be4a671fa029922465fcd7c63d928143f9a6529d25eefd5d908fe2b0ecfe6f51

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 22.3MB
Sample260803-hsj67sdm7x
SHA256 be4a671fa029922465fcd7c63d928143f9a6529d25eefd5d908fe2b0ecfe6f51
MD5 6e37945b138f3c6185d4c54bd55f1c17
SHA1 bc01ac1208afa1c3bc9c7d2093f03db1cc963286
SHA512 ebdc20b125ef2c411625b76b221000a5460b0f0e0179d508b59b1400192e20891dfef0ec7cceb0380796b910ae9d901cec70b8344c44636e79ba5cdf5519fa6a
SSDEEP 393216:LxDHeCz2a7DWxGAvHurXBeFtpZzz0pamnfj4RH:dDHeCz2YDWxvOTB+12Fnb0
TLSH
T1F2378C157A5B99ACD59AC87083474AB34E2170DF0A36B9BF44C482393F7DBF46B29318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
49	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Executes dropped EXE 1 IoCs

pid	Process
4984	lsp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
49	raw.githubusercontent.com
12	raw.githubusercontent.com
43	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 48 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1296	tasklist.exe
4528	tasklist.exe
2092	tasklist.exe
1540	tasklist.exe
5032	tasklist.exe
3844	tasklist.exe
4780	tasklist.exe
208	tasklist.exe
3636	tasklist.exe
2636	tasklist.exe
3252	tasklist.exe
1968	tasklist.exe
4004	tasklist.exe
1980	tasklist.exe
520	tasklist.exe
2492	tasklist.exe
3500	tasklist.exe
1088	tasklist.exe
2108	tasklist.exe
1084	tasklist.exe
2084	tasklist.exe
1048	tasklist.exe
4868	tasklist.exe
3680	tasklist.exe
3688	tasklist.exe
1560	tasklist.exe
1000	tasklist.exe
3772	tasklist.exe
1380	tasklist.exe
3340	tasklist.exe
3340	tasklist.exe
4804	tasklist.exe
4708	tasklist.exe
2616	tasklist.exe
4668	tasklist.exe
3008	tasklist.exe
1236	tasklist.exe
5048	tasklist.exe
4444	tasklist.exe
4812	tasklist.exe
1812	tasklist.exe
3364	tasklist.exe
4444	tasklist.exe
3340	tasklist.exe
4900	tasklist.exe
116	tasklist.exe
4528	tasklist.exe
2752	tasklist.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1082592907\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1082592907\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1082592907\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_26916436\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_26916436\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_26916436\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1082592907\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1999145774\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1999145774\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1999145774\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1082592907\keys.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302140164686717"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1720	msedgewebview2.exe
1720	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4028	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: 35	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: 35	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	1380	tasklist.exe
Token: SeDebugPrivilege	3340	tasklist.exe
Token: SeDebugPrivilege	2752	tasklist.exe
Token: SeDebugPrivilege	3688	tasklist.exe
Token: SeDebugPrivilege	1296	tasklist.exe
Token: SeDebugPrivilege	1088	tasklist.exe
Token: SeDebugPrivilege	4780	tasklist.exe
Token: SeDebugPrivilege	3340	tasklist.exe
Token: SeDebugPrivilege	2636	tasklist.exe
Token: SeDebugPrivilege	2108	tasklist.exe
Token: SeDebugPrivilege	3252	tasklist.exe
Token: SeDebugPrivilege	1560	tasklist.exe
Token: SeDebugPrivilege	1968	tasklist.exe
Token: SeDebugPrivilege	1236	tasklist.exe
Token: SeDebugPrivilege	208	tasklist.exe
Token: SeDebugPrivilege	4528	tasklist.exe
Token: SeDebugPrivilege	4804	tasklist.exe
Token: SeDebugPrivilege	3636	tasklist.exe
Token: SeDebugPrivilege	1000	tasklist.exe
Token: SeDebugPrivilege	3340	tasklist.exe
Token: SeDebugPrivilege	1084	tasklist.exe
Token: SeDebugPrivilege	4708	tasklist.exe
Token: SeDebugPrivilege	2092	tasklist.exe
Token: SeDebugPrivilege	4900	tasklist.exe
Token: SeDebugPrivilege	4004	tasklist.exe
Token: SeDebugPrivilege	116	tasklist.exe
Token: SeDebugPrivilege	1540	tasklist.exe
Token: SeDebugPrivilege	2084	tasklist.exe
Token: SeDebugPrivilege	1048	tasklist.exe
Token: SeDebugPrivilege	2616	tasklist.exe
Token: SeDebugPrivilege	4668	tasklist.exe
Token: SeDebugPrivilege	5048	tasklist.exe
Token: SeDebugPrivilege	4444	tasklist.exe
Token: SeDebugPrivilege	4868	tasklist.exe
Token: SeDebugPrivilege	4528	tasklist.exe
Token: SeDebugPrivilege	3772	tasklist.exe
Token: SeDebugPrivilege	5032	tasklist.exe
Token: SeDebugPrivilege	1980	tasklist.exe
Token: SeDebugPrivilege	3008	tasklist.exe
Token: SeDebugPrivilege	4812	tasklist.exe
Token: SeDebugPrivilege	1812	tasklist.exe
Token: SeDebugPrivilege	520	tasklist.exe
Token: SeDebugPrivilege	3364	tasklist.exe
Token: SeDebugPrivilege	3844	tasklist.exe
Token: SeDebugPrivilege	2492	tasklist.exe
Token: SeDebugPrivilege	3500	tasklist.exe
Token: SeDebugPrivilege	4444	tasklist.exe
Token: SeDebugPrivilege	3680	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4028	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	88
PID 4028 wrote to memory of 1896	4028	msedgewebview2.exe	89
PID 4028 wrote to memory of 2620	4028	msedgewebview2.exe	90
PID 4028 wrote to memory of 2620	4028	msedgewebview2.exe	90
PID 4028 wrote to memory of 2620	4028	msedgewebview2.exe	90
PID 4028 wrote to memory of 1280	4028	msedgewebview2.exe	91
PID 4028 wrote to memory of 4928	4028	msedgewebview2.exe	92
PID 4028 wrote to memory of 4928	4028	msedgewebview2.exe	92
PID 4028 wrote to memory of 756	4028	msedgewebview2.exe	93
PID 4028 wrote to memory of 756	4028	msedgewebview2.exe	93
PID 4028 wrote to memory of 756	4028	msedgewebview2.exe	93
PID 4776 wrote to memory of 3868	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	94
PID 4776 wrote to memory of 1380	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	103
PID 4776 wrote to memory of 3340	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	106
PID 4776 wrote to memory of 2752	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	111
PID 4776 wrote to memory of 3688	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	113
PID 4776 wrote to memory of 1296	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	115
PID 4776 wrote to memory of 1088	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	117
PID 4776 wrote to memory of 4780	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	119
PID 4776 wrote to memory of 2328	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	121
PID 4776 wrote to memory of 3340	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	123
PID 4776 wrote to memory of 4984	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	126
PID 4776 wrote to memory of 2636	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	129
PID 4776 wrote to memory of 2108	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	131
PID 4776 wrote to memory of 3252	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	133
PID 4776 wrote to memory of 1560	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	135
PID 4776 wrote to memory of 1968	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	137
PID 4776 wrote to memory of 1236	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	139
PID 4776 wrote to memory of 208	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	141
PID 4776 wrote to memory of 4528	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	143
PID 4776 wrote to memory of 4804	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	145
PID 4776 wrote to memory of 3636	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	147
PID 4776 wrote to memory of 1000	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	149
PID 4776 wrote to memory of 3340	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	154
PID 4776 wrote to memory of 1084	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	156
PID 4776 wrote to memory of 4708	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	158
PID 4776 wrote to memory of 2092	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	160
PID 4776 wrote to memory of 4900	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	162
PID 4776 wrote to memory of 4004	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	164
PID 4776 wrote to memory of 116	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	166
PID 4776 wrote to memory of 1540	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	168
PID 4028 wrote to memory of 1756	4028	msedgewebview2.exe	170
PID 4028 wrote to memory of 1756	4028	msedgewebview2.exe	170
PID 4776 wrote to memory of 2084	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	171
PID 4776 wrote to memory of 1048	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	173
PID 4776 wrote to memory of 2616	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	175
PID 4776 wrote to memory of 4668	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	177
PID 4776 wrote to memory of 5048	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	179
PID 4776 wrote to memory of 4444	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	182
PID 4776 wrote to memory of 4868	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	184
PID 4776 wrote to memory of 4528	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	186
PID 4776 wrote to memory of 3772	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	188
PID 4028 wrote to memory of 1556	4028	msedgewebview2.exe	190
PID 4028 wrote to memory of 1556	4028	msedgewebview2.exe	190
PID 4776 wrote to memory of 5032	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	191
PID 4776 wrote to memory of 1980	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	193
PID 4028 wrote to memory of 1720	4028	msedgewebview2.exe	195
PID 4776 wrote to memory of 3008	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	196
PID 4776 wrote to memory of 4812	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	198
PID 4776 wrote to memory of 1812	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	200
PID 4776 wrote to memory of 520	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	202
PID 4776 wrote to memory of 3364	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	204
PID 4776 wrote to memory of 3844	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	206
PID 4776 wrote to memory of 2492	4776	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	208

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3868	attrib.exe
2328	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4776.772.3876679553195941317
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\essential.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffbd0d8b078,0x7ffbd0d8b084,0x7ffbd0d8b090
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,14640309544121974456,11096038844978116739,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,14640309544121974456,11096038844978116739,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1376 /prefetch:3
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,14640309544121974456,11096038844978116739,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3624,i,14640309544121974456,11096038844978116739,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4676,i,14640309544121974456,11096038844978116739,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4428,i,14640309544121974456,11096038844978116739,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4688,i,14640309544121974456,11096038844978116739,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3940,i,14640309544121974456,11096038844978116739,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
    3⤵
    PID:2220
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp
  2⤵
  - Views/modifies file attributes
  PID:3868
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3340
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3688
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Roaming\essential.exe\v
  2⤵
  - Views/modifies file attributes
  PID:2328
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3340
- C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\lsp.exe
  "C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\lsp.exe" lsp --definitions=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\globalTypes.d.luau --definitions=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\executor.d.luau --documentation=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\en-us.json --documentation=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\luau-en-us.json
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3252
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4804
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3340
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:116
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3772
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:520
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1082592907\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4028_1999145774\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4028_26916436\manifest.fingerprint
Size 66B
SHA256 22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
MD5 5bbd09242392aacbb5fac763f9e3bd4e
SHA1 14bb7b23b459ce30193742ed1901a17b4dcf9645
SHA512 541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670
TLSH
T1CEA0026342648D9FBC1C042BD478A69DCD9115B088492445A925C75BB14203389F49A1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4028_26916436\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

beta.log

Path C:\Users\Admin\AppData\Local\Temp\Essential\beta.log
Size 1024B
SHA256 c665d7ec2ebdb735d998793b6d83ca23a1ea328d8acc7f303d69fefee08a770e
MD5 33406795546bd92f2d6bc3528b4d5362
SHA1 ca34ea1a4afe100fb23eaeb4dd3711e99e900d88
SHA512 95369a0859d4aa288066d5d54bcd43afac23a81dc412201a270923d71b014d169b3ad25a608c94fd245908251ce3dc5c50cf391e74a261b99a64c1c5965ba0c5
TLSH
T13F118EE706B4801BDDA7268FE769AE52B651FDD142C30E33A584376DA1C0343782A9D6
MD5 SHA1 SHA512 TLSH

Submit Download

beta.log

Path C:\Users\Admin\AppData\Local\Temp\Essential\beta.log
Size 1KB
SHA256 f0e24b41db7627d75c23ee9735996c55bc210ca45d1419fb6ccf9194bdf1ddd9
MD5 44af5d9fcd207db05fa0a16fbf7ad362
SHA1 b819b237e5a145f9343ddec042261f9f26c926af
SHA512 4b5adacc9dd1cebd0e9624349591574a86f60e35be44117d27088e134d8260382196a6cd3368934cdb4e41b1b2adb678aba071b8f3ec52117d8f253df3d5f99c
TLSH
T1EA412BDE06B8401FC87B214FF76A7EA2B641FAC105C38E36F949366D65D0243352A6D2
MD5 SHA1 SHA512 TLSH

Submit Download

beta.log

Path C:\Users\Admin\AppData\Local\Temp\Essential\beta.log
Size 2KB
SHA256 85426ccceaab6047dc4500426d439a7784390182ef4fd3cdaa3fa56a2127c9e7
MD5 d7b810d0116a256aff51cef5e195a7ac
SHA1 554e1a141f4006413be42f5fd53477d10499849c
SHA512 e03bc3771c253e0c8c4c37c52808316c40f6645c278932b1cc42954fa3ee3576e690200802a477e5b6fa5f479ae3f67d6fb966458229bc1b4480901d738554a1
TLSH
T170511A9E06B8002F887B654FF76A6EB27641FA8501C38E36F94D366DA5D024739296C3
MD5 SHA1 SHA512 TLSH

Submit Download

beta.log

Path C:\Users\Admin\AppData\Local\Temp\Essential\beta.log
Size 4KB
SHA256 d4586cbe2bec7ac6bc4817bfa1bb835f1fc4430391303a652c4b73c9ea1d10e4
MD5 2423d1956f1e24f2014af198ced2b745
SHA1 5a60c5d7207eb395d4af138bfa374e8e2368cdc4
SHA512 fe30e4de1c2aa0ec17cf4ac0a5bc6c7ac6f27b454c38eaa81bb2f97279b897aae85a6a08bda26257bb2a317e0ce15eab7fa77431277c8d5a4e22d39688335ab8
SSDEEP 96:TSWTNhIJSGRO/UbuM6oYi2aKLUmsoCzCe61lCebixoN6i6:OXPaVD0
TLSH
T143911B9A46B9001FDCAB264FF72A7EE37602F9C102874E37F44C365EA190247292D9D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 159f254487f6af489e17ae1d7734ab851588406fc75c9766c579d9c3e521b451
MD5 6cc9f083f3e1fe11ac13bc3bfadae8aa
SHA1 814fe204053e7eb8c95bae2e561262a34db1f53f
SHA512 43027e2dce3a168bbe53317ca45567b313e6ee170ea8dc3f79a7a9572d6da46c1034e188391d5910f4311ccf6839d8f16a0235b2de701eda3605f55caddf9299
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d352d141d280f995a73e83d88c0d8e191e7d03695bbd87e8d87ff3f969571948
MD5 53be6d4fd4323c7f0a528e841bb1eb08
SHA1 1c86b4fecb3477357a0f511f3502443020b40b5a
SHA512 e3156b7551ff6a37b421d74232b269ca4f100ad24e400902857e2a1d7572c4b94a417cd7c75fca2ed6eef97c8b27ed49d6a36ab19b7523e6df561d4ed797df42
TLSH
T184D0121233020234C02625331D936A0D9400C10B4105C00A5428D51D1B040600903442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 9ef765270c29358d3966ba6e2ccd131a69f4ac8d9f3f63a172d12fe4bcba7f08
MD5 45edc7a9344c99d0ec3da0706f408a8b
SHA1 db647fe6374e8c712395b351e6951e8633209064
SHA512 9e2362a43e4a4a78ddd76a00cce0c5a373cd639c07f7566d1a5744a26640851962cfcab972ae1d172391bde6ac612778e72a6b497e4361b9cec5e34197aa7f01
TLSH
T13CD0125855D90DA2D791D73917C209D3B73049A04317BEC752BB56F5C704754F106711
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d424.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58d424.TMP
Size 48B
SHA256 995102d1be039f35cb220490ea6ef772f3e8e6299f4cc3e206a8ec366b89fbc2
MD5 a1bc5132998ed036c1430b4d1b1165f9
SHA1 de85cc2a1ee53da0994aa3572ae2086449294a06
SHA512 193c9547219e70c3dd50c085bd4d4d89c31fee87a74a4926858a702e869efcfc1dc478d17fcaadd9f80035a4d046fbd0e5a2668b0f2e7bd2782c0ae71d630b41
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\Network Persistent State
Size 690B
SHA256 779985f0668d4f055288585637aaf9375567c46e10411cf840a798a9b921c972
MD5 73e4e0ba61ce85dfe2106a77688f2e66
SHA1 0ba514da92ce0d88b042b95430e2cda59c663608
SHA512 2da25dbbfd2c461a90f286cf5d1e77a98dfabbc565a9dd2be80ce4069c5d6491e707ee366c24d3dba0c09dd1e559114613146937eb6dae61275a509dc2f94380
TLSH
T116017BA287F0C66D8A4123E02734B817C92E04199228BD26CEEABBE65BD24B5E11054B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59983f.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\Network Persistent State~RFe59983f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 452af14f1e4743ab49029626c4c048fbdc40246f11ff218962d2c2c1ada5dfdc
MD5 3cacd9f899c9a98107ae217a107c5581
SHA1 bae404a0d194e58f5db5fc9b8a568fc185db8302
SHA512 bcb3ac9435e4754941ccc5b0fc4104fb61afabafa280895bde08cb6bcb445027b724331e428c23d73e3e3d0869a89cfb9eee3a496904517445eb06b2bb031ad2
TLSH
T13BF059A2C07AA4361079396A0E457D066AFDF437100278F4DBA2807D60454B34613033
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe591a93.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\TransportSecurity~RFe591a93.TMP
Size 355B
SHA256 fe7cfa13b5b1bb25d8c8300d4d9bfd0f7d21ab08eb7fb9940709dce4641d0ebc
MD5 c58377d13c922fa43a15bc8ad53edc7d
SHA1 ca6c6ae161ca5516c72ee12192e7dbe50b899798
SHA512 8dee6b45289624aca0b65c93eeaa785385742af8898861b89b7d49af90d7d9eb65500fbe0284d5d6e3e3b65d057a539a2acfe1544716b9b0b9b017603b54bad4
TLSH
T13AE02092903EA476107C752E4B84BD456FBDF174005268E8C79742AC60445778213063
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 97c3a5852de55491c2a6245691af6df6115b105df01ace82b884f36aabf10f47
MD5 977b2162ccc540782a2403aff33ea16b
SHA1 23567c4792852161b8b722624a09bf11114c58b4
SHA512 6622dfcf5ec3d83603eba861b94f21ffd17f860a79796801e8c5a52bafe4dd037b20efe12ddb45155bdcca2fa30901167d1e903d490695026ea2d841a7011706
SSDEEP 96:st805nB0ib9k73MffEZ8i0vhE0ktd6m/7qx+WVHMSm+uecJVh1idQjH+gN5MOB:st80RO73MfcZ8paXx/S+WiTVhwdyD5MC
TLSH
T12DD1C6426E6879774CCFF6497A35BB12E2F6106261C50E98ABFCC61C09D66CC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59193b.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Preferences~RFe59193b.TMP
Size 6KB
SHA256 b66871d5a360158c6423a0227783f2c260e0e522eb19e40808401003acedcb98
MD5 b41a2bb9bda2ea529638a9de91176ff0
SHA1 d8aa5acf964a5e4db1a644d717df73d4601a94af
SHA512 106ad59d63a26d1a11684dcdd4c36d3587cf4ac4c00cec7c6a019da7ab5ec9e0df443baac44a879aaf3e00c309ddf1d1fa839891091baed66e762541491d0f25
SSDEEP 96:st805nB0ib9k7uMffEZ8i0vhE0ktd6m/7qx+WVHMSm+uecJVh1idQjH+g35MEB:st80RO7uMfcZ8paXx/S+WiTVhwdyh5M8
TLSH
T145D1B942AE6879774CCFF6597E35BB12D2F6106261D40E98EBFD851C08D66CC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

en-us.json

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\en-us.json
Size 6.7MB
SHA256 bfb1ffb3119b4a081882237ddcd1e29f33ce0557a6e54ba7c1049392fb228bcb
MD5 12236bdb8a86788be295891516db9175
SHA1 ef0137add69bed3a10b1a1f8ca93b80e2fa60179
SHA512 ce47f4102511042707ae9622451f56b98b164ba15a38af936c467d0dd97f09386729d6db63c2579813eb4af8d57e5c24167565ec6730fdafacb1589252e43ddd
SSDEEP 49152:Acv8mlo/8ZrJGYbihxzWwvkeUvJVwG9he/a:p
TLSH
T18966CD72C9A01D932686165DF8B9425AF83840DB285D3D88BA9C732C6F88D7F51763CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp.exe

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-en-us.json

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\luau-en-us.json
Size 150KB
SHA256 df16b4bce28e169bc54442f030ae7cfbe03ea5588421be290b323a13a9cf4d1b
MD5 d53854e092e78a22e4b269464b18bbb7
SHA1 4dada46917d5fdd7aea42a47fef7c83f6c840ed8
SHA512 5ba2aec5526cc31eb2fb197295a928e4e408a2e77f506a9c58d369e968229b2795307f6061656dd20afb1237b561a27ee98159107431b64aa9667a295da686a8
SSDEEP 3072:6UBaQcZlXmr0yokdWR0MUBNpYybDwPO9he/jq3:6UBaQcZlXmr0yokdWR0MUBNpYybDwG9/
TLSH
T179E38A6CC6B11C231AC6212D997EA21AB43C40A7799F7C1079BC764C1F2C97DA37D29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 1KB
SHA256 d8c9ff01b0fceb68552a223f04f248d2f5b5d523178c4455dd7bc686a3cc9b00
MD5 de283e59b32c652db6c97e26cfda9a1c
SHA1 06e81452d20ec45f7fb87ab6da8439a1dec6d63c
SHA512 b06b94354b02499fdcbda65ab837e20db7fecc6c0c8fc094ae20ec96d6554757b53c3d39997974848333ba1f4ed6689ad9a1af118c9cabefb2e9b3883d776f03
TLSH
T1BA318572A4B4BF33AC9656D6B3453A975D202066C2224F4492FF8B2C01AB3DDD566C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 2KB
SHA256 c53e47424e47a0760f9e87937935560ea01a624f2c175f4d8b751eb5aea3dcb6
MD5 cd24b55c653d903765c8125f5642e0ad
SHA1 beed61533ddcedbcedc4a789bb6fc3aa15f8ec9f
SHA512 bcb263626cf0c42e0ddf511cf75367df2112a1f656c82cf83b652243bb71e828ccc8fee1b86eb5b3bfd69f60f9259685270fcbae90fb33537f71ddc415c27023
TLSH
T18851A7337864BA3389E79A85BB493F13993111A5D6621FA096FE4F1C01DB2AC6302C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 3KB
SHA256 1731642f208162b86ebd571452bc53b531cd9b4e1f5d0d70c13b3379d8f3d868
MD5 514dc3c6eeebeb89f6b0a5991e6e714d
SHA1 90ce93f50725975ff7b34ffeb7ce5ff2526f58b5
SHA512 aec26be6ae81298c503c44a81b5bce92035de27fa771cbdb404d5a5695b914c0d0e5a2e7993cd84626e2409fb626742ca21ca31c99a7c4279bd41d3fd512b2d6
TLSH
T103719433A8B4E9274DF79A85BA852B12A6A11137D5912FA4DAFD0F1C01DB39C2342C16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 16KB
SHA256 6e04ebe054c6b94958163309a8dd7353d86455ce77a8232d0c727bed8d8fbf53
MD5 02f0917155e793442c7ccdf1f2d06702
SHA1 6c34253709b760174252b40777d4cf4b381256eb
SHA512 ed366a10194e6a343b48eddc1e8386924748eb652aa298f33103f3f268208560cc354d230eb95f2c9ab1346d0c46670e6cec6c54b3491c850615c52cf07cb0c1
SSDEEP 384:zY+aQikB+z/xvxjg/qhEwNbMJ2ZIzfluQ7f9zC:L/UxvxjgC+xpTlz7fFC
TLSH
T1F0729E3754787E2365F7FA457A4C1B5BCBB584B280C12EB88AFE5F0D068B3A81342D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587654.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State~RFe587654.TMP
Size 1KB
SHA256 b9e35a1cdc9235bb5c71d4f97fe95378a1ab69e4ddba021be350bee303e0ad1c
MD5 e1e73d5451f864bad97a664bc91aacef
SHA1 860cc727462e9c811635e829c4a91b8ff4b7da0d
SHA512 93d7c045265b2bb10808466cdbe34b7ab3833042e656cd0596a9ca704177c8b5a9ae1cf1923cc9a759cf08248e61326b64086a489a089e1fdda877925fecc33c
TLSH
T1C0216533D4F4BE32A8565AD6B3517B871C502176C2214F48D2EE462C019F2EDD667C32
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\essential.exe\v
Size 8B
SHA256 e3121abb19d064148aa27a37c91ba2eee99940accea3eb1adea272c5a555df70
MD5 07c487b441fc294e19d48094b23ca80f
SHA1 e43cc175c7a56c5d600924ff63763bd78bbb2aac
SHA512 fb33f7b3d9dd2a2e79bfd1f5b5aa2bee3fd9d3ae467344dcc0e2079d084b8ed4ffd6aa33367b5f49562ea82230770800fe8acb813fba58e6d904623cb87c07bf
MD5 SHA1 SHA512

Submit Download

memory/756-135-0x00007FFBED1E0000-0x00007FFBED1E1000-memory.dmp

Download

memory/1720-600-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/1720-592-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/1720-594-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/1720-593-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/1720-598-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/1720-604-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/1720-603-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/1720-602-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/1720-601-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/1720-599-0x0000021CA4DE0000-0x0000021CA4DE1000-memory.dmp

Download

memory/2620-25-0x00007FFBED1E0000-0x00007FFBED1E1000-memory.dmp

Download

memory/4928-47-0x00007FFBEC050000-0x00007FFBEC051000-memory.dmp

Download

memory/4928-48-0x00007FFBED1E0000-0x00007FFBED1E1000-memory.dmp

Download