13248a3909ff4e0643bee8d8e8fca66d8b0ed7c67cbc31f18695ed7701375503

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Size 3.4MB
Sample260804-pkpv2sen3t
SHA256 13248a3909ff4e0643bee8d8e8fca66d8b0ed7c67cbc31f18695ed7701375503
MD5 3b08b09188c80989ee9414306b004591
SHA1 a52bc91c9e8426f05edb861e847d75e2e3644d2f
SHA512 bee1d2628be90daf88e2a951b133e323f6689b03dcbc037160b3098cd5f12e7ee8a2cf5a1c7150b937b54588c08f3d4b36a595b7648419b9eaa20c5d0a1f02e1
SSDEEP 49152:JpsNP6jh/Og5PwJuGtNxkz3x6BM4A4/kDV91omT/U0xFdgC0YdM0rUr:gV6jVwJ28SgcDV9fLpvrI
TLSH
T168F56C03E69580E9C06EC07883569637FA32B88B4624B2DF7BDC0B112F66F905F5E759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView\DefaultIcon	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView\shell	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView\shell\ = "open"	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView\shell\open\ = "用 mdview 打开"	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe\" \"%1\""	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.md	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView\ = "Markdown 文件"	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe,0"	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView\shell\open	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\MdView\shell\open\command	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.md\ = "MdView"	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
592	msedgewebview2.exe
592	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
984	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 984	2512	2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	89
PID 984 wrote to memory of 4324	984	msedgewebview2.exe	91
PID 984 wrote to memory of 5680	984	msedgewebview2.exe	92
PID 984 wrote to memory of 5680	984	msedgewebview2.exe	92
PID 984 wrote to memory of 5680	984	msedgewebview2.exe	92
PID 984 wrote to memory of 5680	984	msedgewebview2.exe	92
PID 984 wrote to memory of 3288	984	msedgewebview2.exe	93
PID 984 wrote to memory of 6036	984	msedgewebview2.exe	94
PID 984 wrote to memory of 6036	984	msedgewebview2.exe	94
PID 984 wrote to memory of 6036	984	msedgewebview2.exe	94
PID 984 wrote to memory of 3744	984	msedgewebview2.exe	95
PID 984 wrote to memory of 3744	984	msedgewebview2.exe	95
PID 984 wrote to memory of 3744	984	msedgewebview2.exe	95
PID 984 wrote to memory of 3744	984	msedgewebview2.exe	95
PID 984 wrote to memory of 3744	984	msedgewebview2.exe	95
PID 984 wrote to memory of 592	984	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2512.1232.17380060387027143285 /pfhostedapp:84a64b9c644d3f9f24376044870a54096d001ea5
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView /prefetch:4 /pfhostedapp:84a64b9c644d3f9f24376044870a54096d001ea5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x164,0x194,0x7fffd02a5fd8,0x7fffd02a5fe4,0x7fffd02a5ff0
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView" --webview-exe-name=2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1828 --field-trial-handle=1840,i,6551302140926318236,170035263961436928,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:84a64b9c644d3f9f24376044870a54096d001ea5
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView" --webview-exe-name=2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2012 --field-trial-handle=1840,i,6551302140926318236,170035263961436928,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:84a64b9c644d3f9f24376044870a54096d001ea5
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView" --webview-exe-name=2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1840,i,6551302140926318236,170035263961436928,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:84a64b9c644d3f9f24376044870a54096d001ea5
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView" --webview-exe-name=2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3396 --field-trial-handle=1840,i,6551302140926318236,170035263961436928,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:84a64b9c644d3f9f24376044870a54096d001ea5 /prefetch:1
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView" --webview-exe-name=2026-08-03_3b08b09188c80989ee9414306b004591_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4376 --field-trial-handle=1840,i,6551302140926318236,170035263961436928,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:84a64b9c644d3f9f24376044870a54096d001ea5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2ee0b2027d47e59c7628dc9626efa6276c652766f360c639c8201b4ef4b97713
MD5 1a7d41d942e4753d715b9e65f88075c7
SHA1 f0c0bab96d03cbba6a04356aa11f82d3e334fd81
SHA512 e1e62d7f233b22591d4bfc38d364ad5945960feb30a9f36afa3bb62f5ad11b294f9d55f29b4c842f16a0b5848fe37e723cc675bdc96b35515a3108b91eae0fd6
TLSH
T10DD0121333490578C01020B31002A5890500C11BA0464100A438E71E1A080A02917481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 14c8062a43db262f41cbb71857dfd538236186eaf737ecddf49f328cbe5f2989
MD5 f880cfd6b18821baa21c2621cb458476
SHA1 840e1543a71abdfba7e7e3dc3f2a5bb6bbf4eddb
SHA512 0c320206c5a82bd67cc95b0eaad177910334558464378c073d7677f7fe380cc652f3d6d5a7848b2922883fc8d45011dc33603db0ce52ca7f565984e34883e3ba
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

4ff60316-d672-499c-8918-954fdc7720cc.tmp

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Default\4ff60316-d672-499c-8918-954fdc7720cc.tmp
Size 6KB
SHA256 89b654e19232b7125d8c3080b27a6c59f9243fa47364391141cb1339bf633005
MD5 11821b6418230252d873cb16b277c525
SHA1 fdccad57f278465af0a76e68b805d68d313bf73f
SHA512 6ba240338c8cd6223e4cf98f81a414b761e1721a00ac31655a6ccd5e0b7840007ab9f3ccbd67b26bdcb9d80c0e168f84f3092fa75c48cbdc2375a3b5f3618c22
SSDEEP 96:stj/deV9sb9dkio5h16Zdas7/x+6MhmuecWzT1ejeEK+gYGyej28XM1C7K:stbUExoKasV+FizTQjU+eG6K
TLSH
T1CFD1A5015E24797B4CCAF519BA3A7B43E2F660B261D51E68F7F8562C08DB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5abefc.TMP

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5abefc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 746a7bdf4392a4850f9b94a494fdea48a2b4d05f2feec6e8d7bb808f6b50aa2d
MD5 a624bbf13471c16c34c1771d4e4afffd
SHA1 74971b2a33a13a33c3814904cec327959484109b
SHA512 3a9a75c8f2a493246388e11fbf25a91220cc414536c851d92aa96a771f83d6087dfba753b27a9d0add67a46a7718400bfd6526131b1e16f236f9470da0aff764
SSDEEP 96:stj/deV0Gsb9dkio5h16Zdas7/x+6MhmuecWzT1ejeEK+gTGKj28XM1C7K:stbUGxoKasV+FizTQjUxG6K
TLSH
T126D1A6015E24797B4CCAF519BA3A7B43E2F660B261D51E58F7F8562C08DBADC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Local State
Size 2KB
SHA256 6427c05a1867ebfaef95faa92e20303289ba2af93364439290b554b6f7935453
MD5 08daf0387aac5ce1b31517e89af8f984
SHA1 b8e60a89153cdcf677cb0c9f776bb9c67e36bc7e
SHA512 9f88675c51bd393fce07c859c0d0d840498a65fff3022b2df0d1b22595a5a3fce077fa740d0dc2059b35736d9482cbc3d2bc6610746e507c863e6c3d49358e3b
TLSH
T18A51B833B914AB37C5E75644B84A3F63DEB6A1E2DA521F60E6DD2B1800D759C1342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Local State
Size 3KB
SHA256 b33f6ac323b279c755725175c7f71286e1b2d3779f342a823a1abdf27c65ded0
MD5 72dd89bc4a1bee0ae072cbf4e1c51f79
SHA1 6084b807993c33b74c6c1dafd44ff85d88b00473
SHA512 e2f085dd0f89c64bda2c9b50208f20f25cf651f2f23f4f10936c05f100cee52049496f79715375805d2db6a8cc97ea73ca44a4e38ad42163bb8d03dfa3197d6a
TLSH
T1886196376974AA378EF79A05B8862B17ABA55163E5813FA4D6EC1F1C01D72CC1342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Local State
Size 15KB
SHA256 79f483950bf82904e01af232486fa0b66cacd5559faf830c1ad71c2d04453c05
MD5 53550e72545d99596d6331235cc62d1e
SHA1 f5119afb18a5f5a11d020e88206d1735d6afe461
SHA512 18c902ac50c753fa916b505e0bfd34be7b0745734563b753cbb6f49097d4ee6ed33461008779217d1f438212fa11ed4e9a5a2225f30a6880104f0f43a27305d4
SSDEEP 384:L+aQikB+z/xvxjg/qhEwNBSmYsEWUd6f7s9zx:q/UxvxjgC+ubNc6f7sFx
TLSH
T12372AF2B95797E2795F7E605794D078FCBF998F291822EB84AED6F0806C32D80342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe599764.TMP

Path C:\Users\Admin\AppData\Local\mdview\WebView2\EBWebView\Local State~RFe599764.TMP
Size 1KB
SHA256 a4414bb108d0a18037227cbdfb8cd8a582eaf3d85385e985c7ca9381b11c2795
MD5 5cb75a54d6724eeed879ab908f5fcfb2
SHA1 b2148d282214664d8c3356003c3a9fd81621272f
SHA512 bff087f8065739cde55f48139d164a48fcbefc151b49ea1aa5e43364756bc8c9a0f48829be77811b4e880390333d73edd5151c55ab5dfb20437e35e0d9cabe0b
TLSH
T1AB218473E5A16F33DCD72246B0462B975E7220A7C2000F50B2CD9B2801E70CCA26BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

.b90c9dc193b52ef0.dat

Path C:\Users\Admin\AppData\Local\mdview\cache\.b90c9dc193b52ef0.dat
Size 267B
SHA256 99aa56dfc2f61dffbd569ea7c676b632a280a91cb2af0ca92d088d9ce6b1e82c
MD5 7a8a330a637b69ced7265374be007820
SHA1 335603e83eebfc415d02fe95da4e9e0f0b0d5f42
SHA512 c2b413f78343356b29206520be4d26a9a9a16e627a1b3cd96cfdf4a552dee7dc73d0429a511ceb261fa3e191782e7dc838c0acec43a6759d07b50607ed322608
TLSH
T111D02E2A6A488CEB2AD7A086DCE19C2FC2480532F408B08CC03A060098DF66F00AB296
MD5 SHA1 SHA512 TLSH

Submit Download

memory/592-283-0x000001964BA70000-0x000001964BA71000-memory.dmp

Download

memory/592-277-0x000001964BA70000-0x000001964BA71000-memory.dmp

Download

memory/592-275-0x000001964BA70000-0x000001964BA71000-memory.dmp

Download

memory/592-281-0x000001964BA70000-0x000001964BA71000-memory.dmp

Download

memory/592-285-0x000001964BA70000-0x000001964BA71000-memory.dmp

Download

memory/592-284-0x000001964BA70000-0x000001964BA71000-memory.dmp

Download

memory/592-282-0x000001964BA70000-0x000001964BA71000-memory.dmp

Download

memory/592-286-0x000001964BA70000-0x000001964BA71000-memory.dmp

Download

memory/3744-102-0x00007FFFF10E0000-0x00007FFFF10E1000-memory.dmp

Download

memory/3744-208-0x000001EEE9860000-0x000001EEE9907000-memory.dmp

Download

memory/5680-207-0x0000023CBB570000-0x0000023CBB617000-memory.dmp

Download

memory/5680-24-0x00007FFFF10E0000-0x00007FFFF10E1000-memory.dmp

Download