8faf9ebc7b5171ee5000d464d68a69c1119b883eaae4cbed3d748ae27b2bdb94

Analysis

max time kernel
899s
max time network
839s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zenith-cracked.exe
Size 22.1MB
Sample261104-y3myvavset
SHA256 8faf9ebc7b5171ee5000d464d68a69c1119b883eaae4cbed3d748ae27b2bdb94
MD5 4d7c9c1744b7b64a00378737eaae90ab
SHA1 23fa160139867030d3d2969896b096f363756c47
SHA512 6678007d5cde7998e67c85496936ee59abc7cc31759f961c217f3c5028f68982b5b1aa69df7b9102fd3950a7d8c0e8ed24574ec6c7be434e74c36c748181e248
SSDEEP 393216:Vn+Evc2RADK1zusLOdwPszfZ5Bqeu9qwEE:V42R9z1KdwPC5Bxu
TLSH
T17C378D03F96254E8C1AAC175866A6233BB71BC49473137EB1B90AB203E76FD06F79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1680	msedgewebview2.exe
1952	msedgewebview2.exe

Executes dropped EXE 1 IoCs

pid	Process
4124	znx_inject.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zenith-cracked.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1648	msedgewebview2.exe
1648	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4136	zenith-cracked.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1680	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4136	zenith-cracked.exe
4136	zenith-cracked.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4136	zenith-cracked.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4136	zenith-cracked.exe
4136	zenith-cracked.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4124	4136	zenith-cracked.exe	89
PID 4136 wrote to memory of 1680	4136	zenith-cracked.exe	90
PID 1680 wrote to memory of 4644	1680	msedgewebview2.exe	91
PID 1680 wrote to memory of 1264	1680	msedgewebview2.exe	92
PID 1680 wrote to memory of 1264	1680	msedgewebview2.exe	92
PID 1680 wrote to memory of 1264	1680	msedgewebview2.exe	92
PID 1680 wrote to memory of 1264	1680	msedgewebview2.exe	92
PID 1680 wrote to memory of 2388	1680	msedgewebview2.exe	93
PID 1680 wrote to memory of 5832	1680	msedgewebview2.exe	94
PID 1680 wrote to memory of 5832	1680	msedgewebview2.exe	94
PID 1680 wrote to memory of 5832	1680	msedgewebview2.exe	94
PID 1680 wrote to memory of 1952	1680	msedgewebview2.exe	95
PID 1680 wrote to memory of 1952	1680	msedgewebview2.exe	95
PID 1680 wrote to memory of 1952	1680	msedgewebview2.exe	95
PID 1680 wrote to memory of 1952	1680	msedgewebview2.exe	95
PID 1680 wrote to memory of 1952	1680	msedgewebview2.exe	95
PID 1680 wrote to memory of 1648	1680	msedgewebview2.exe	97

C:\Users\Admin\AppData\Local\Temp\zenith-cracked.exe
"C:\Users\Admin\AppData\Local\Temp\zenith-cracked.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\znx_inject.exe
  "C:\Users\Admin\AppData\Local\Temp\znx_inject.exe"
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --remote-debugging-port=9222 --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4136.2632.11617475220446456160 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView /prefetch:4 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc6cdd5fd8,0x7ffc6cdd5fe4,0x7ffc6cdd5ff0
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,13785711691996909377,15162010721447037291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1760,i,13785711691996909377,15162010721447037291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1760,i,13785711691996909377,15162010721447037291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3464 --field-trial-handle=1760,i,13785711691996909377,15162010721447037291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView" --webview-exe-name=zenith-cracked.exe --webview-exe-version=1.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4060 --field-trial-handle=1760,i,13785711691996909377,15162010721447037291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:14fb9c56a553057ee480fb0185ee19efa92d2759
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1516

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

znx_inject.exe

Path C:\Users\Admin\AppData\Local\Temp\znx_inject.exe
Size 6.7MB
SHA256 e09d8cf2169e25f61d7c1e54194af32f28f92b47eb6d3befa5371fdf69b521f2
MD5 ed6f831ff32342fe9cbe807129f0b871
SHA1 fe98bff78a4d6c51defcfdd1a87b07ab07a59c0d
SHA512 77be834f8a3af7bae54fbc518cfefa932e9b83a8db6fa5bdf4635d064d7c5c4d72c77fe93987de32c1272249a15dbfad80225bec3d60970066f82f68b642c322
SSDEEP 49152:3zQdfaIKYjwfcO+0+81TRug6VrI/Lsg4wusUlq1csq9dmyrmggyx5MaAKCK5KwZE:3Udjry+81uPIq9sy6g9ZMwTE
TLSH
T1B5665917EC9918E9C1AED13089679112BF71BC494B2123D72B80F6243F77BD4AEBA354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86b02224-b139-4733-9987-4730e34294f9.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\86b02224-b139-4733-9987-4730e34294f9.tmp
Size 3KB
SHA256 7bb4fd139eead0e87fddfd01246fef8faf2ffaa22c4c930a97ad7d9f87174d7c
MD5 7f73a9da7fb3d51f7c459a7ef68ec7ec
SHA1 ff45e9053b809f05821740839f8055fd20dd6d76
SHA512 dc2a77da658c73798dd916971c16d8d737d49474209f24cf955408331afb1efbc9fce38c2fc812b904b4c4c6da50feadc547ea73c3bb26b9ece1b99ad4485d94
TLSH
T1117164366974BA3B5EB3DA05B9872B07EBA99023E4953F95C5EC0F1C01E729D1381C17
MD5 SHA1 SHA512 TLSH

Submit Download

8af9cd32-d082-4a89-8836-e72a7f4f4786.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\8af9cd32-d082-4a89-8836-e72a7f4f4786.tmp
Size 3KB
SHA256 fa1bb65d7deee78288c0dd192085673905ecdc9dfba8040ad64e65cf1ee98376
MD5 788d643c68e7f1cf2fb4b88ab2c2a456
SHA1 2858ef01d7871ebb0f130a9a8468b1709302691f
SHA512 79f465c5cf3dbc24a1726e7ac4593b01baf468b29af6054832d864f72cd4920e63eb17c1c76d55963b88becee984495363d33258a75a32001bcba8d761bf6764
TLSH
T1757174366874BA3B5EB3DA05B9872B07EBA99023D4953F95C6ED0F0C41D72991381C17
MD5 SHA1 SHA512 TLSH

Submit Download

9a6e6d45-3926-49cb-a5c3-296b0226023c.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\9a6e6d45-3926-49cb-a5c3-296b0226023c.tmp
Size 3KB
SHA256 871ef46bbe09561fe429e163bcdda08d7b67fffc5629e950ef38a77b5887ff3a
MD5 75bfb49ce71e316a441f2859e88d8c7a
SHA1 d363b4a1dccb65b2f2f455c6a83c326a66a82625
SHA512 a343cea9aa22d9577bad852c52732ed94da0a0681e4a05d2ee8dc1c98a49babc85e1ef1db7042309c04f317bbf7d7b7d12a1a4565dc3397be43265a6e37e1236
TLSH
T1297164366974BA3B5EB3DA05B9872B07EBA99023E4953F95C5EC0F1C01E729D1381C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 aa9d05396a2f2023d7269a895ec0a09e4b430860a75ec6e8fee8b6b6b37af580
MD5 7c704f5d97e8808d86cb20a4baac80f6
SHA1 de573e9a4fda7c224164027c81b585833d01fdc3
SHA512 7ee387c8ff98a41f4ab339584c67a8d2b1939e933a46ae275393967ba12e68b69aec017d52603e97a464fa6afc9c3547a0bed4ca90c2a269d78ceab688c6bd68
TLSH
T15ED0121633510174C03030B31402734C1604C11B41498105982DC52D2A544A01E03451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a636b0d8c72d38482f5e3a4e46a935baf0fdd00f002b7926b96b8d30c4dca451
MD5 468f9808d41d986e52e09824a78af868
SHA1 49acef63b27f0b2a2874f0c26af56233b2f100d8
SHA512 17bad5bc163ee399a0001164e9dd0d8214d734263e1e17a60ef277d04c7b7ed064e8b7711cf766351eb44a2357dc08568a3fde66fcb54c292929f0c2034ac020
TLSH
T184D0041453541040C07130F314145344131C4410054553154555401414D14501503110
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

58505d3f-eabb-4d84-866c-dd4e9f9bd0a1.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\58505d3f-eabb-4d84-866c-dd4e9f9bd0a1.tmp
Size 6KB
SHA256 a35a9eac411434bfb98e777e1a06ed9cf3bba55a21c66f5dcfc6bb78fe2c9bc2
MD5 e9b1403f396e9bff379687beb2073cc4
SHA1 7865b29de3b0c83afee880e4d2f667e5318a4f33
SHA512 0e0a3aa96776074e691ff62bc9c0558eec8209181c512dcfa22db9b3481381b208eadfd776fc0fab2014fd80804590e08a9d76c4e7198c82dcafeb88e24833cd
SSDEEP 96:r6/dfJXlb9ak+edo616Z0fs7/x+6MhmuecJ111ejea+K+gAMjF28XM1C7K:riZIso6fsV+Fd11QjzWUFG6K
TLSH
T1B2D1A8015E68BD7F4CC6E608FA29BB1BE2F5503265D51E58E7F8452C04EB6CD631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93aab2b8-e509-43b7-a18b-039c51ea43dd.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\93aab2b8-e509-43b7-a18b-039c51ea43dd.tmp
Size 6KB
SHA256 a7bf10b1e3f883d74705b647288b2a935bc5cdd7808ce11a66b629e02d12713a
MD5 8de98086384de9d542c64c204707ca41
SHA1 ccd0e3d03f444700b5bd1573a8b6a3289b52433a
SHA512 d9c012f286ac8ab23a72d6c76e1b9556e06a33080d06fcff14a9604044705c013120ba4fc63f94baae4e46084820ce4c2b565002987655dc1de321d45fc00b4b
SSDEEP 96:st6/dfJXlb9ak+so5h16Z0fs7/x+6MhmuecJ111ejea+K+gAMjF28XM1C7K:stiZIwonfsV+Fd11QjzWUFG6K
TLSH
T1C4D194015E68B97F4CC6E609FA29BA1BE2F9503261D51E58EBF8452C04EB6CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 6959cacb6e4d4326e4d74c6d9eee69662199252ade792ca571bc72fa7069554c
MD5 d201896ed6961e08caef05a686a1ae0f
SHA1 dd3f6a726057e4178a51a95f02dcbce48ee87089
SHA512 2fd58f847f98ac2b3edd4447af42f27d7b5037813ec80dc8c24597c6fbdf9b3b263c999e1dfb222fb4ef28368d2b5b2536c8229cb24cad09832f33c3c47ba062
TLSH
T1C6A0022419448012C7E40FF5D0D26140333D593053632B0E96B140BC89707846615550
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0aac37f5b135f8844773f6ecb1c67b3df97fa8c2375e07ecbeb1355c7aae10df
MD5 8e3c18d02374c6bd384e6840d65d86c2
SHA1 7d1e8470c8c611a8c7c4df789aa6d7486313ac86
SHA512 9ea2088265fde8e949a8657220e5efb1d606802fc68ac42da67bad19ea9bb0d62354bac0cb3c31f043aab90164ed00ff7ed30f1f3e8c50f6abd5515f6d10bde0
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Preferences
Size 5KB
SHA256 3ec05a928eaca9c06552530871e69a68bbc72fee798da7f166c927106b9220e4
MD5 a9f84c58f716fc76a9bcec7be5d0c76d
SHA1 e377e1d2a23a2a92f6f8157242a725661f06a01a
SHA512 aa1d7c498f607e2d1fc82ca4fd6f09aa8120c815880cfd3a16a4db6b87b3f3a22b2678d2d82f40e211839329f79dfa6b53c9a022d320818c35b388e4141666bd
SSDEEP 96:r6/dfJXlb9akjdo616Z0fs7/x+6MhmuecJ111ejea+K+gUMjF28XM1C7K:riZI8o6fsV+Fd11QjzWUFG6K
TLSH
T1E9C185025E68B97F4CC6F608FA297A1BE2F5503265D51D58E7F8892C04EB6CD231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b34b3c5b-aecd-418b-abf4-4d532636b550.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Default\b34b3c5b-aecd-418b-abf4-4d532636b550.tmp
Size 6KB
SHA256 04cfbe6c6ded76d0afdb4c9e5f2ff4ebf98b66b9dced31c2652de1fbc21c0e28
MD5 e342e9eb1f81d1ab7abb1be6233aa4c3
SHA1 70f16dee4e8d18e0d475eaf80582429b7b56a0ba
SHA512 cd8cee20561c634ee53b3a37514c1d14540fc158395a1adce4f937b7538b3797715c3c563a13f6af686a3a782d0cf23b1d7a7669162c09e21d65c7f8f4576ff4
SSDEEP 96:st6/dfJGGlb9ak+so5h16Z0fs7/x+6MhmuecJ111ejea+K+gqjF28XM1C7K:stiZSwonfsV+Fd11Qjz8FG6K
TLSH
T166D194025E68B87B4CC7E609FA29BB17E2F5607261911E58EBF8452C04EB6DD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\Local State
Size 1KB
SHA256 6e4ad53e137ca4784411748a3c4fd3571878a3aec3d70dd369f0e547db0be128
MD5 87955374614572c54956ba089f8cdfea
SHA1 eeb9d84cc4e20ca1d70f3cacde1c279a9311d255
SHA512 e45ccf05c2ed9b3f4c44b4e8b0df418047bbc82aedba56f6e7d5c791eeb2d4242eb7d162423858d5dcfc498d61ff07a74e07009b3e16b0b9e376d6fdd3631c3c
TLSH
T19921B773A5643B37FE525B45200B77DBAD76A027C1504F0050DD8F2811E304DA72D832
MD5 SHA1 SHA512 TLSH

Submit Download

b045fdfd-7582-4d43-8b31-6e8ebba47f14.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\b045fdfd-7582-4d43-8b31-6e8ebba47f14.tmp
Size 2KB
SHA256 11953be14a365860339886f404a606a63a4f3d9de3e730080597109b059f3a01
MD5 9c2bc2445b53cb632a6e8b20ea16137e
SHA1 039944074c8734e899d129720143b4f85cbc089e
SHA512 6044927800c594428893fe039912a259d0b1082a172431568aae1275f5af263f8c5eee2892d8d67d9eb7dc23713491ea452d9e9ab3e90e77afe6ca6ce9be73ff
TLSH
T1B151723379247B3B9BA38A08B94B3B67DE7AA061DA622F1086DD0F1C01E755D2745C27
MD5 SHA1 SHA512 TLSH

Submit Download

bcced5b7-1c86-4ff0-a8df-5eee5d9dc425.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\bcced5b7-1c86-4ff0-a8df-5eee5d9dc425.tmp
Size 4KB
SHA256 f41190d997f8fa2af1698ec80008fd7ad38e0cffa63628d6e3fb8465e2057c6f
MD5 39de95feec6f7a9a2817e5c4283b88c8
SHA1 2ed66e27a01cc25109ee64de62394b93501ee222
SHA512 ed99466e359878e631b3c9116039d7f5a717e7a5c1534648008696210e36d1adea7504150745fe4f910a6c65a68c71fc8066b1b9b20f8b97e84e1b55fba2b0b7
SSDEEP 96:GFNkEYt3fZsYiA8kh/cI9URoDoto+5d2HBL3nA166T3cE3t6ZgZ0T4yJaa:cN4x3eoDUhobnABcE3NsT
TLSH
T15EA1C532A864B63B9DB3CB84B9477786FBB59123E8842F94C9DC1E0C429729D1346C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd1e557c-aef4-41c4-a151-ffc1a9d3718f.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\cd1e557c-aef4-41c4-a151-ffc1a9d3718f.tmp
Size 4KB
SHA256 87b4280c42219a17521dab5ae60b9f82f9cd2ca8e29fe8e475050623c5916e3f
MD5 d5488a51a4df894d2d749912ea7693aa
SHA1 aa8ea8ec18841f03f4f8315ea3698f55a0138009
SHA512 7f8ab7748a22b3777ed3388dbee1be285e5339af8e3616d13f4087b81186d3eddc9ec2b53473c3c2116d914ea51933c0d6638bf890915b3c2b92b988295ed8c2
SSDEEP 96:GFNkE93fZsYiA8kh/cI9URoDoto+5d2HBL3nA166T3cE3t6ZgZ0T4yJaa:cNlx3eoDUhobnABcE3NsT
TLSH
T15DA1B732A864B63B9DF3C784B9473786FBB55123E4842F94C9DC1E0C429769D1346C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0f14bdb-6d7b-42d0-8b7c-2212f68a0f76.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\d0f14bdb-6d7b-42d0-8b7c-2212f68a0f76.tmp
Size 3KB
SHA256 310158b0b800939982ac097a6ff9ad02d330b825c214ddc67acaa4ccb01ac0d2
MD5 786691de5136942a8978436539f91e24
SHA1 04439105fcf5d20a3f46cedd3b4dc17346fccf62
SHA512 5b9f5b41b7379697f44bdd6a71ee20db39c28498cffac6b1a2a389b18ea13b0840c1e633f1104c8b273f12de2d268bb4e68725c0b0465d9eeba5b53c57841716
TLSH
T1226164376974BA3B9EA3CE04B88B2B56EBA59023D5953F54C5EC0F1C01D729C1341C17
MD5 SHA1 SHA512 TLSH

Submit Download

decf2b9d-d24f-4df6-9820-73dee2acf8c7.tmp

Path C:\Users\Admin\AppData\Local\com.apphost.runtime\EBWebView\decf2b9d-d24f-4df6-9820-73dee2acf8c7.tmp
Size 4KB
SHA256 cff8dfdd0e057925f3cf40965404a9d76c9bb6269f2a6eac9823e59eabcc09ef
MD5 8d9b1bc90500d508fcceabda093e7946
SHA1 6e5a60442b78bec337d2d0968469a3d5608f0200
SHA512 630cce4e849b04695bd405a6ffa61aa479a6dc47cbfdbe48cc3e09f03e752dd48fdbe980f688645e106e332ca7b6bb2e667e5c32971d7ac673214b5dd58f1642
SSDEEP 96:GFNkGS3fZsYiA8kh/cI9URoDoto+5d2HBL3nA166T3cE3t6ZgZ0T4yJaa:cNBSx3eoDUhobnABcE3NsT
TLSH
T16591B532A864B63B9DF3CB84B9473B86FBB55123E8842F84C9DC1E0C429769D1346C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.json

Path C:\Users\Admin\AppData\Roaming\5da8b38f\app.json
Size 603B
SHA256 a1d78f7de83fdab989a707230995a7b976bbf5609b48a20b64ada62cb83f39f2
MD5 d29c2bef3b9e53474c28722509954b58
SHA1 ce18d7158bca267d881a746bc02055525794a4a5
SHA512 9f098bd97c40b1b6c456e5c91a1836d2431be265f20e30c0bb8f88b68c1c6fa9d5ed9141b6504064d13fa970cbe89fb55ccc3af1d8deec233773a84645077a48
TLSH
T10FF02204C2A5487700DC8A3A887E612367104DB7065A3D2DF622CD2C2F4E62B37F8CD8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1264-220-0x000001FE57D90000-0x000001FE57E63000-memory.dmp

Download

memory/1264-32-0x00007FFC8EEB0000-0x00007FFC8EEB1000-memory.dmp

Download

memory/1648-302-0x00000288DF400000-0x00000288DF401000-memory.dmp

Download

memory/1648-304-0x00000288DF400000-0x00000288DF401000-memory.dmp

Download

memory/1648-313-0x00000288DF400000-0x00000288DF401000-memory.dmp

Download

memory/1648-312-0x00000288DF400000-0x00000288DF401000-memory.dmp

Download

memory/1648-311-0x00000288DF400000-0x00000288DF401000-memory.dmp

Download

memory/1648-310-0x00000288DF400000-0x00000288DF401000-memory.dmp

Download

memory/1648-309-0x00000288DF400000-0x00000288DF401000-memory.dmp

Download

memory/1648-308-0x00000288DF400000-0x00000288DF401000-memory.dmp

Download

memory/1952-102-0x00007FFC8EEB0000-0x00007FFC8EEB1000-memory.dmp

Download

memory/4136-1-0x00007FF709CF0000-0x00007FF70B318000-memory.dmp

Download

memory/4136-199-0x00007FF709CF0000-0x00007FF70B318000-memory.dmp

Download