5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
Size 15.3MB
Sample261022-sydaysvx4q
SHA256 5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525
MD5 8ed22cf91cc1eca5089cb3423e520ee0
SHA1 780d5dad9ded762e5380cb97e536d036647c7ccc
SHA512 bb82529efdc29368cc5da7c28bc8e15a92855b352b3d9d24bdaf9d325e73618ed9c2ea07ab8eb592ee19c9a9c0c831e63e32d98bbba0efd3bb035f53a0555937
SSDEEP 196608:1f8Cfrf+jJRDJVrq7GD8hNs/OXPbR4Bvzd8v84:1fjfuVrqfy/gQSv
TLSH
T12CF66A13E8A505E9C0ADD274CAB29297BB707C490B3223D72B60B6356F77BD4AD79304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
6	ipinfo.io
35	ipinfo.io

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1681431582\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1681431582\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1681431582\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1681431582\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_692381167\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_692381167\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_692381167\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1681431582\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_692381167\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_692381167\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\english_wikipedia.txt	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5248	msedgewebview2.exe
5248	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5760	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 5760	5392	5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe	89
PID 5760 wrote to memory of 764	5760	msedgewebview2.exe	90
PID 5760 wrote to memory of 4676	5760	msedgewebview2.exe	91
PID 5760 wrote to memory of 4676	5760	msedgewebview2.exe	91
PID 5760 wrote to memory of 4676	5760	msedgewebview2.exe	91
PID 5760 wrote to memory of 4676	5760	msedgewebview2.exe	91
PID 5760 wrote to memory of 3760	5760	msedgewebview2.exe	92
PID 5760 wrote to memory of 1288	5760	msedgewebview2.exe	93
PID 5760 wrote to memory of 1288	5760	msedgewebview2.exe	93
PID 5760 wrote to memory of 1288	5760	msedgewebview2.exe	93
PID 5760 wrote to memory of 4584	5760	msedgewebview2.exe	94
PID 5760 wrote to memory of 4584	5760	msedgewebview2.exe	94
PID 5760 wrote to memory of 4584	5760	msedgewebview2.exe	94
PID 5760 wrote to memory of 4584	5760	msedgewebview2.exe	94
PID 5760 wrote to memory of 4584	5760	msedgewebview2.exe	94
PID 5760 wrote to memory of 4904	5760	msedgewebview2.exe	98
PID 5760 wrote to memory of 4904	5760	msedgewebview2.exe	98
PID 5760 wrote to memory of 4904	5760	msedgewebview2.exe	98
PID 5760 wrote to memory of 1372	5760	msedgewebview2.exe	99
PID 5760 wrote to memory of 1372	5760	msedgewebview2.exe	99
PID 5760 wrote to memory of 1372	5760	msedgewebview2.exe	99
PID 5760 wrote to memory of 5248	5760	msedgewebview2.exe	100
PID 5760 wrote to memory of 5340	5760	msedgewebview2.exe	101
PID 5760 wrote to memory of 5340	5760	msedgewebview2.exe	101
PID 5760 wrote to memory of 5340	5760	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe
"C:\Users\Admin\AppData\Local\Temp\5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5392.832.6041059751055949558 /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView /prefetch:4 /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x160,0x188,0x18c,0x16c,0x194,0x7ffb02455fd8,0x7ffb02455fe4,0x7ffb02455ff0
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView" --webview-exe-name=5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,8564577908559911970,9800934928375935007,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView" --webview-exe-name=5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1768,i,8564577908559911970,9800934928375935007,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView" --webview-exe-name=5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1768,i,8564577908559911970,9800934928375935007,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView" --webview-exe-name=5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1768,i,8564577908559911970,9800934928375935007,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView" --webview-exe-name=5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1768,i,8564577908559911970,9800934928375935007,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView" --webview-exe-name=5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4540 --field-trial-handle=1768,i,8564577908559911970,9800934928375935007,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView" --webview-exe-name=5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4552 --field-trial-handle=1768,i,8564577908559911970,9800934928375935007,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView" --webview-exe-name=5f9dd24db4a8d1bd4bbfb5900af8983e9a88b2afb9e898b55802f926c848a525.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=1768,i,8564577908559911970,9800934928375935007,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:200bd7c13927337c7329c2ba68a8e643ff120786
    3⤵
    PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zen-gate-icon.ico

Path C:\Users\Admin\AppData\Local\Temp\zen-gate-icon.ico
Size 27KB
SHA256 2aac83c7cf1aceabfa7a0998234131ceffa85b437b4e1f8e5b9535b5538514af
MD5 ec2bc308e514178a0e2c3d0c45b6fc2e
SHA1 44a44d663e147a237b7817f0f256b5f330344084
SHA512 c1eae7087df077460591105a694bf19ea336a1e24d353c821e2af75d6ee96995f1a59d3c3e63cecf0e77040af0b8898c1ad8390798f0e44121174883b79d39da
SSDEEP 768:NcTDynAVhpn9eZsXWsOZBRdI745nFu8fjd8MG:N4n9plkjMkFhBFG
TLSH
T1D5D2E1BEEA21E52ADBDEE7B30696541EFFC6132838C40097B54E38361732784E130756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36beb3fa-0630-4db0-bc06-786399a20a59.tmp

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\36beb3fa-0630-4db0-bc06-786399a20a59.tmp
Size 3KB
SHA256 76c31432f8058682899c1e03043f3d3efe94d742955ca9ac676cfcef04c6fdfd
MD5 04a89d1bcc8ce9f1097701e3e2f2a80b
SHA1 57905daa294d93388ed11bb3b2c015ccbc11c906
SHA512 28e36095e5e348f5869c37f91c11081f09f8256fa0d2d1a3cd5870760d48d4c5c9f8522282a2b434bb7b2cc7404a29b3ad1848babc0f8346e865ec02cd90c99c
TLSH
T12C619477A974AA678DE6DA05B9863B12BBB5606BE5813F95D5EC0F0C01D72980341C13
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 63db35b15f46c53f4f2d2e7b196f0c07c093411306109a620c2605a0a18ec7bb
MD5 6af4e71c8efd13386e61485d9c8e7834
SHA1 09438ecf3e67556df50a8e04ce09a185606c90c1
SHA512 3a79d2e4401312d89296f4abc89e2bac11e9af6efb64465da8e7f2ce07b7cb5f478e8354d0f579fbdf50e48401c075780fdcc6e79a395643b7914fa19302fc05
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 68e556cf68095cd95014f09fcda2d9ff31ec3d5ad8e1cf5f9d0ef70ffba52398
MD5 089e0113d85f6c61979c852476485553
SHA1 f58f375be0d5db42ec8615fdb9a684a0fb929e3b
SHA512 0e21ef632462a5a772f29411431c10cb729d3fb8e55ac785a948a159b153cb6bfe1f72bf051457a264b4d9f1a370b10f6be03fafc889b3725db9b28022316ef4
TLSH
T1FAD0122732018534C01024331003B5080444D20F800540816828859D5A441702E02441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

028e9bfd-e4ee-4c80-b8b9-1d7813b41a4b.tmp

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Default\028e9bfd-e4ee-4c80-b8b9-1d7813b41a4b.tmp
Size 6KB
SHA256 3cd8e6fe11fdf2bcada89c1b389512995dd9e824d6b1d20fd324544921ca75ad
MD5 957e581a15d4bd5eea9d6e92b9258b3b
SHA1 945498d504c744f4a8d15ad4d4104dde8209a0ae
SHA512 1c497c541ab3902f845d4865d0d3c7eb8040da5d5e5062f52d5161791d7b1bd991d1f0fb795bf78f1dadfc2b07a3571da7cf9a276544d6be8ed12bc07416a802
SSDEEP 96:stqgU/d40uzb9KkZo5h16Zd6s7/x+6MhmuecK6/1ejehK+g428XM1C7K:stqgYiUcoK6sV+Fe6/QjD6G6K
TLSH
T1E1D165025E2479BB8CCBE119BA39BA13E2F5603275D11E58E7FC462C08DA6CD6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Default\Cache\Cache_Data\f_000003
Size 16KB
SHA256 7aa783f42e80272cd2c177e23c104d82a06d4d86cda8170e3954c8274fb2cf72
MD5 2162482244534773a9904ebe5211ef26
SHA1 d81973ea9bb7aaf41f7973ff8879ade411c8af67
SHA512 7398098b4d71e5ab9ea6bbd55a1f7a00b63e210b74f0e9b2edef23ca4fa9e405b0b4cbc84d35450eb0ca29d5743f2e3799cad67d9764221ad4fabcbf3fccfc66
SSDEEP 192:n6hmXXNABEud2tcJKNXQe6lttYlcKgSOi6dZdmrPvvl4JR48vAfDT3YJZ2C0AO5P:xWdYS7LGYQfYZ67dv
TLSH
T1FF72736A26565CFC8B948FD26C0B2B95156D7633F18C6C0AC1E8CFB5ADDB6A0007721B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Default\Cache\Cache_Data\f_000005
Size 44KB
SHA256 4a443cd2d9dda03ade806c7596eafc4cb2a99956a3558dc5214d09038ae98020
MD5 a5cde0ee76e41bd5a2bfcf4a15c1ee32
SHA1 e403510f1ac5f1bab390affe47fa3f16fbacb7ca
SHA512 3aec54bf800bcf3f2019119427e4f30d9eda6e2afdc733474e5ce4ef67208b704020f0ef355fe0cbbc4b6f926b4bf2132f1d064d8971105b8fb521ba757a639d
SSDEEP 768:Hgh8LPfv3Fdo9uDpmIcmdGUf9nABq8W3TO9wmS7LGpzdb:AiL3zoe6Uf9nT8W3Tscuzx
TLSH
T160235DA9031EBCFD4F884FD16D0E2798252C2537E1A8CC1DD3ECCF95AAD9AA5019B117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

9868201c-3f6f-4ef7-818e-95b6f71f2d7a.tmp

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Default\Network\9868201c-3f6f-4ef7-818e-95b6f71f2d7a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

caf5f0f8-2e0b-460c-b092-db8363d16fe3.tmp

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Default\caf5f0f8-2e0b-460c-b092-db8363d16fe3.tmp
Size 6KB
SHA256 9928c0e4f38b3032cd68a0faacb52166a1ed7db3096b1b31fe9101737d38911d
MD5 7f08fd57829b5c1373e607f2e7ed53c4
SHA1 000cd7071669643d00cde8082065c0b654e16999
SHA512 dc3bb46d2a5557c464cf66f637b31236e7056a88101dc2fd003965dfd0ad18031f5a9827af06e2b4f579107b9caa1e73760ffd321625cf645b564437cdbe5256
SSDEEP 96:stqgU/d401Gzb9KkZo5h16Zd6s7/x+6MhmuecK6/1ejehK+gP28XM1C7K:stqgYiacoK6sV+Fe6/QjDRG6K
TLSH
T143D176025A2479BB8CCBE119BA397A13E2F5607275D11E58E7FC452C08DB6DD6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Local State
Size 1KB
SHA256 c0699b51ba42a525ceb8950cbaee744ecb5372101f08a91cb46caecb93ac9dae
MD5 9b1665428b0b7799515e313f6141d00a
SHA1 d24c225b3e2b11d81ce79566a91a5c95f5c6c863
SHA512 8cdb1fae16c541e62232b6e756d8de49a2201771cba30b533fed769b4a8dcb16d3d1569eaf1091bfe0b7f4ce0ebac0378d1700c69b336d5f90ea6e42da55113b
TLSH
T11D2172F2E5246BB39CD86B062646BA976E3020FF91408A0075DD0F1C01E318C8725C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\Local State
Size 2KB
SHA256 40bf59236e6836dd9251c0aefb668f0e0adea5afb930688bd2b94b1cf2eb4435
MD5 ee820ad527256a887db9c2497371cef5
SHA1 1add628902b74a56358bfd6d71ed6cddbf19e2d2
SHA512 7779d3b8175dac3add86bb49d3a2e1a6fe478a619150515eb73b812c24fa046d08e870e65bfd2d93c08fe39796410b66b86db977d9afd35b4ec94dfb43ffd5b9
TLSH
T138519773A914ABB7CDE69B097D4A7F23DE3960AAAA512F50A9DC0F1C01D725C1301C73
MD5 SHA1 SHA512 TLSH

Submit Download

c3ad46f5-699a-4366-81cc-f21d324c6a04.tmp

Path C:\Users\Admin\AppData\Roaming\zen-gate\webview\EBWebView\c3ad46f5-699a-4366-81cc-f21d324c6a04.tmp
Size 15KB
SHA256 83b550f0bd49ecb2053f06e4c5d80bebc4477af681b2e1036afa20872bb2d284
MD5 a047942a6b8ef947f11cacbd692bd52a
SHA1 f25c6ca3171b26941ad2a049a1026b99f0630da1
SHA512 52fcdc725b3318e6924691594211f0df0b3f00d1392be3e33f15aa75785cab8bb50a4fea2dc9cf983dd75b050c8e2b7d15741b2f1c03ec7fc5224f98f27bac21
SSDEEP 384:q+OBqImmJvGBLx3NaFMJFNNBSxjCXQ6eg6rs:/cvGtlNmqQ6oI
TLSH
T18272ADBB19656EA32CBBC909BA8E3783DA756297C0C177E5DCEC4F0F21AB0901352951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1681431582\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_1783720796\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5760_692381167\manifest.json
Size 102B
SHA256 4a918873dddefc4e395c8a9f8580c8f03c9a37512eb7da6e6454730be756fdac
MD5 bbd743ed25bbba94c85d6d7310c4fd45
SHA1 d19550c1895576761ab76f3ba9bb813511002bd8
SHA512 070aad3473150ba7388e2305f3d5dff14c69a4b468609fa38e1411e575d271d63cc1bf4083d63372b4d244ee5031bd40933f5f68f041c9650999509666e219e1
TLSH
T1B0B01220EC10B4B30004436C0C6CC3C073272F032C4079180DE59F84E90E9DBE071529
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4584-129-0x00007FFB23900000-0x00007FFB23901000-memory.dmp

Download

memory/4676-44-0x00007FFB23900000-0x00007FFB23901000-memory.dmp

Download

memory/4904-286-0x00007FFB233D0000-0x00007FFB233D1000-memory.dmp

Download

memory/4904-285-0x00007FFB23700000-0x00007FFB23701000-memory.dmp

Download

memory/5248-370-0x000002E29CE30000-0x000002E29CE31000-memory.dmp

Download

memory/5248-377-0x000002E29CE30000-0x000002E29CE31000-memory.dmp

Download

memory/5248-374-0x000002E29CE30000-0x000002E29CE31000-memory.dmp

Download

memory/5248-378-0x000002E29CE30000-0x000002E29CE31000-memory.dmp

Download

memory/5248-379-0x000002E29CE30000-0x000002E29CE31000-memory.dmp

Download

memory/5248-376-0x000002E29CE30000-0x000002E29CE31000-memory.dmp

Download

memory/5248-375-0x000002E29CE30000-0x000002E29CE31000-memory.dmp

Download

memory/5248-368-0x000002E29CE30000-0x000002E29CE31000-memory.dmp

Download

memory/5392-6-0x00000211FF540000-0x00000211FF568000-memory.dmp

Download