD5 5adfa2eaecc853ef20de07c9450868f5
SHA1 5d294ffa3dda092fc52ea5c9d9ab761373ac3f76
SHA512 864e773dd179708b1b0b98f8fc63b9c7426d3ab5cb5cd9d70d89e0e30d352e3413e3828d9bb40935a9921911693a827e2a7f17d198b98621a4386c25d9c44963
TLSH
T1EC318573E5843F336CC65690B2456E436E75507AC1100F48A5EC4F1C12DB2CC6236C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Local State
Size 2KB
SHA256 64c13adb8342b372a907eff2f1df88abff59a3df3c3e1b52c4f10b3a036a1f72
MD5 410d351056cdb6b173d3c6484326c5f2
SHA1 35530b07efa2698f2c03f6b70884dc89bbd130d3
SHA512 e2cc631c57e98dad56639903a6f18832cbbe3166490be6318612bc6e765804dd94ffb2d45f305a2dab0d7ac44ee0d68eeaf89516e25ef7313b17db4c3b801af8
TLSH
T185519473B844AA379DE39A54B9493F13EE7990B596512F94AAEC1F1C01DB28C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Local State
Size 3KB
SHA256 3280a735627c387f7880268d6c6396f78eb5d7b239ad01179dc8dee80a90c150
MD5 bd04fe30f195ce6b61fbf2c1a99cf0e3
SHA1 8149bbfd292e4506f0fd6684f0245b8942005b33
SHA512 d90b121af09f8a3f8dc4adf2ad631e9b1a41043bb1f4a1d7976b9905386befa794ea09f9135e837184819c4abe9e51da5363ddcef0faad66f72c3c7ae5010e2f
TLSH
T121719536A9A4A9374DE39950B8892F07BBA95177D5803F98D9EC0F0C01DB3C82301C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Local State
Size 16KB
SHA256 4d8e6e898c2888b7387eab6a9372ef47e08358e20b0a25cb32d9447c4fb5d9c0
MD5 ed7ccddb191b534d105e9617a4278612
SHA1 206b3898862e4bcaa8e5081e74248609aead5aee
SHA512 76a5d8b045c95f043d5fa2ee319a234b16353df4f61885d4d826e7d5b5fd42366f4248e9bb7303d567e8e99203fad9ed1213f6ebaf14cf78c968bfcb0ba6c154
SSDEEP 384:zf+aQikB+z/xvxjg/qhEwNbsZGWxc8w/9zZ:y/UxvxjgC+pZdq8yFZ
TLSH
T1C6727D37A5687E2759F7FA14B94D0F4BDBB994B280C12EB84AFD5F0D068B2941302D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe580ba3.TMP

Path C:\Users\Admin\AppData\Local\com.code.athas\EBWebView\Local State~RFe580ba3.TMP
Size 1KB
SHA256 61bb42ef28d3dac35cf7876b36e5bf3ec39fe06f24236525a250e9a0def8c3e5
MD5 ed6ca5f87f249f96e766a8465c69d317
SHA1 024154b3ea2a88a55152cb2cecdff934c129c9cb
SHA512 39c6ceb712bb98f4fd975be505de43755c3a552ad72e1efcaa3971caf971ecada9dcd92ed06cf681cbe33e6a422f90d695dde34b690560e2ed4cecb3a3f0e0c5
TLSH
T117214073D0857E73BC8A4960F246AE472EA8907A82100F4CA5EC4A1D22DB2C84236C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3380-228-0x000001854D410000-0x000001854D4AE000-memory.dmp

Download

memory/3380-246-0x000001854D410000-0x000001854D4AE000-memory.dmp

Download

memory/3380-146-0x00007FFF26900000-0x00007FFF26901000-memory.dmp

Download

memory/3380-266-0x000001854D410000-0x000001854D4AE000-memory.dmp

Download

memory/4732-210-0x0000028037A30000-0x0000028038A30000-memory.dmp

Download

memory/4764-249-0x00000175C0F80000-0x00000175C101E000-memory.dmp

Download

memory/4764-245-0x00000175C0F80000-0x00000175C101E000-memory.dmp

Download

memory/4764-26-0x00007FFF26900000-0x00007FFF26901000-memory.dmp

Download

memory/4764-211-0x00000175C0F80000-0x00000175C101E000-memory.dmp

Download

memory/5608-47-0x00007FFF25AA0000-0x00007FFF25AA1000-memory.dmp

Download

memory/5608-48-0x00007FFF26AE0000-0x00007FFF26AE1000-memory.dmp

Download

memory/5968-356-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download

memory/5968-355-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download

memory/5968-349-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download

memory/5968-360-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download

memory/5968-359-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download

memory/5968-358-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download

memory/5968-357-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download

memory/5968-354-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download

memory/5968-350-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download

memory/5968-348-0x0000024C56290000-0x0000024C56291000-memory.dmp

Download