b7c748fa58f55f93cca972992a80e39570e70d71b868864b7e4236a0c07e0bc3

Analysis

user interaction
yes
max time kernel
74s
max time network
68s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/10/2026, 19:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hackerai-desktop.exe
Size 7.0MB
Sample261029-xw51easvft
SHA256 b7c748fa58f55f93cca972992a80e39570e70d71b868864b7e4236a0c07e0bc3
MD5 fcbbbf3c22461dbeec68da71200f3c8a
SHA1 5fe12cf983c78f1cad429a67d08458ece0f09566
SHA512 eaefc1b6ce0202fe7815f5c4d61c4847809d42f91582787748a355e3b8da0ee93857f70de39b62e8e1f8c8929181da181a60ebeb8ebefa981e14c506f827d451
SSDEEP 98304:scRr2p05nTbePWXtBFNzF97OUNQxjQ8nBn+:R58qtBFNX7yBQeB
TLSH
T182762903F59181E8F05AC17483DAAF33E6F2BCB94920B2AB5AD47A212F75E507E1D744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hackerai-desktop.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	hackerai-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	hackerai-desktop.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	hackerai-desktop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	hackerai-desktop.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\hackerai\DefaultIcon	hackerai-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\hackerai\shell	hackerai-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\hackerai	hackerai-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\hackerai\URL Protocol	hackerai-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\hackerai\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hackerai-desktop.exe,0"	hackerai-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\hackerai\shell\open\command	hackerai-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\hackerai\shell\open	hackerai-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\hackerai\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hackerai-desktop.exe\" \"%1\""	hackerai-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\hackerai\ = "URL:co.hackerai.desktop protocol"	hackerai-desktop.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	hackerai-desktop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3888	msedgewebview2.exe
3888	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
956	hackerai-desktop.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 3888	956	hackerai-desktop.exe	84
PID 3888 wrote to memory of 2188	3888	msedgewebview2.exe	85
PID 3888 wrote to memory of 4972	3888	msedgewebview2.exe	86
PID 3888 wrote to memory of 4972	3888	msedgewebview2.exe	86
PID 3888 wrote to memory of 4972	3888	msedgewebview2.exe	86
PID 3888 wrote to memory of 4912	3888	msedgewebview2.exe	87
PID 3888 wrote to memory of 4152	3888	msedgewebview2.exe	88
PID 3888 wrote to memory of 4152	3888	msedgewebview2.exe	88
PID 3888 wrote to memory of 1248	3888	msedgewebview2.exe	89
PID 3888 wrote to memory of 1248	3888	msedgewebview2.exe	89
PID 3888 wrote to memory of 1248	3888	msedgewebview2.exe	89
PID 3888 wrote to memory of 3024	3888	msedgewebview2.exe	90
PID 3888 wrote to memory of 3024	3888	msedgewebview2.exe	90
PID 3888 wrote to memory of 3024	3888	msedgewebview2.exe	90

C:\Users\Admin\AppData\Local\Temp\hackerai-desktop.exe
"C:\Users\Admin\AppData\Local\Temp\hackerai-desktop.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.70 --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=956.1712.8938773381038372567
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fffc60eb078,0x7fffc60eb084,0x7fffc60eb090
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1784,i,7479204871163577032,1187290942803540471,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2080,i,7479204871163577032,1187290942803540471,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2380,i,7479204871163577032,1187290942803540471,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3584,i,7479204871163577032,1187290942803540471,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView" --webview-exe-name=hackerai-desktop.exe --webview-exe-version=0.0.70 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3824,i,7479204871163577032,1187290942803540471,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
    3⤵
    PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58066d30-5502-452e-acee-b85f578adb42.tmp

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\58066d30-5502-452e-acee-b85f578adb42.tmp
Size 2KB
SHA256 1e39c518e747b122c7088b82e780070271220d38734c617b7413885ef8827de2
MD5 0701bb77161e79a2a34296424c88efdc
SHA1 90e81ec34e687d3fe1ad8544353a3ff81fbe98ab
SHA512 055f1fd707dc2b96f5addd6536a311473f42b4639c4fd9b2216f5643fb0c4422bdc579ca2aa4ecfc460e5d6de4090efa3d90425f0152a90f0973abf0f1fc13bf
TLSH
T106519472A944AE3789E2D784BA0A3F13EF31516196A22F94E7DD0B0C01D725C6317C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 82f48aecf406a1efc5643ac15dbcce67443c02026230a5ef2aa722745723af78
MD5 45302db7db237a129d9f77bb64f36e6b
SHA1 d93ca858179325696618449ba6c4dc44d3c085a4
SHA512 624cad98be1c803e0dd47e95649d3319d557ed9a66f8c579ed0069848912b480775aa39a00d3726668cefc3760683182764dc38e74f4a37a1936471234168a30
TLSH
T10BD01212B6418234C02030330902660F1410C10B424A8444A43C956D1A040641B174E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3a50c2a99119a14624f6c8fb080006bfaf054f3091c4c98082482544e807dcbd
MD5 5d2cf3013a1883fee3eaf7f73c61ce27
SHA1 1dfa8beb23e5e30477c1b44dbd9da95b93bd5f2a
SHA512 29faa6743833f4fb8f9653029ed722eff13798c68f7b2a4f7e10434338f7b5e1bf75d9cb31123ef9ba631ea8d8d7c63f2543ed881f1834c9138061d3df23fb52
TLSH
T17CD00410D540C110C01130310D1447071130444107574D5450341054044101453171F0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Cache\Cache_Data\f_000003
Size 22KB
SHA256 5f3d6ad60f29d6cb708414ec6887163d63bf197377ef5417d2483ff31ace6c3b
MD5 cd5b25781181c5c03d99ac2cbf88016a
SHA1 0e04bb6e7b54057d64c421b959c8c22774ae632d
SHA512 f41989a87c7438a19dff3325c3546aaad0039f2433b4fe8550f3831bb01acfae9956c3e6d402d83fb6c38df647156cab2e4ed2ccc321007e858760e9af7ffe6e
SSDEEP 384:4CAnZnTSz1wLaDPA2knsJ9ufQnGaWPegCLyUrMF97Vg8RWP94KiBjJRMbkcYCaXp:4CAQzec94U9uonMP7BF97V9RWl4KyLMW
TLSH
T1AEA2D004C129AC1911B6017780694CE99EEF64D51CAC357F9CBE2CBADDB5252FC3BE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Cache\Cache_Data\f_000004
Size 28KB
SHA256 9b6f5ff45b278c744b5f379a2c4ecbaf858a842b8eaf82ac8d21b699ca16c608
MD5 f4634c3bc1fa7cb53247e1f2872adb5a
SHA1 9d846db84c501327431670fe23b1a8ea1d2a5349
SHA512 e480a1ca3a52fdfd2f59daf185b56c9f203c4b0daa7a36537410ccefee9bfab229308145026aeea53a49d02cd7f0e89de8d4c05ec15fe80a2b09e754197afa49
SSDEEP 768:ePXLNqwQ5RnlpBAyv/2+NR6C36OojNMUp06QIhgXZY2Ko1K:e/LNHQtpBAQO+NR6k/eFp06zE0
TLSH
T127D2F155036F442269023B6A0619A9A0C172469FA9BD73C2407A6A931F67FD7D37DC8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 f4a45692d3374f1c4dac6e22bb89f6abe481b23bde14ee4241752ef376500c37
MD5 6cffdfab5345a5fa0740e7ac2d30caf0
SHA1 0527a829390604db0b20235aa59968e154ed3a05
SHA512 2695bdcc82b6eb34652669b065c70717dc06b9b36cd08fac2f6df31d9d1b82c2c3a8ecaca8b77eb5a2f9ca3682f1f230d1ad6604fabe15a9c3870fba1ec666f8
TLSH
T10A11DADCCAECC04DCF6629B814FD9E00F7BB052456C79F07C8A401B2E843BE12194D56
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 51e7874b74a394d196c39bd454d73f3e874037e296c0f7e31d7e31b306075f97
MD5 da4e75ce6594bb4d0c471ce0c246a048
SHA1 717d2850949b917217259427328b0815024b90de
SHA512 7b7fd5187d31c8b19aabd12aae8dfc80fcd6b7539394a1592765b7ca6fe6a09668b5b5cd4f5062141cfb48b1a14a184390ef76f6e8b2337d290ec306ad03f905
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 a0808811b38a4de1212f4327ca8874b25c4f6431e9260c3cc7c030b482336e7b
MD5 f7f07d3fc0d430b930b725a9237087a4
SHA1 c404bb0cba4caea1400c07ed428dad2232a8a785
SHA512 4b50ae714b30a74bfa11c10c021e1901676647c9af181b21470c5953111efe5b779a4395c595a19596d741f051e6d3308d7d73b44f92c4f06e16d6ee67115f5f
SSDEEP 3:LstlNllkll/lhFwY+l/:LsX3lEtzta/
MD5 SHA1 SHA512 SSDEEP

Submit Download

1e082e8b-fa22-48f0-9674-5bbc7c5cca4e.tmp

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Network\1e082e8b-fa22-48f0-9674-5bbc7c5cca4e.tmp
Size 356B
SHA256 0c8689708f51242b628e11efd5665ffc694c2036091f91a661ecb5f2f95db0ce
MD5 0830f1d797d63c8b682abf9bf288efd0
SHA1 e7e270b71ccecb2e2878351165d0b60281b42454
SHA512 b845bc46eddcffa668bbbec048790d297d03902e1c62d9f87a7bc50d68fe876d7e1fb165034bb1819542167295c573dab822fbe11c8e16fdf43be849a8db6518
TLSH
T146E068BA037448BE4B66C3B86A28691FCF6D0002432C293A8AE42B6287A24A4D024907
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\Local State
Size 1KB
SHA256 15a9d51d9566d333b7005f33d880083ce2b4f18fdeade9b586832e819a56ebbf
MD5 5ce5c61f32d87c1a0777ee47af2e530d
SHA1 e057535658a6be6dac2b2c08dc4c6fb28443d043
SHA512 5081db379e8856ebafc41affe4513153ffc377ec502a37898aaf18a771858330c42861120733849918025b79c55faff6a1abaf734d038fc7d01a7358764329f5
TLSH
T1FD211072C895BE329985A695B317BB8B6E20522581254E4CE3CD0B5902E72ADD73BC33
MD5 SHA1 SHA512 TLSH

Submit Download

bbca7725-706d-4144-8e1e-a6b1dc0772d4.tmp

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\bbca7725-706d-4144-8e1e-a6b1dc0772d4.tmp
Size 16KB
SHA256 febbd125fc027242ff410b035b91c07e60584e42a7c9dda194b686f77df3408d
MD5 58fd0b4f71a31059db0fd64d3ca5269b
SHA1 feb3481bccd47d122191b30fff51afc76b1350e2
SHA512 99d0465cb3993d68f115e43e638828c723394c7bcc2f3e9886bef04073ad82e9d283cd46cb5cd839aa64d6becd8822f6007d97f2e4da519bfd44b384dc436262
SSDEEP 384:zK+OBqImmJvGBLx3NaFMJFH3Nbn++RaQSlhng6r/:7cvGtlNHIiaQkTz
TLSH
T18A72BF7A1CA5AE232CE7C549BA8E6B0BDB612263C0D57FE8DDDC5F0E026B1441353D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf746a9e-bff0-4268-8cd7-1e98d0c91837.tmp

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\cf746a9e-bff0-4268-8cd7-1e98d0c91837.tmp
Size 1KB
SHA256 7fe988c63464ead5fc34272a521fc2b81de061371c74d71466166163081c5123
MD5 745c04bd9ba9ad0797274d8a2241b288
SHA1 0d0098ffd9fd557ce0344a1f3538cfb258486020
SHA512 212732df83c13f2593fd87cea3422b3af4baa43aa2306f3c6e5499ab843da94b31dab69f24f6c77d99bc2bc824e6404e33903eb19f9984cc879356a85a56bb6c
TLSH
T13E3142B1D5906F3298C1E795B306BB5BAF211125C1654E8CE3CD0B5802E729DE63BD23
MD5 SHA1 SHA512 TLSH

Submit Download

dc37f485-338b-4cb2-995a-d891eb015370.tmp

Path C:\Users\Admin\AppData\Local\co.hackerai.desktop\EBWebView\dc37f485-338b-4cb2-995a-d891eb015370.tmp
Size 3KB
SHA256 a5952d279b07925e10e691176854a658c54073c39e2b8d61ef83e7d8711d1855
MD5 3c831dc9d531b220f41541caa6931433
SHA1 86ae5678734aded117c0558ddcf6829e9ccb59ca
SHA512 81495d63faf84a5611a46ba18f82a9902f15ad9d55ee27cdb06d305ce6f45cc4d6cb77c1bd9fad3de32171d73cfbf0d4e40640c8913ce97d0ce1aa7906090b34
TLSH
T1B271A622A9A4ED378DE2DA44BA862B17FB611132D5D53FD8DAEC0F0C01D73982352C17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1248-119-0x00007FFFE0C30000-0x00007FFFE0C31000-memory.dmp

Download

memory/4152-121-0x000001A4CD5D0000-0x000001A4CD5D1000-memory.dmp

Download

memory/4152-433-0x000001A4CD5A0000-0x000001A4CD5CB000-memory.dmp

Download

memory/4152-120-0x00007FFFE28C0000-0x00007FFFE28C1000-memory.dmp

Download

memory/4972-432-0x000001F4CF260000-0x000001F4CF374000-memory.dmp

Download

memory/4972-28-0x00007FFFE0C30000-0x00007FFFE0C31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads