e19ed1931052ec51af42aac33b3cbb7e4c4540cbc8f9ffc05e48dcb707231173

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 10.8MB
Sample260805-a5h6nsbb77
SHA256 e19ed1931052ec51af42aac33b3cbb7e4c4540cbc8f9ffc05e48dcb707231173
MD5 6ae88fb185df2e96bdb15f4fc2b6c2bf
SHA1 792915494d42547e69282da91868577b39a94351
SHA512 907946a69eda2d3c1bed5d01f2013a2cbabc4d599e2e8b759636b7119531c78a1cb759dbca7ad7a169bc7f6fbfa7d956216a051ca67e7ef5b79cdb001ba53aac
SSDEEP 98304:UDKtKu+Ti+iLxU4qcfOUrO65u5ML/aMPQKpXtlzMjg+B9dZp30MTu:ftKu+Ti+iLxU4JI65u5UZQUPzMBBnfa
TLSH
T10EB6D624AA5F996CD09BC474834B8A67493430CB0B35B9BF5484963C2F6EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_301807443\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_301807443\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_301807443\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_301807443\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_301807443\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1277072076\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1277072076\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6052_1277072076\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
844	msedgewebview2.exe
844	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6052	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4976	2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 6052	4976	2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe	88
PID 6052 wrote to memory of 3360	6052	msedgewebview2.exe	89
PID 6052 wrote to memory of 1972	6052	msedgewebview2.exe	90
PID 6052 wrote to memory of 1972	6052	msedgewebview2.exe	90
PID 6052 wrote to memory of 1972	6052	msedgewebview2.exe	90
PID 6052 wrote to memory of 1972	6052	msedgewebview2.exe	90
PID 6052 wrote to memory of 2640	6052	msedgewebview2.exe	91
PID 6052 wrote to memory of 120	6052	msedgewebview2.exe	92
PID 6052 wrote to memory of 120	6052	msedgewebview2.exe	92
PID 6052 wrote to memory of 120	6052	msedgewebview2.exe	92
PID 6052 wrote to memory of 1184	6052	msedgewebview2.exe	93
PID 6052 wrote to memory of 1184	6052	msedgewebview2.exe	93
PID 6052 wrote to memory of 1184	6052	msedgewebview2.exe	93
PID 6052 wrote to memory of 1184	6052	msedgewebview2.exe	93
PID 6052 wrote to memory of 1184	6052	msedgewebview2.exe	93
PID 6052 wrote to memory of 4824	6052	msedgewebview2.exe	97
PID 6052 wrote to memory of 4824	6052	msedgewebview2.exe	97
PID 6052 wrote to memory of 4824	6052	msedgewebview2.exe	97
PID 6052 wrote to memory of 844	6052	msedgewebview2.exe	98
PID 6052 wrote to memory of 964	6052	msedgewebview2.exe	99
PID 6052 wrote to memory of 964	6052	msedgewebview2.exe	99
PID 6052 wrote to memory of 964	6052	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=1.7.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4976.1584.261037142747895419 /pfhostedapp:bfa07b568c5f18141f02bad77b702f12fb72f837
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView /prefetch:4 /pfhostedapp:bfa07b568c5f18141f02bad77b702f12fb72f837 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9fdd05fd8,0x7ff9fdd05fe4,0x7ff9fdd05ff0
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView" --webview-exe-name=2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=1.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,4087050310863521666,5512185742709134386,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bfa07b568c5f18141f02bad77b702f12fb72f837
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView" --webview-exe-name=2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=1.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1752,i,4087050310863521666,5512185742709134386,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bfa07b568c5f18141f02bad77b702f12fb72f837
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView" --webview-exe-name=2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=1.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1752,i,4087050310863521666,5512185742709134386,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bfa07b568c5f18141f02bad77b702f12fb72f837
    3⤵
    PID:120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView" --webview-exe-name=2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=1.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3336 --field-trial-handle=1752,i,4087050310863521666,5512185742709134386,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bfa07b568c5f18141f02bad77b702f12fb72f837 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView" --webview-exe-name=2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=1.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=1752,i,4087050310863521666,5512185742709134386,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bfa07b568c5f18141f02bad77b702f12fb72f837
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView" --webview-exe-name=2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=1.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4492 --field-trial-handle=1752,i,4087050310863521666,5512185742709134386,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bfa07b568c5f18141f02bad77b702f12fb72f837
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView" --webview-exe-name=2026-08-04_6ae88fb185df2e96bdb15f4fc2b6c2bf_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=1.7.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4300 --field-trial-handle=1752,i,4087050310863521666,5512185742709134386,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bfa07b568c5f18141f02bad77b702f12fb72f837
    3⤵
    PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f451ddd3f57754d25faa7ec95a2608ad65a5d50cc09eec4c2b46004085220f46
MD5 353a55d597ea607bd5047851d04d6d5c
SHA1 3dc02d06208a905934f2c4742d8a69a549b14443
SHA512 c4f26bc96d8c6c3e3b7b7a8e7190978a75e94f69603f4d3c7277b87083c32f4e97e299947894880daeabdea2ee595efb8da43ac6befad65bb021c5d7640cff21
TLSH
T15AD0122672010A34C4143033061262491401C50BC015404D542DD65F1B180940D03C45
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 25a2858b205b62ad078b2b917a6c9f5389fd5e2a46ad25f27f096b31aa82f2bf
MD5 125c38bd678b0f54b556d0be3c08cc06
SHA1 b22933f60f6a3205047e0652b24f64eb043c7802
SHA512 50a7d7154180ae1ecd28d60dbd156143435d1edba36eb0a020698b78db81f4425fb7c17c227b96bc0ca208f42c1ea5aa463bac80a2604684e9ea205c7dea9377
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 160ad6d9fa6fbad8297216a923b62c3800e780324f6893c6000d6b25c689d8e9
MD5 e7112a6f892a84fd1cf1f32cbd17559d
SHA1 93347fa3f7967cb60f95fca8a750056ea45cf2db
SHA512 46dcee2e9b0d98d72348985d9db1f3bb56e52a7c6f0128ee076ddfa85793588b567da8628ed215dff4bf9f3696df92322fac8273b88e5e9ac2d406b654bfa6be
TLSH
T1C3C0123590004083C32F317C71C7101D7670A5680DC72CE800B714B69C33750E717000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a371f.TMP

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a371f.TMP
Size 48B
SHA256 83205ef34c13bcfbc5be729331a136ea8fdfd064ff178becfa1a7fd1c566aa08
MD5 bebc3bf8d3cf5e99a9adc655217e37e0
SHA1 19c1b2985e1735a30a1cfe8155f3e6ea455b50c3
SHA512 4087f3821619d14f89a975e1f428a0050d11c7d70c2c41539f4e382d4e5e364ca096c57264d9ac9c306f276d547d314d99b1047f84c9e59e88bbac0658e82ad5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Default\Network\Network Persistent State
Size 949B
SHA256 96b4b9d2edb7f33c9529102f5c57d3d1e7523bbf4a1fe10177e9a7daf77fdbc3
MD5 c1967c168d1b8d80609056d554fe3970
SHA1 e7bb04ae4315f67aa683b0e355989bc11357062d
SHA512 575e70f9470c2c5e846191a7a5f20427a77c282c6c2d3b83b511a4652d540d792a1f1f6c1adad4fef91aab9fdbf66944665417be371db45f5913d840e29c9d22
TLSH
T13F1171B283E4C67D8A4167E06B343917CD3E041693286D27CDEAEBDA57D1071D11064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5af965.TMP

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Default\Network\Network Persistent State~RFe5af965.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Default\Preferences
Size 6KB
SHA256 ec17d2394792c507d453b45c7524457db5366bad2dc9ec3c23fed55a59b5f2c2
MD5 ddad39eb93d37a0fe1872193d7e57645
SHA1 c9c291ea786701fbb1e08dc3858c98bdd62102b6
SHA512 ec6574f9572824529d0dfbf9f686b1cc2310040f16feab2f8de20922beaca7eb35cc1298815852e00b420c523dd0d310de883906b7be2a2e676f4eb0c355ba28
SSDEEP 96:sth/dM++aiGib9MkAo5h16Z0Zs7/x+6MhmuecJ951ejegK+gdGS328XM1C7K:stVOb+1onZsV+Fd95QjobG6K
TLSH
T1A5D1A6029E28BD7B8CD7E109BA69BA13E2F6707275D51E58E7F8552C04DB6DC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f47c4ccd-a501-4a3f-b8fd-d3dfce9a220b.tmp

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Default\f47c4ccd-a501-4a3f-b8fd-d3dfce9a220b.tmp
Size 6KB
SHA256 0dbe7161b06c6f6ffe1c434da109b5626810038037990f2e7cdfd6cf7af9c6b4
MD5 7fec9278f2999f307e801ee712468c94
SHA1 2a0a7aef3d2153fe57d5fbf747edd4f46b95bbdf
SHA512 bca13b6a36597920ff144763cf4b5a28166e29065114ab0b70d0f4ef6f0d7651efa015cbffb83055cd2404cf0c982df215d5664f5cad9c0cc4d817928998e56e
SSDEEP 96:sth/dM++aDib9MkAo5h16Z0Zs7/x+6MhmuecJ951ejegK+gdhW28XM1C7K:stVObQ1onZsV+Fd95Qjo8G6K
TLSH
T179D1A6029E28BD7B8CD7E109BA69BA17E2F6707274D51E58E7F8552C04DB6DC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Local State
Size 2KB
SHA256 6d5723024c9095d5b8f3501fbe88c012f1906baa6a4e25850bdb29275eeffd48
MD5 fe8b4f208c2ff8960ad617f7aefc75d7
SHA1 aa3944616f7853e8d7d4edd6517cad4e00398605
SHA512 997234f3e4a5f2ec54310cc81258397588ad203be0eb8ba1d8143bdafbbecdb4177e048239f7ff928fefee8fd6017ceda83843230e8b7b709d08874783dc0f07
TLSH
T1D6519533F8246F37D5F29608B98A3B13CE7660A69B622F6096ED1B2C41D655D1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Local State
Size 3KB
SHA256 7bcb1d42264e766d88366c8dd2a8a6e9a596ac1856a0021921bee2cfe50b9371
MD5 895d13fd8412f682ab007ec31d053969
SHA1 a763dace9042ff5244f9264f9be642b7405ab91f
SHA512 84c272528f4bd55b7f981a6bd2eaab16f94e55511c4d54777780dce319bee04dd834c6260278d4820d23326e35fa0c50307b2b3510a061f01dd1d966260bb789
TLSH
T19B618737A974AA3B8EF39A04B8C63B06ABA55077D6913FA4D6EC1F1C41D729C1341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Local State
Size 15KB
SHA256 ab4050343398542ea2322708c509f8276d44d5c93689799983f272ec563b7442
MD5 e6b1b93f0a5439584f8daeeeaad6536a
SHA1 ba77875d318b001c989e7b7b18bdbab05f088a33
SHA512 fccbc38020678fd517d71523661f79302d21d170adca32a3439793ef4d22d6d6286fea8fdd7ef20655ea0e4c2d0bf9becd39a416a3283b582525c162d6e1aa80
SSDEEP 384:C+aQikB+z/xvxjg/qhEwNBSe/rFzh8bAe9z2:t/UxvxjgC++JreF2
TLSH
T117729E2BA8787E37A5F3E914799D1B5BCFBD94B251C26D7849F96F0D06C72980302813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59e47a.TMP

Path C:\Users\Admin\AppData\Local\com.pr0gorib.axis\EBWebView\Local State~RFe59e47a.TMP
Size 1KB
SHA256 7a649cfaafb5d58479cd3949a22922bab4cb931dd0eea9ad0c84a4dd59f00a47
MD5 de20ed26d87777738c2587b7c0627729
SHA1 f2568882fcbe2b9234200ec6cea4cb8cb8abe072
SHA512 e028f78d00403e45fd5db424c6ac7690c3cf46a8163fcbadd5bfd7de744d3369e76f60c83d735d9d3d5a6bbaf6bf71f89517b574780cdf504a1f9239eacf987b
TLSH
T121216571E9642F33E9D26609A1877B078D71106B83610E1462EE1B2C81D649DD62AC33
MD5 SHA1 SHA512 TLSH

Submit Download

projects.json

Path C:\Users\Admin\AppData\Roaming\com.pr0gorib.axis\Axis\projects.json
Size 216B
SHA256 7096506db96c5a264d9e764b09622bb5e68a60aff67c8aaff8f947192124bdac
MD5 1a37fd8920f6b9a1d9e7f1da78af7fe2
SHA1 6ba90126d76d987f582555bc942109a27da80d9a
SHA512 675e221c91df06d9bcb3831a6599286b5bf72311784b5dfa9c7b9ee77eaa1f222552c88123d0cc01dbc024c746c0903ce13c53d2f9f5f8f721c7264040e90979
TLSH
T166D0222CB92009C41BDD555AD3BE0843B0062A530E6138A0330E8F1B5F0434B083220F
MD5 SHA1 SHA512 TLSH

Submit Download

data.json

Path C:\Users\Admin\AppData\Roaming\com.pr0gorib.axis\Axis\projects\my_comparisons_c0by\data.json
Size 37B
SHA256 692ce3e7377bb43e8e3a71f327e8258343fd7a68acaaec57aac87aadd36a54bc
MD5 ef65c800617d460f93eaaa5652416146
SHA1 c819344c282691df701f87c9627b5344bb38c5f2
SHA512 81753d93e22a5dea837199fc996d711b46498241a9b2a2f6868d63ab7a00ea4cb1448f66c3303fa323181477418bc5b346335424b9cf98f055ccc8686a4944aa
MD5 SHA1 SHA512

Submit Download

memory/844-371-0x0000019884600000-0x0000019884601000-memory.dmp

Download

memory/844-379-0x0000019884600000-0x0000019884601000-memory.dmp

Download

memory/844-378-0x0000019884600000-0x0000019884601000-memory.dmp

Download

memory/844-381-0x0000019884600000-0x0000019884601000-memory.dmp

Download

memory/844-382-0x0000019884600000-0x0000019884601000-memory.dmp

Download

memory/844-380-0x0000019884600000-0x0000019884601000-memory.dmp

Download

memory/844-377-0x0000019884600000-0x0000019884601000-memory.dmp

Download

memory/844-373-0x0000019884600000-0x0000019884601000-memory.dmp

Download

memory/1184-70-0x00007FFA1DC60000-0x00007FFA1DC61000-memory.dmp

Download

memory/1184-332-0x000002503CDF0000-0x000002503CE99000-memory.dmp

Download

memory/1184-276-0x000002503CDF0000-0x000002503CE99000-memory.dmp

Download

memory/1972-275-0x00000285577A0000-0x0000028557849000-memory.dmp

Download

memory/1972-291-0x00000285577A0000-0x0000028557849000-memory.dmp

Download

memory/1972-26-0x00007FFA1DC60000-0x00007FFA1DC61000-memory.dmp

Download

memory/1972-395-0x00000285577A0000-0x0000028557849000-memory.dmp

Download

memory/4824-349-0x00007FFA1F3C0000-0x00007FFA1F3C1000-memory.dmp

Download

memory/4824-350-0x00007FFA1DB10000-0x00007FFA1DB11000-memory.dmp

Download