0ae278280e794293daa419642d4f2fb1a0650e3ca4e8167c4c5fa706fd753f09

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe
Size 15.5MB
Sample260808-dbywtabc85
SHA256 0ae278280e794293daa419642d4f2fb1a0650e3ca4e8167c4c5fa706fd753f09
MD5 b94cb7a6fae2a61bcbb8d44f59e44a88
SHA1 e0b8cfaa05682ebb7a85d0bb3cc226e5d8136d05
SHA512 8d2e5a93da17338db7602081a68185601b713298501b961b9d2e48e0baa1c131b002f320021b469acf942ecb81235ce0445c518135b8af49915ae68423a151ae
SSDEEP 98304:Nh2qoRCZZBiOOjTT3hyavPNqSwQcyQ7XGjyQbbKSDcnytOBt+++0S4HOFiyr66yI:Nh2qoRCZZBiOOjv3E6Fxbb/DVaY04OS
TLSH
T1F9F607257B5A99ACD09BC474834B4A725A7130CB0B35B9FF44D492382F6ABF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306310675072676"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4884	msedgewebview2.exe
4884	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3916	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
952	2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3916	952	2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe	86
PID 3916 wrote to memory of 2892	3916	msedgewebview2.exe	87
PID 3916 wrote to memory of 4920	3916	msedgewebview2.exe	88
PID 3916 wrote to memory of 4920	3916	msedgewebview2.exe	88
PID 3916 wrote to memory of 4920	3916	msedgewebview2.exe	88
PID 3916 wrote to memory of 1552	3916	msedgewebview2.exe	89
PID 3916 wrote to memory of 896	3916	msedgewebview2.exe	90
PID 3916 wrote to memory of 896	3916	msedgewebview2.exe	90
PID 3916 wrote to memory of 216	3916	msedgewebview2.exe	91
PID 3916 wrote to memory of 216	3916	msedgewebview2.exe	91
PID 3916 wrote to memory of 216	3916	msedgewebview2.exe	91
PID 3916 wrote to memory of 4884	3916	msedgewebview2.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.9 --user-data-dir="C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=952.1684.11917572300875796592
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x138,0x170,0x7fffdba0b078,0x7fffdba0b084,0x7fffdba0b090
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView" --webview-exe-name=2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,3822353321979468604,7050751259692590659,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView" --webview-exe-name=2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,3822353321979468604,7050751259692590659,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView" --webview-exe-name=2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,3822353321979468604,7050751259692590659,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView" --webview-exe-name=2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3572,i,3822353321979468604,7050751259692590659,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView" --webview-exe-name=2026-08-08_b94cb7a6fae2a61bcbb8d44f59e44a88_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4468,i,3822353321979468604,7050751259692590659,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 22d6aa85a5ccca359fe873dcaa9822251caea212de8f92616d0632224fc3749b
MD5 a5315e172bd57a6d0fe8cb002d5160de
SHA1 7eabf1244b44117684783015173dfbce557526b7
SHA512 8f435d6042d17020f26bd7d477da0c9fc0ed265261aa0038f01bb5f9d6b4cd314caf3cda8e003000a4cb59a222347e8e771933c28c950709cf2f8c237fde353d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c057e6aed59d2a6f6c82b7852151d2523046504dd6f2cf942c267573ea09b95b
MD5 9a7109a06b8b00b0e14fa0802b25e01f
SHA1 4235785001e93de60e7d3c29a4920bb7cddc27f4
SHA512 a35ddb34b275136c02bf7fd703fbfbd545505a03a11cf7083a8084d2187b9c80d8e6d37655e7e14d3206508134733518c8a6015fb76553008bccf508291f179c
TLSH
T109D024133751C174C01030330753714D0DC1D31FC105400DF53DC51D5F440543D13441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 feb12df14882cd2d53b6c49ac17c4c947e66ddf53b7a9f9ef65aac5d4393c046
MD5 545aec0ecf37ebf27078b6323a916218
SHA1 42cda90fa3244eaa242d213fb9ea992a8b23c716
SHA512 ab872a962369f99a7ef995b631c0715665cb3be0baa3adefe0f9f5c5f49378f57e34e13bd009a2577ca17b1d119f715de22108ed193265e6c3075e56e1a438d8
TLSH
T1F2A0026006495216D96947B251CD0AE577345C1807034F0197F52574C970F84C112104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588bb1.TMP

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe588bb1.TMP
Size 48B
SHA256 b7f28811b5de64d9bf394281fa6b81b6ed5de536271ddb30eef30978a722bae5
MD5 d599012046250d3bf3f0e15f6f0906eb
SHA1 828301b551b0daf1eb71ca63f0ca2e9db9598e46
SHA512 5c27110941d21fdc9b1257e9ebbe9cb2ceb49d8f4a708df6ce648eac2e893aaac440f52c102c935b87959c991ee8969e6b456771637f36cca97d8fc54e79bb9d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 43208c83c85ead6f74c85c864fae3edcebd47500bcf7aa39648269fa56562600
MD5 8073c1114e5683725fe398e24af08abc
SHA1 d9cc05c63798ac67d4b381e0b7e0209920e9d788
SHA512 c90c7b949450a12e9b3720f7aa75da0ac5194e83b4f470139e1db8ffed88caa49a4154d2ce1ba936b809431c961dde17761cf90b040d247b42f32c30dd4f44e8
TLSH
T1270182A2C3E4C57D4A4156E427347813CD2E041952282E27DDFDEFDA5BD1075D11050F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe594e84.TMP

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\Network\Network Persistent State~RFe594e84.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 9504788d38afcec9f04511ce4614dcc8be1c400759c7c137f3d82677c573e9a4
MD5 831f2a81205342417246df6d744f14eb
SHA1 3eff3a602d048bda6cccb119fff240e0bf2d9ec2
SHA512 1e201ae52ab93a170b403f7a73ba94d9c54dd0c5fd3e8f1c2cc02297fd73bb98d22ccf2cc9a02c5a6482055cb303d480910e66a0407337ca0a83c0cec1614427
SSDEEP 192:stu07IfGZ8paFI/S+WiT5FNVwYjCgIq+MC:str7Ipt/Vzw0vC
TLSH
T1CCE1C9025E287D778CCBF61D7A35BB52E2F9202225D40E58ABFDC56C18DB6CC220794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d54c.TMP

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\Preferences~RFe58d54c.TMP
Size 6KB
SHA256 1cf782c016370a1ac73ecf0812a1031a0cbb3232dd31e63a417cbc5a029969c3
MD5 730b8f6c719512519a58734336fdd31c
SHA1 94e53719d1e2d09e47330ceb62404cd434374b53
SHA512 afee39c24528a72e6b11d93c3262044464271bd2ec0f9710233f78a57f4ac10698c8523f9198d69a8581bb3e1cf3ae75c771308bd819516349b212e1e783ed1b
SSDEEP 192:stu07XfGZ8paFI/S+WiT5FNVwYjCguq+M8:str7Xpt/VzwIv8
TLSH
T1AAD1B8025E287D778CCBE21D7E35BB52D2FA206265D40E58EBFD856C08DB2CC620794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Local State
Size 1KB
SHA256 37038c010a05d6ab5e3841b911b7892759f73bbf156963140a765a002aea2dac
MD5 89236e479113f10d1d38f7087c44741f
SHA1 cd6b2f297ba2958e4d3798182433900f3c255a39
SHA512 ea63ca8e78181ea94b9a52d058bc53494f42369b4705ccfd3d2f70e4f31e34f9b07434f1c4e1b011dfafedb8603066cc28e5fa32cac977142d5397ac00091100
TLSH
T199318572D8A03F777CD6569D710A7E931D642166C0218E8894EE8B2C16DBACC6D2BC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Local State
Size 2KB
SHA256 1cd8ce9ee7f15f157be547bdd07d99282e99f73e7bf402f69cd7c1e8f3a92217
MD5 28d1cb13af5c96ecc01f699991838e1c
SHA1 15c0308cf45a43dde844b434a2b5eef21f8d4230
SHA512 5cc93ab8137ee51a4a52a70ff5710d2e67cfc4512755d9155a8ed768429ad1349885e65c4565a2aabcdd4950848f1627feb45851af216ed6374bf0085112c760
TLSH
T1B651B633AC14AE7749E74A5C784E3F539A3961A1D5622F9489ED1B1C02CB6DC2B12C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Local State
Size 3KB
SHA256 1bcb68afdfbbab572acc0e531885aa44b3ffbbca37f62848d3a1a14bd733ace7
MD5 8c91fb102b0bf1c43b06fe05afb6f9d5
SHA1 8fc2f22f290ec5d43d57f3f1f2962e54db48e10d
SHA512 9f9533df5273760b5458986a4a5ed5c3412fb60d01e7e510aeb29e2e8b81da594132265ddd2cbee29f1d2b5155fba420b8c333172c59cdc7d5171dcf8a03a755
TLSH
T13371A836A864AD274DE79948B88A3F03B6652133D0913FD8C9EC0F1C02DB7C82752C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Local State
Size 16KB
SHA256 ebe664f205d0c336323f18acc8d521628177b21e417c29580707a74273a55e18
MD5 c142c8aa90e48ddfed8330af1ed3f1f3
SHA1 3a4d9e94b99a38ce279611ac7d492d07c6b671da
SHA512 7e0caa6b9173e560aecb5c5433136e8714fcde105d24742bfbb557b60b1eb2b59250ea611c4d5037f315d03b687e08305a7afdab8bec66fbede642eb8dc379a2
SSDEEP 192:zs7DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4k0NbRKfooDUhRLP:z8+aQikB+z/xvxjg/qhEwNbIOqukd9zA
TLSH
T152729E2BA4697D3355F7E909790C0B8BDAB894B2D0C16EB849EE5F0D0ACB2D81702D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5835e0.TMP

Path C:\Users\Admin\AppData\Local\com.easytrader.desktop\EBWebView\Local State~RFe5835e0.TMP
Size 1KB
SHA256 76e0b44582a98cf2a6170745681a8338389927a99855b17ecacb6d8dccc703a6
MD5 c5fd1ec546e9b597e5eadecb65f49e3e
SHA1 285742fa496b9e155e08a0f681aa49d948e3b7c0
SHA512 a7fa3bc7c12184862e5e57d484387e3026f31bb9295d7885f5a6a80b9fc680ec356f4784f2f87989ab86591fe101d982afb4c4764b6c8a854e11a20cd38996a5
TLSH
T132217032C8916E7778C646ADB106BE871D54216280219E4C90EE8B2C06DBACC6A27C32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/216-133-0x00007FFFEA140000-0x00007FFFEA141000-memory.dmp

Download

memory/896-63-0x00007FFFEB2A0000-0x00007FFFEB2A1000-memory.dmp

Download

memory/896-64-0x00007FFFEB2B0000-0x00007FFFEB2B1000-memory.dmp

Download

memory/4884-321-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4884-310-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4884-312-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4884-311-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4884-316-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4884-318-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4884-322-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4884-320-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4884-319-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4884-317-0x000002DA1A6D0000-0x000002DA1A6D1000-memory.dmp

Download

memory/4920-25-0x00007FFFEA140000-0x00007FFFEA141000-memory.dmp

Download

memory/4920-228-0x0000015BC2060000-0x0000015BC218A000-memory.dmp

Download