cab45d9561fcb0300d8850187cfcc7e9fbf79d839acb92d62f77f37a6b51d45e

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 3.1MB
Sample260712-31g22ab121
SHA256 cab45d9561fcb0300d8850187cfcc7e9fbf79d839acb92d62f77f37a6b51d45e
MD5 7c2f8cd1f6731307caa004daa5b37c7c
SHA1 cf499ec7ac6a49f1e0a77a91192be94612227a48
SHA512 760066b454342b1c76cf514aacb93c3a5dd47e25c07821a806ea768831e11eda4048139fc27117bd22e5eaa7998dda245544f679ee058946c039577c23218dee
SSDEEP 49152:yU2mkodKfo9tWRvKaxrvZJnLgj0L9/kk5CDLQrErgiIT7/is:3dKhZmm04kcis
TLSH
T194E55B03F66191E8C16EC178C35AA273EB3278994A2475FB56E81B313F6AF506F1D348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1052669380\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1052669380\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1374738963\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_572657029\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1052669380\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1052669380\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1374738963\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1374738963\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1052669380\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_572657029\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1374738963\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1374738963\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_409911705\Part-ZH	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1768	msedgewebview2.exe
1768	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3388	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1848	2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3388	1848	2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe	87
PID 3388 wrote to memory of 4256	3388	msedgewebview2.exe	88
PID 3388 wrote to memory of 4332	3388	msedgewebview2.exe	89
PID 3388 wrote to memory of 4332	3388	msedgewebview2.exe	89
PID 3388 wrote to memory of 4332	3388	msedgewebview2.exe	89
PID 3388 wrote to memory of 4332	3388	msedgewebview2.exe	89
PID 3388 wrote to memory of 5208	3388	msedgewebview2.exe	90
PID 3388 wrote to memory of 2604	3388	msedgewebview2.exe	91
PID 3388 wrote to memory of 2604	3388	msedgewebview2.exe	91
PID 3388 wrote to memory of 2604	3388	msedgewebview2.exe	91
PID 3388 wrote to memory of 3288	3388	msedgewebview2.exe	92
PID 3388 wrote to memory of 3288	3388	msedgewebview2.exe	92
PID 3388 wrote to memory of 3288	3388	msedgewebview2.exe	92
PID 3388 wrote to memory of 3288	3388	msedgewebview2.exe	92
PID 3388 wrote to memory of 3288	3388	msedgewebview2.exe	92
PID 3388 wrote to memory of 4288	3388	msedgewebview2.exe	96
PID 3388 wrote to memory of 4288	3388	msedgewebview2.exe	96
PID 3388 wrote to memory of 4288	3388	msedgewebview2.exe	96
PID 3388 wrote to memory of 3324	3388	msedgewebview2.exe	97
PID 3388 wrote to memory of 3324	3388	msedgewebview2.exe	97
PID 3388 wrote to memory of 3324	3388	msedgewebview2.exe	97
PID 3388 wrote to memory of 4252	3388	msedgewebview2.exe	98
PID 3388 wrote to memory of 4252	3388	msedgewebview2.exe	98
PID 3388 wrote to memory of 4252	3388	msedgewebview2.exe	98
PID 3388 wrote to memory of 1768	3388	msedgewebview2.exe	99
PID 3388 wrote to memory of 2808	3388	msedgewebview2.exe	100
PID 3388 wrote to memory of 2808	3388	msedgewebview2.exe	100
PID 3388 wrote to memory of 2808	3388	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1848.5800.11000792624199641376 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView /prefetch:4 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x120,0x194,0x7ff99f8a5fd8,0x7ff99f8a5fe4,0x7ff99f8a5ff0
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,7819292484371384494,12436382577142282538,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1784,i,7819292484371384494,12436382577142282538,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2624 --field-trial-handle=1784,i,7819292484371384494,12436382577142282538,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3348 --field-trial-handle=1784,i,7819292484371384494,12436382577142282538,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874 /prefetch:1
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=1784,i,7819292484371384494,12436382577142282538,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4560 --field-trial-handle=1784,i,7819292484371384494,12436382577142282538,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1784,i,7819292484371384494,12436382577142282538,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4536 --field-trial-handle=1784,i,7819292484371384494,12436382577142282538,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView" --webview-exe-name=2026-07-12_7c2f8cd1f6731307caa004daa5b37c7c_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=4.6.10 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1784,i,7819292484371384494,12436382577142282538,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:390c8020b2e076f548d5e1aa5b9000e9414e9874
    3⤵
    PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5a80aaa221ed72cf40655c2729cfabf8082a74b6ead2b0508377c3f39b32fbb4
MD5 f00c20d84f5c58e9f6d50b546a5ae587
SHA1 9dcdfd65ecc4e8f6fb38adf14bf74ab32ee1de7b
SHA512 1f322652f34fb5679b74a8f77555f2244b100a45181656ebc30805420b2da9ed88b8ae07dc77eb9650a6b590f1bb454e144f889b6e1892796b36b7e62292c54f
TLSH
T1CED0122333110138C01031331103614B0940D15B411580447838851E5B1E0600916897
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a04c70f192209814b5726ba532945f5065f4e9de0dd8688e419ef0ca0a3cb9ab
MD5 7c4b3b36c803ad57bd3a5c92494fe9a9
SHA1 9625b905a2120885a19b3ef8fda85e06ef83d748
SHA512 d7b96594ceb18a4959ecebe678a25c7fc076767914ff05b59947b42035adac788daf29866ab58211e356a1f24eb636ee89001e6ba981520cdf1ab5fd80e3307e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 bd8fc3f0ce62a4206b5fac82b9b13214f025709bc86dd0894e0223f0d97332bd
MD5 50a10f09ade5b49b6b4b44c3dcca972f
SHA1 edab163ea12b7bb94e02c1bdeb95d6a1b7f31ee6
SHA512 6887d2194e77080919848e7872531f30d89300c86143e487a15a30a1e917dfc30059519ff2844a2f4aa5cc1056854603a072f728c2114181c725d861c390bdd9
TLSH
T196B0026D6432E4AEC218537469D6C1D43A713E714BF72EAEB09D10B4EC95350D7C33A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596da4.TMP

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596da4.TMP
Size 48B
SHA256 792c825e792e67b34aa6803501c76c88ddabca1128abfb52fcd5a38c1a1a30ee
MD5 a0380b0ffffb0a234ecbe3eef28af67c
SHA1 387d0df5ae01b1a3a942e7e22d1323340fd27d68
SHA512 22f222248617930ff4b56bfc4edf489bb6a7ac21be4544b80548b6478db57f1062c4d5671d58f534a5cebf69fe8f13edf20343c884f360db25204449bc703717
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\Network\Network Persistent State
Size 971B
SHA256 2e452f5d3aa6b75ed5f98d293b0c69191fb9a42eebff23f5dbf1eb0d3417e25a
MD5 db92d53011e5004bc64352e8aaf5e637
SHA1 65cb19cec673e277f9f9b35b16ad2a26da5f05d2
SHA512 d759f2222c9beaa9d37808b7f908a69c7f7a8f248b7151b9e8295c9a7ca32eb5796f475d6257ac71f6330ce9410b3f408ff19d2349ff3e1ec4227e73f09ac860
TLSH
T1E711B1E2C3E442EC5D5209F429256D13DE1D4831532C3A56C8DCEBABE3F1460D245D8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2b67.TMP

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\Network\Network Persistent State~RFe5a2b67.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\Preferences
Size 6KB
SHA256 c2621775b010fd1b23b305cfda265c07f5ece1ce406dc0756a7c950204b5c4b2
MD5 9de3edc29b0ce5addef15dd32c9c1887
SHA1 fd80048cd3b5072b1057a59644863b9e294a79ed
SHA512 caa9aa9af6f8d80ab09af710dbcf778742d83f3ecba383f99fec3ecce2bc9ebcaf897d66ce833f036b4ec6538185e2a52fa61a274cc33869de84013a713cd2a0
SSDEEP 96:stED/dM++flSU0GPrb9ikOBo5h16Z3Os7/x+6MhmuecDz3I1ejeX1K+gAoy28XMz:stiObotogOsV+Ffz3IQjjmG6K
TLSH
T104D1A5039E24697B5CC7E508BA29BA43E2F9A03276D11E5CE7FC8A1C04EA5DD6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b0621167-3ef5-4247-b175-3a00602fc58f.tmp

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Default\b0621167-3ef5-4247-b175-3a00602fc58f.tmp
Size 6KB
SHA256 2d139eb62e75c53901d934ee0d330615a5bf56b47e4bad4cb2d88f4c8be8d5c0
MD5 acd303c09ffd961e8b4ea23d9c180824
SHA1 58ceed5fff08cc2ec710e11a444ee5974668bba3
SHA512 e5ca2ef2aa4991cc642fe7b78f1fefd27542a0ba23cb3443f96df40eb654ac8f10f3f5eefe60c6a7154474bde91285a3447f76dc7195d33508000328df6c11e4
SSDEEP 96:stED/dM++flSU9Prb9ikOBo5h16Z3Os7/x+6MhmuecDz3I1ejeX1K+ghpy28XM15:stiObqtogOsV+Ffz3IQjjsG6K
TLSH
T18FD1A7029E28697B5CC7E509BA39FA43E2F9A03275D11E58E7FC861C04DA5DD6307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Local State
Size 14KB
SHA256 576fa99d930dcc88feeeec8a93f6e3ea4ee2dc42c7977077b7e942578a961422
MD5 a343db7eea348541934f6db4c8cf7546
SHA1 58eaf2eb77762e9cb0fb24142cf80d671f3065aa
SHA512 044b136fcc74454681484172515db1d9039c318c17ddb6c7cf912d57df9e376f20b27d0a3280fa376a8a0bcbd7d95428a1465aa4098b8cd8a1413822f5fa0a7f
SSDEEP 192:QsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vnNBSla20eoDUht:Qsrv+89zHqlDNP9oid6NBSjkkxhO3Nk
TLSH
T1F1629E33E57CA637ADF29508B486BE077FB8606665C21BA4E5AC4B8C41CB0CE2307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Local State
Size 2KB
SHA256 69d0759123b9f0d1a50d1a9bade7c6be77bc561a3094279eebfcde64e7abb84f
MD5 142cf5b778fb906524264e98c5aa8c78
SHA1 8b1db71ab44924f195c5c88fd00af685e58766a4
SHA512 52c30495e521d33149fa41ce73192da8698561549f8a75713119c741e80713de64d02ed6f290d4deaa5c51c896fc3ccd65b8a14754086936e0dadce722f48cd8
TLSH
T173518333A9205A37A9E38648794ABF538E759161AB532F94A6EC8B0C00C755D2307C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Local State
Size 3KB
SHA256 181f50c2d3163c3f3ebee61a2f43e0b90d37831df109c7601355d6d98e3f5078
MD5 55ea1224921fd310484fa49f93452546
SHA1 970f167fd28c04c4771985e6af1e14c409caa662
SHA512 1bf4ec7a2963dd100db4e3c3c0194653fd028c94382e784148919fb20caa14b73756e7bdd0c6f9d8df4e50a2f843fc7768f7587a6656e96a4c9a1f793c10cea3
TLSH
T15E718737A97499375DF38A087C867B13ABA59126E9963F98E6EC4F0C01C729C1303C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Local State
Size 3KB
SHA256 e02771301f2cfd0efb4f2f6967c11a9415c90653984285ffc3fb7d21ab766c2c
MD5 71f1a32c051f9e3e3b094c223e15336a
SHA1 63f95d637b46182aec76c64f5988710ada37290e
SHA512 8ec1be87a7908b21c22fc39f1b5689faa33fe6a8f6e60466be0df0316bc5d96eee241f268213ac12c6bc3ab4f902d307cb0b49214ccc6771903864a1291512f2
TLSH
T1C181A736A474A9375DF2D508BC867F03ABA59127A9963F98E6EC4F0C01C728D1303C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe591592.TMP

Path C:\Users\Admin\AppData\Local\com.integrator.doc-integrator\EBWebView\Local State~RFe591592.TMP
Size 1KB
SHA256 06ab36b391ddb0f742c2e9fc08a2d6a21516e82e92d6beb03eccbdfbfadaa5d8
MD5 aa3d629e5e2316c0afcc0841c716be98
SHA1 72488a45ee6521971701ffd097b9e9de09a490b8
SHA512 4ed959396325e2054923a709e31af079d724182526ee95285b3807c95c51b8926ca1f45347f79f58564e79682de8168b0193dddca958ca9e225272ed9b728efe
TLSH
T1633186B2D9705B33BC92528A3546FE939E71917A53521F44B2DDCB0C01C654DA72FC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1768-385-0x000001FCC5EB0000-0x000001FCC5EB1000-memory.dmp

Download

memory/1768-393-0x000001FCC5EB0000-0x000001FCC5EB1000-memory.dmp

Download

memory/1768-391-0x000001FCC5EB0000-0x000001FCC5EB1000-memory.dmp

Download

memory/1768-392-0x000001FCC5EB0000-0x000001FCC5EB1000-memory.dmp

Download

memory/1768-394-0x000001FCC5EB0000-0x000001FCC5EB1000-memory.dmp

Download

memory/1768-395-0x000001FCC5EB0000-0x000001FCC5EB1000-memory.dmp

Download

memory/1768-387-0x000001FCC5EB0000-0x000001FCC5EB1000-memory.dmp

Download

memory/1768-396-0x000001FCC5EB0000-0x000001FCC5EB1000-memory.dmp

Download

memory/3288-58-0x00007FF9C1060000-0x00007FF9C1061000-memory.dmp

Download

memory/3288-206-0x00000208767E0000-0x0000020876B5C000-memory.dmp

Download

memory/4288-275-0x00007FF9C1490000-0x00007FF9C1491000-memory.dmp

Download

memory/4288-274-0x00007FF9C0550000-0x00007FF9C0551000-memory.dmp

Download

memory/4332-205-0x00000226F46B0000-0x00000226F4A2C000-memory.dmp

Download

memory/4332-24-0x00007FF9C1060000-0x00007FF9C1061000-memory.dmp

Download