Overview

overview

6

Static

static

3

2026-07-31...om.exe

windows10-2004-x64

6

2026-07-31...om.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/07/2026, 09:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  • Size 37.8MB
  • Sample260731-k5tbrazvbv
  • SHA256 6e9dc5c71a89b6f854b19b021d14c3893d6d4139d78858b4d7c5c4e34f84d244
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Drops file in Program Files directory 15 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -Command "if (Get-Process sunshine -ErrorAction SilentlyContinue) { 'true' } else { 'false' }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5104
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-gpu-shader-disk-cache --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --gpu-rasterization-msaa-sample-count=0 --ignore-certificate-errors --renderer-process-limit=1 --lang=en-US --mojo-named-platform-channel-pipe=3892.732.10724151465652616628
      2⤵
      • Drops file in Program Files directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.212333.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0xf0,0x16c,0x7ffef928b078,0x7ffef928b084,0x7ffef928b090
        3⤵
          PID:2008
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgABAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
          3⤵
            PID:868
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1932,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:3
            3⤵
              PID:4940
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1712,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:8
              3⤵
                PID:2004
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --gpu-rasterization-msaa-sample-count=0 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3380,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
                3⤵
                  PID:4696
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --gpu-rasterization-msaa-sample-count=0 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3732,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
                  3⤵
                    PID:1284
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2148,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
                    3⤵
                      PID:4628
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1992,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:8
                      3⤵
                        PID:2928
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4516,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
                        3⤵
                          PID:3856
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoABAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4508,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3396
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.212333.app\EBWebView" --webview-exe-name=2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4328,i,11795386978783320185,16469398424199996638,262144 --enable-features=IntensiveWakeUpThrottling,ThrottleDisplayNoneAndVisibilityHiddenCrossOriginIframes --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=952 /prefetch:8
                          3⤵
                            PID:3420
                        • C:\Windows\system32\sc.exe
                          "sc" query SunshineService
                          2⤵
                          • Launches sc.exe
                          PID:3328
                        • C:\Windows\system32\tasklist.exe
                          "tasklist" /FI "IMAGENAME eq sunshine.exe" /FO CSV /NH
                          2⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2980
                      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-07-31_9826dbd8660ba586ffc15ec33bb16b04_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe" --hidden
                        1⤵
                          PID:988

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              manifest.fingerprint
                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1222782902\manifest.fingerprint
                              • Size 66B
                              • SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              manifest.json
                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1222782902\manifest.json
                              • Size 135B
                              • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              manifest.json
                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1550166384\manifest.json
                              • Size 79B
                              • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              manifest.json
                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1579036701\manifest.json
                              • Size 102B
                              • SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              manifest.json
                              • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2416_1956017885\manifest.json
                              • Size 43B
                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                              • MD5 SHA1 SHA512
                              Submit Download

                              __PSScriptPolicyTest_v3ht2cob.chp.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3ht2cob.chp.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              protocols.json
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                              • Size 3KB
                              • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 3e2d3bd087c82ceb662e49fdff5648e3ba79da619780ea1dfba1751d41b1b82f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 5f6466fe1bfeee5455d4f7dce75e4bbc5badd21d14e4935f120f358cedf7731f
                              • MD5 SHA1 SHA512
                              Submit Download

                              throttle_store.dat
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Crashpad\throttle_store.dat
                              • Size 20B
                              • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                              • Size 432B
                              • SHA256 fd53c1db15a4d06a7883033286c94f2783b08f8401fb7b3c1d3cef5511253fd5
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                              • Size 48B
                              • SHA256 52cee36a91b69398ba1b1a331891786ff6e92cd92d5005cbd9e561b368047da9
                              • MD5 SHA1 SHA512
                              Submit Download

                              MANIFEST-000001
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Default\Extension Rules\MANIFEST-000001
                              • Size 41B
                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                              • MD5 SHA1 SHA512
                              Submit Download

                              Network Persistent State
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Default\Network\Network Persistent State
                              • Size 111B
                              • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Network Persistent State~RFe59ee9c.TMP
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Default\Network\Network Persistent State~RFe59ee9c.TMP
                              • Size 59B
                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              SCT Auditing Pending Reports
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512
                              Submit Download

                              Preferences
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Default\Preferences
                              • Size 6KB
                              • SHA256 d9031b3f738c8f93cc5debb14638bce18af6681e9d0589992c54596b80adc9b2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Preferences~RFe596632.TMP
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Default\Preferences~RFe596632.TMP
                              • Size 6KB
                              • SHA256 c954b33d0c0ddae71dda5877b70e1c112b3250b19c101edd85f5f36972c93e4a
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CURRENT
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Default\Site Characteristics Database\CURRENT
                              • Size 16B
                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                              • MD5 SHA1 SHA512
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Local State
                              • Size 1KB
                              • SHA256 dff5f3cca9ee2112297ed8228d177ac166562b41e416e03e5e5b8fda34b0d10c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Local State
                              • Size 2KB
                              • SHA256 fdbd223305529de832a62c90dfd2ceba14d9ae87aa10908a1d325a8a9aabdf7e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Local State
                              • Size 3KB
                              • SHA256 553892cd7e310929690df7cbe6bca2215dc606b4f6a186a02ee3dd2b7c5e5480
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Local State
                              • Size 16KB
                              • SHA256 87b074187cb60bf1301cbc21838992f6ae7ca0a87edb573f99c37ad5edfdc13f
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State~RFe58c752.TMP
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\Local State~RFe58c752.TMP
                              • Size 1KB
                              • SHA256 5f854a2329a8e3f5142fc1b909a31c359cc10a0e6bd4c8ee833d42b326946329
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              crs.pb
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\PKIMetadata\46.0.0.0\crs.pb
                              • Size 233KB
                              • SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              ct_config.pb
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
                              • Size 16KB
                              • SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              kp_pinslist.pb
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
                              • Size 10KB
                              • SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              keys.json
                              • Path C:\Users\Admin\AppData\Local\com.212333.app\EBWebView\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                              • Size 8KB
                              • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              memory/868-30-0x00007FFF188F0000-0x00007FFF188F1000-memory.dmp
                              Download

                              memory/1284-194-0x000001C6D5020000-0x000001C6D508B000-memory.dmp
                              Download

                              memory/2004-52-0x00007FFF16FC0000-0x00007FFF16FC1000-memory.dmp
                              Download

                              memory/2004-53-0x00007FFF170D0000-0x00007FFF170D1000-memory.dmp
                              Download

                              memory/3396-339-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/3396-341-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/3396-351-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/3396-350-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/3396-349-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/3396-348-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/3396-347-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/3396-346-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/3396-345-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/3396-340-0x000001B8CC450000-0x000001B8CC451000-memory.dmp
                              Download

                              memory/4696-107-0x00007FFF188F0000-0x00007FFF188F1000-memory.dmp
                              Download

                              memory/4696-193-0x000001B802B20000-0x000001B802B8B000-memory.dmp
                              Download

                              memory/5104-12-0x0000021D259E0000-0x0000021D25A02000-memory.dmp
                              Download