8faf9ebc7b5171ee5000d464d68a69c1119b883eaae4cbed3d748ae27b2bdb94

Analysis

user interaction
yes
max time kernel
899s
max time network
844s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zenith-cracked.exe
Size 22.1MB
Sample261104-y3myvavset
SHA256 8faf9ebc7b5171ee5000d464d68a69c1119b883eaae4cbed3d748ae27b2bdb94
MD5 4d7c9c1744b7b64a00378737eaae90ab
SHA1 23fa160139867030d3d2969896b096f363756c47
SHA512 6678007d5cde7998e67c85496936ee59abc7cc31759f961c217f3c5028f68982b5b1aa69df7b9102fd3950a7d8c0e8ed24574ec6c7be434e74c36c748181e248
SSDEEP 393216:Vn+Evc2RADK1zusLOdwPszfZ5Bqeu9qwEE:V42R9z1KdwPC5Bxu
TLSH
T17C378D03F96254E8C1AAC175866A6233BB71BC49473137EB1B90AB203E76FD06F79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3888	msedgewebview2.exe
2524	msedgewebview2.exe

Executes dropped EXE 1 IoCs

pid	Process
4036	znx_inject.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zenith-cracked.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1504	msedgewebview2.exe
1504	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4372	zenith-cracked.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2524	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4372	zenith-cracked.exe
4372	zenith-cracked.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4372	zenith-cracked.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4372	zenith-cracked.exe
4372	zenith-cracked.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4036	4372	zenith-cracked.exe	85
PID 4372 wrote to memory of 2524	4372	zenith-cracked.exe	86
PID 2524 wrote to memory of 3232	2524	msedgewebview2.exe	87
PID 2524 wrote to memory of 884	2524	msedgewebview2.exe	88
PID 2524 wrote to memory of 884	2524	msedgewebview2.exe	88
PID 2524 wrote to memory of 884	2524	msedgewebview2.exe	88
PID 2524 wrote to memory of 3308	2524	msedgewebview2.exe	89
PID 2524 wrote to memory of 1480	2524	msedgewebview2.exe	90
PID 2524 wrote to memory of 1480	2524	msedgewebview2.exe	90
PID 2524 wrote to memory of 3888	2524	msedgewebview2.exe	91
PID 2524 wrote to memory of 3888	2524	msedgewebview2.exe	91
PID 2524 wrote to memory of 3888	2524	msedgewebview2.exe	91
PID 2524 wrote to memory of 1504	2524	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\zenith-cracked.exe
"C:\Users\Admin\AppData\Local\Temp\zenith-cracked.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\znx_inject.exe
  "C:\Users\Admin\AppData\Local\Temp\znx_inject.exe"
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --remote-debugging-port=9222 --lang=en-US --mojo-named-platform-channel-pipe=4372.2356.5731439615447113563
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff85e2bb078,0x7ff85e2bb084,0x7ff85e2bb090
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,11323934259690705589,18053507928806263824,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,11323934259690705589,18053507928806263824,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,11323934259690705589,18053507928806263824,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3628,i,11323934259690705589,18053507928806263824,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3964,i,11323934259690705589,18053507928806263824,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 215625f41e455cb47547a488ea898c4948ad7eecf7b59765ff118e1d954356b4
MD5 597d1b45a5833ee8497c93a4acde1ff2
SHA1 6f4a361553ac6f1d44b98a2b6abcd88d89c0a88f
SHA512 32f00730e2b05db561f773a027c8c0fc832beb5a44e8a0fc6d1723d47a22362f07de635c26a799c3d19a29a5779c359dac7af8585bf08ddc6b638ebd0e095a67
TLSH
T1EE412658BAE91048B3B36F5A6BF6A86E487FB9372F07D49D00110D4E4B22B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

znx_inject.exe

Path C:\Users\Admin\AppData\Local\Temp\znx_inject.exe
Size 6.7MB
SHA256 e09d8cf2169e25f61d7c1e54194af32f28f92b47eb6d3befa5371fdf69b521f2
MD5 ed6f831ff32342fe9cbe807129f0b871
SHA1 fe98bff78a4d6c51defcfdd1a87b07ab07a59c0d
SHA512 77be834f8a3af7bae54fbc518cfefa932e9b83a8db6fa5bdf4635d064d7c5c4d72c77fe93987de32c1272249a15dbfad80225bec3d60970066f82f68b642c322
SSDEEP 49152:3zQdfaIKYjwfcO+0+81TRug6VrI/Lsg4wusUlq1csq9dmyrmggyx5MaAKCK5KwZE:3Udjry+81uPIq9sy6g9ZMwTE
TLSH
T1B5665917EC9918E9C1AED13089679112BF71BC494B2123D72B80F6243F77BD4AEBA354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0721adc6-18f7-4fba-8591-ea8ba3e44b01.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\0721adc6-18f7-4fba-8591-ea8ba3e44b01.tmp
Size 5KB
SHA256 c6160a394e40860b53fe24bbcfb3c269af4cc32fd029bc5a38a97a0443786efc
MD5 3ad025155e9f55f555fc7b31d44c9e4c
SHA1 0d1247ea7ab49578f5be7e911819d8f8d7d8b944
SHA512 a73f5f3de5de8e867b563652b689d5328c810e96af2d48a9ac03a0b43ea2672599adc03ef8ef08223cde2aa02cff6dac142d8bdcad856b290c4fb4c230ef8c22
SSDEEP 96:zuf03NkCbTfePUzE8Frh/cInURoDoto+5dH7DdHBLQA1PC6M8/sRnYZRyTZyTulK:zx3Nbuq7ooDUhJHUA9/sRc6qt
TLSH
T1C4B1A531A8A4A63B5CF3DB85B9473B96B6B14167E5842FD8C9DD0F0C029779D2382C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

504eacc8-5ce3-4626-a898-2f78f83d83e6.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\504eacc8-5ce3-4626-a898-2f78f83d83e6.tmp
Size 2KB
SHA256 0e1a07ce4d666d33124ebf0b6f7ea578e18d7c55d438c6364f69ca8ce4fb4bb8
MD5 f6f45f9c22d8bf45288c3f48797c0780
SHA1 8ab18f37fa8ee5fbc4ea854aed93d990bb42824c
SHA512 f3a7a49acfddefdcef97cc2b27aac935bacd2ccdd51e573997157545e7c5cec2823b24fdda9b40b7fd5da2ac9fb2b18129b134a4b4bcc9dda41f1e7e4173b074
TLSH
T1BA51C573A858AB3B99F38F04B94A7F17EA3590659A512F94A5DD0F0C01EBA5C2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

59b22c7f-0f32-4ba0-b863-b863525e59dd.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\59b22c7f-0f32-4ba0-b863-b863525e59dd.tmp
Size 3KB
SHA256 4b0888e4d52cf8a645a200283ebb12a195ea19ed508b9f7538ebaf560857e3de
MD5 7a5d8920d2bd132b2fa66c59643a2c06
SHA1 99bc16b469dc956088f5d8a8053f63f42cf64e0e
SHA512 4e069616f903227b1aa95ade1da7a3bf4f0a7062bef55bac11835370c147e3a8cf1049a2ed175b428805fa5ea70841682331f095f943f52cb86ad3f37264dbf3
TLSH
T116718672A8A4A63B5DF39F05B8862B1AB6A55037E5913FD9D5EC0F0C01DB79C2382C17
MD5 SHA1 SHA512 TLSH

Submit Download

5d9abb8c-00c4-4272-82a7-66c1b9e7f012.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\5d9abb8c-00c4-4272-82a7-66c1b9e7f012.tmp
Size 4KB
SHA256 65b260ad9716533a80083bb2e0054d26fccfb2e87ab99b23207069df3cf0be4e
MD5 45a8f22c17cb4a3aa1d5ce47dec4d73b
SHA1 6c18cb6c8b907a6d6d09f3dbb987e8e3d48e0c0a
SHA512 5081f980fc93992f3a555c34242a07e49e8d795818c692dfa802bf7f4025c05b79ddba47e41747a58b83815ca88f26c984ff0178aed6194fa7038b6722e28523
SSDEEP 96:zuf03NkCbTfePUzE8Frh/cInURoDoto+5dH7DdHBLQA1PC6MjZRyTZyTul3a:zx3Nbuq7ooDUhJHUAi6qt
TLSH
T171919531A8A4AA3B5DF3DE05B9563B06B6A15026D5903F95DAED0F0C019B79C2382D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

805b00e8-1e0d-4b9c-afe9-67fae45cd518.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\805b00e8-1e0d-4b9c-afe9-67fae45cd518.tmp
Size 3KB
SHA256 edf387fea6b77bb08a18949c8bcc17c729d40420122c412adfff888b8c3202a2
MD5 5103b4f23ec533f13724d55ee7d8d3cc
SHA1 2bb5e49568970a3b675c93e97ed69fdccba10492
SHA512 beaef9d762213dbeb16e38195960c9e6a3a777f4fdfd1c6adbf63502d863b663287c30e27188deeac4c17e394e46567ba9f96b9ccf0af0585c5a1eefbbbe6528
TLSH
T15D819432A4A4AA3B5DF2DE05B9862F07B6A55037D4913FD9D9EC0F0C01EB29C1382D1B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4ded82a1f215cc724f9e8334a1e35eb0573a339af2407d843939708f8461b7e9
MD5 06eeb26151337631fb8bcd93d0f93986
SHA1 563a8ba1ebc568ef0e56f2fe4e91c52a360e119d
SHA512 c78c66bc063c72750c88a70da3a06c7fb8212e19b4c2208e8e91b6384acc757897809b387e2a09963296e5b06f62e2d1712d2ac6316d51e612a4e281d97fac61
TLSH
T184D01227721515B4C1103273010772090404C50F80554100642DD53E6B140940D32882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cb4d46118eeb0c99e6335aaaeeee3f32ca3c21070fe4027bfd785ca6fb81e401
MD5 3f60804239693ed07ffa4f0608d6c5c9
SHA1 eb665938d144f09f3e9e69c8040c3df70793d47e
SHA512 f721256d117435062f7c9d55d0ab411543fdb7bc9e3074ebe5bd4fcb044aa970129bba6f7d9fd92b01451099660a1ad1f53b4942a2a3b77c6ac0f9508879462f
TLSH
T161D00475D11C34C0C3443371011D7301410C4C44407107001115503555510440471445
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 ccf437340d11c01471da4e509c15e647ca310cfa79d09a6303ba313faf282c68
MD5 dd43c6db6d2348adda3856a98d5ee822
SHA1 5da27a7505101d322ad306486acbe2f8c4810012
SHA512 2cce008736548abebd9cc3da56f25b6a41f427f31f369053f2ab3371b12899aa6c5ca4b76cb27ee3446f726e6984d1a31a40a553cb7b03d1a5f1f22b640bc772
TLSH
T15EA002606AD59801C96402F3E0970694271D8DA10992C707A1B2008E8D72AC472A2201
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5bc96b90784bf0c615a3c9ac1d206ec00d08023de12883b90600dcc8e3df510e
MD5 d94bc156a995899ff140cd6e87111815
SHA1 6ec1d8a107f4a869f86acb0ed03f29b2d2b99a11
SHA512 8fd6913f38dfabd0ba40a6f40d8c0c7d7dab214246da0574e109f77fdde754d9fbc7d48db3a56065e0780840688ec62e9b58c858c771de25c86580171daf7273
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Preferences
Size 6KB
SHA256 e6e8049240830b61a7192983bfc8446be662598efd627e1d86623d0f3ed2aa6d
MD5 b4a8f0a79015ac5e275a516fc27b64ac
SHA1 acab55545777b025093e7d0d4c7308c00e461c6b
SHA512 027bd5dd163bea5b58bfd1785dd46e05684e1319a8c6db668f767a3686b9213889f000bc6b585c404d0e7a310638bb2a0e230e0c0bda4cc5bc956a43bbd36da5
SSDEEP 96:stdU051yrtqkb9jrff3XGdZ8i0oEKektGm/7qx+WVHMSm+uecJ4v1idQjUw+gSQh:stC0X0rfwZ8pFuz/S+WiT4vwdAeqM8
TLSH
T130D1C9026F78797B4CC7E609B935BF56D2F6106161D50E58EBFC862C08E66CC230B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b6368f69-2236-401c-ab38-95c16292b917.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\b6368f69-2236-401c-ab38-95c16292b917.tmp
Size 6KB
SHA256 855a59cf4db52ecfcda2ac4540d1f62fc8dfe1e71b4d43db6be95805e3736f63
MD5 7da9a520309bbf55fa7d4e128fb944ce
SHA1 358e4da0a6f4f1e03c8ecba77b3574e2dfd03a6d
SHA512 84cb84976c86309e806c4031244008b36ba10ab2172f3357494fbe8d885e6e04e1bc898e9874788c2629678aa1c7bf917ec5f5b175d99a1d2c825e03efe0d3e1
SSDEEP 96:stdU051yrtqkb9trffqfXEZ8i0vhEKektGm/7qx+WVHMSm+uecJ/8jMdQjUw+gwY:stC0X+rfRZ8pauz/S+WiT/8odA8qMC
TLSH
T15CE1C802AE78697B5CC7E619BA35BF16E2F5106261C50E98EBFC861C05E76CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Local State
Size 1KB
SHA256 9a0dbd3e01f25c50d5fff437e75c9cd100d8ec16bbe7cd892edd337248221f3e
MD5 7461e4fa8c418a01e398f3415f058eb1
SHA1 f8f133e611b792add7fe1878b879a275a4e9ed52
SHA512 62eb1b2984d0cefb460b5552ffb2940cb2f8467799d5ca435ff5b18cfbe0824dc42718859b3d7f80b2ffde759bda162fd623d9149b13ee64afaa69b6c3da88d2
TLSH
T1C52165B2C4E46B7B68A14F41B552EF8B2D60803991109E8CE1DD0A0802DBAAC53A7C33
MD5 SHA1 SHA512 TLSH

Submit Download

da199b88-6078-4c80-a436-5c0b1d344ed2.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\da199b88-6078-4c80-a436-5c0b1d344ed2.tmp
Size 5KB
SHA256 ac684e24650c88a2d25b8ca1a2467e6361c876a9d2fa5c8ee658a65c3356d693
MD5 16b0ac647e817d2d31862345f78642ea
SHA1 fe5ad957590c9f67d979895925371cbd6a09d507
SHA512 20d5eebb6e10730e29c0b3288fcf47982494a78de541c0d0713e5705eb708f787972cd9cc914411a048cb6863c1db03ff0e20c8337bc7fa1cafbb84fc97b599a
SSDEEP 96:zuf03NkEIbTfePUzE8Frh/cInURoDoto+5dH7DdHBLQA1PC6M8/sRnrlGKaIjZRh:zx3Nguq7ooDUhJHUA9/sRtau6qt
TLSH
T149B1C531A8A4E6375CF2DB85B9473B96B6B05122E5852FD8C9EC0F0C029B79C2347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e60caa87-cbf5-4e13-8a02-16dfe6d3e057.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\e60caa87-cbf5-4e13-8a02-16dfe6d3e057.tmp
Size 1KB
SHA256 1d3d0477794cbb12910ccb2c6f51a6fc3997772196fb001496e626aa4937675f
MD5 2115f6502cb72f5114fde18ebe193066
SHA1 834c802881ed95364ccb96930b2aba49dccc7586
SHA512 e83502d74106fd505b968fc569d27297d770f407d097b07539b09d0c0c776ff212fad11bab86ac398d41d45712f0eb129e936ec28c296c2511d6b90b0c1cb2fc
TLSH
T15431B7B2D4E42B3B6CE15F42B556AF5B6D21403991508ECCA1DD0F0C02E769C6366C33
MD5 SHA1 SHA512 TLSH

Submit Download

f91cabf5-d329-4f14-ad7f-55bb431d6bce.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\f91cabf5-d329-4f14-ad7f-55bb431d6bce.tmp
Size 4KB
SHA256 a658cbbe5dafaffcc3799abca43b09d893f2e5f4383fa02d384500d2a44e4233
MD5 be2271f6e697d9c6c742dd346931ec29
SHA1 fe3fd90bf23164bcf081430f49370f832b5a9aa5
SHA512 7e7a5c288c53be24d2a5fb8131157431b847a08dc7c9be3c70fb079aa80aff6827a13686e35802978b6071773c5f68646496fe1238ed56018d9a3fa6f8dbb186
SSDEEP 96:zuf03NkCbTfePUzE8Frh/cInURoDoto+5dH7DdHBLQZ1PC6MjZRymNyTul3a:zx3Nbuq7ooDUhJHUZi9Nqt
TLSH
T17A919631A8B4AA3B5DF3DE05B9463B06B6A15027D5903F95D9EC0F0C01DB79C2382D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.json

Path C:\Users\Admin\AppData\Roaming\b88ee372\app.json
Size 603B
SHA256 a1d78f7de83fdab989a707230995a7b976bbf5609b48a20b64ada62cb83f39f2
MD5 d29c2bef3b9e53474c28722509954b58
SHA1 ce18d7158bca267d881a746bc02055525794a4a5
SHA512 9f098bd97c40b1b6c456e5c91a1836d2431be265f20e30c0bb8f88b68c1c6fa9d5ed9141b6504064d13fa970cbe89fb55ccc3af1d8deec233773a84645077a48
TLSH
T10FF02204C2A5487700DC8A3A887E612367104DB7065A3D2DF622CD2C2F4E62B37F8CD8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/884-31-0x00007FF8799A0000-0x00007FF8799A1000-memory.dmp

Download

memory/1480-88-0x00007FF87A3A0000-0x00007FF87A3A1000-memory.dmp

Download

memory/1480-87-0x00007FF878830000-0x00007FF878831000-memory.dmp

Download

memory/1504-320-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/1504-321-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/1504-331-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/1504-330-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/1504-329-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/1504-328-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/1504-327-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/1504-326-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/1504-325-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/1504-319-0x0000021F025D0000-0x0000021F025D1000-memory.dmp

Download

memory/3888-160-0x00007FF8799A0000-0x00007FF8799A1000-memory.dmp

Download

memory/4372-3-0x00007FF735E10000-0x00007FF737438000-memory.dmp

Download

memory/4372-218-0x00007FF735E10000-0x00007FF737438000-memory.dmp

Download