8e1902f8f9e455ca672de8ff2b80dd7e41fac8f5525dd70586e7daca2f4911c8

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe
Size 9.9MB
Sample260808-rdkc4adg86
SHA256 8e1902f8f9e455ca672de8ff2b80dd7e41fac8f5525dd70586e7daca2f4911c8
MD5 f0f79c6d64fbdf60e0f83bc898fdf95a
SHA1 009096d38db5214723ed8868ad25702bdf3ac116
SHA512 860459cb97e847eeee66c0098ae6198b45b7ce6cc752bc1bb2e9ac94333bdaf89c90c0bbf0ce9898215f5f7d7e8403d20c57564e53c6a1b1b6ffa49d9e91be2b
SSDEEP 196608:eEOBGwv3fWYtI4yvehBAETDNKNSzBrY9sd4e5WLizZi6u:7rwv3fWYtK2zg6
TLSH
T185A6E7117A2B98ACC447C97082464A775E6130FB0A367ABFC485723C3F7EBA05B2F655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1175437125\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1175437125\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_1175437125\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3320_989316313\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	msedgewebview2.exe
1852	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3320	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3548	2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe
3548	2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3548	2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3320	3548	2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe	89
PID 3320 wrote to memory of 3364	3320	msedgewebview2.exe	90
PID 3320 wrote to memory of 3372	3320	msedgewebview2.exe	91
PID 3320 wrote to memory of 3372	3320	msedgewebview2.exe	91
PID 3320 wrote to memory of 3372	3320	msedgewebview2.exe	91
PID 3320 wrote to memory of 3372	3320	msedgewebview2.exe	91
PID 3320 wrote to memory of 4836	3320	msedgewebview2.exe	92
PID 3320 wrote to memory of 4900	3320	msedgewebview2.exe	93
PID 3320 wrote to memory of 4900	3320	msedgewebview2.exe	93
PID 3320 wrote to memory of 4900	3320	msedgewebview2.exe	93
PID 3320 wrote to memory of 5492	3320	msedgewebview2.exe	94
PID 3320 wrote to memory of 5492	3320	msedgewebview2.exe	94
PID 3320 wrote to memory of 5492	3320	msedgewebview2.exe	94
PID 3320 wrote to memory of 5492	3320	msedgewebview2.exe	94
PID 3320 wrote to memory of 5492	3320	msedgewebview2.exe	94
PID 3320 wrote to memory of 4872	3320	msedgewebview2.exe	98
PID 3320 wrote to memory of 4872	3320	msedgewebview2.exe	98
PID 3320 wrote to memory of 4872	3320	msedgewebview2.exe	98
PID 3320 wrote to memory of 1852	3320	msedgewebview2.exe	99
PID 3320 wrote to memory of 2324	3320	msedgewebview2.exe	100
PID 3320 wrote to memory of 2324	3320	msedgewebview2.exe	100
PID 3320 wrote to memory of 2324	3320	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3548.1196.7889848848523159720 /pfhostedapp:07e0951d817566b62394ac9d7311f1437e8d6f79
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView /prefetch:4 /pfhostedapp:07e0951d817566b62394ac9d7311f1437e8d6f79 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x198,0x7ff9a5a65fd8,0x7ff9a5a65fe4,0x7ff9a5a65ff0
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView" --webview-exe-name=2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1780,i,10894300570759437726,3501674108101349409,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:07e0951d817566b62394ac9d7311f1437e8d6f79
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView" --webview-exe-name=2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1780,i,10894300570759437726,3501674108101349409,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:07e0951d817566b62394ac9d7311f1437e8d6f79
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView" --webview-exe-name=2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1780,i,10894300570759437726,3501674108101349409,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:07e0951d817566b62394ac9d7311f1437e8d6f79
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView" --webview-exe-name=2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=1780,i,10894300570759437726,3501674108101349409,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:07e0951d817566b62394ac9d7311f1437e8d6f79 /prefetch:1
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView" --webview-exe-name=2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4348 --field-trial-handle=1780,i,10894300570759437726,3501674108101349409,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:07e0951d817566b62394ac9d7311f1437e8d6f79
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView" --webview-exe-name=2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4348 --field-trial-handle=1780,i,10894300570759437726,3501674108101349409,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:07e0951d817566b62394ac9d7311f1437e8d6f79
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView" --webview-exe-name=2026-08-08_f0f79c6d64fbdf60e0f83bc898fdf95a_akira_glassworm_icedid_njrat_quasar-rat_rusty-stealer_ryuk_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4300 --field-trial-handle=1780,i,10894300570759437726,3501674108101349409,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:07e0951d817566b62394ac9d7311f1437e8d6f79
    3⤵
    PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7a5fcfc1f78a29a5e8f5abf957ab4aab0fb52ad05af92b8d51531ebe74a0226e
MD5 9eb86f210bdd434c897e7e0c18e6023f
SHA1 03559b7f482b3628aaf6695ea0e8654609fe1940
SHA512 2e45f2f3e8f1b96fce2755523095fc94a398e96adfed53155c9ca9747b16b613b6525fc1684f5689c204b80e171e202f2a1f239f9a40ff68883b9efe7c4438c5
TLSH
T12FD0121336410738C49030330003E10C0800C61F414D8104583D962D5A280901906841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f7f86ad50aa860b4899006206d29b8c89d51fa3277e11d513c63d8150e81f4f7
MD5 ecd79fdd6887ee16528a3aa5f9f0dae7
SHA1 e0c18c77b476402d4f34c0422feb89f090d3726d
SHA512 a6e6233cafc7820476df0968ca94570bc4a4b7144442a8d9ec2d2a3a4ed5f6ab099ec9e20ae7d9daf6bd4ba35a2b31046e294437622402cb18ed8609fc1ce945
TLSH
T1BBD0045155400714C4C030310015C10405044D15155D43140575111444751405005504
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

90969fdd-5385-4332-94e4-62adf4f7e911.tmp

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Default\90969fdd-5385-4332-94e4-62adf4f7e911.tmp
Size 6KB
SHA256 78a25e8e79658b9f135a2838692e591f991d62f0dcfea681e8f4f1d9e0e371bc
MD5 3820929366835f7e8db885a8e8f98226
SHA1 d15518306c2e4c2d0ed6832a933b8023fd2aab78
SHA512 12884048318fd19e67474528bb90b8d7fc484bf20227f99713cef7d5050d5d37eb28cc0608472796065a8e219b42c9d44f5b3c976b33a98c2cd158b387c4c939
SSDEEP 96:stw/dM+8aA60b96kTo5h16Z0cs7/x+6MhmuecJfb1ejeaK+gw228XM1C7K:stkOmnuoncsV+FdfbQji1G6K
TLSH
T1F3D196015E2879BB8CC6E11DBB39BB17D2F9607264D52E58F7FC452C18DA6CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b3994ddfdb7f84c131a901e900f622e847ad7773e74ac4fe3a407b26ae3cb8f2
MD5 0de47b2478e41e02039573ebe5a9c40f
SHA1 1b40ba937eb996905f6e3e5519a5ccbd117f355e
SHA512 ecb4e4ec9f9bbb86d74927b7e048f608cd8422467bfb42f472805cb9af609df92c1ac28312b45a7a772a1983a466ebd188303c971ea4ff8e53f546e68e0da613
TLSH
T177A0023441984002D300477811CD414833379A298343165193B10875DC51B42F753570
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598081.TMP

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe598081.TMP
Size 48B
SHA256 1db32b70e9dc87b52a8c63100ffcde02334a4f781e9470f971077bbcbe029acd
MD5 69b05b46223b3ab2a135d5ccab7af65f
SHA1 60a80e47845f9f4ca2467568a14b1fe5c13ec637
SHA512 db7a09d3716df7f35edbb3883d38814df3c626562e40a5618671f91f8ced1384290d3429e3d2d207967becb0305abf7a18c818bf961fbed8297e4c3c793743ee
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a55d2.TMP

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Default\Network\Network Persistent State~RFe5a55d2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Default\Preferences
Size 6KB
SHA256 b2df09f6f2674d358aeb569fa8a6ca9576f0d651ec199caa413bf9480359f66e
MD5 110fab4419cfdfa2d6d2f296f29a68e4
SHA1 f4a33b465ac590ed707d2b0be178d5ccd0ee5b9f
SHA512 bc922e876237f09a4a6ed7a9b7ca33e8694c9140f35112b8e63f8ff20c0a800e9dba3c951db03811ee5f71a340d5a8b6b81d7a4c6ff9bd12d60bf691fb704706
SSDEEP 96:stw/dM+8aAhG0b96kTo5h16Z0cs7/x+6MhmuecJfb1ejeaK+gv228XM1C7K:stkOmNuoncsV+FdfbQjioG6K
TLSH
T16BD184025E2879BB8CC6E11DBB39BB17D2F9607265942E58F7FC552C08DA6CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Local State
Size 2KB
SHA256 b11d6ecfc39dfecccece029f127b8ba3686492fd2edc39a06f31e60a467c2ea5
MD5 560e43531f8789f8a82997f144d1b215
SHA1 a51d434978a944c742d627e28dba4f34b3fab346
SHA512 a5f52ceb84db5568f47198124423ed049b8b64d3cbf10792f02ea60e53895791d55db552bb82d9b00cedb98f3bb492405bbee7a2520daf940ccc2d37160af69c
TLSH
T18B51833279146A76C9B3864C7E5B7B228E799066AA612F60AADC0B0C06D714C1342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Local State
Size 3KB
SHA256 79fca29fa13c263721b4260b1c10d8af4a9480781e04c63c40d395aed633bf68
MD5 237aa94afac73df2c42289791bbe057a
SHA1 93f9c4635f7564bde9ae42cfc3b1d8c401b129c1
SHA512 276e5a80cdc1ee619196f56417c7dcdc77b687d48ecb6a17178a06c9bd8a11a069163861703956d04f589c9cb9302bf5afaccbbcd467f4faa6b874b839ec8422
TLSH
T1196198367934A9778DF3DA09BD873B16ABA59027E5913FA1D6EC0F0C05D72881342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Local State
Size 15KB
SHA256 a10b7f2a123f4528200c4b347af03919808f6af066b3953cacd945f7f518f5e2
MD5 a261c9edf1c07d857d327931240984dc
SHA1 9b892b4e9c9f446156afc6e0ca80f3e665cf9225
SHA512 e9e12b911a5867f5509d58bc9f17f093bd84bc5ef402b131c95f7f0e515622f6fb845b1f7bc07cd8c0900c4687004b368d588ef10d2747aaf696c450f88866c4
SSDEEP 384:C+aQikB+z/xvxjg/qhEwNBSMohy5AVdpCt9zK:t/UxvxjgC+tk5UCFK
TLSH
T183729E37A4292E3395F3EA097A5E578BCFB8847254C17DB44AAD5F0D0AD72D80342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe592e98.TMP

Path C:\Users\Admin\AppData\Local\dev.mousevpn.windows\EBWebView\Local State~RFe592e98.TMP
Size 1KB
SHA256 cb0ccfb5b3cb355757212db761b63af4523c24f5cd6024ba4d00835ee7e4bd14
MD5 8dc599cc680b5e665f17065edbb5a638
SHA1 ea7ccd3d580cdbc0f823071b797e574234624e61
SHA512 aa61e9b8c26d5053c4adced65e3465b19f10b5b6e12cbfd366f8afac3df5c6bcd667f435c3e8e8ecdd2108017283c7ff728f9ebb7e76360f51d3520dd68b6767
TLSH
T1682195B1B4241B72DDA3634A36577A675E70806B82604E40A2DC0B1C17E318C565AC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1852-298-0x00000165B6B00000-0x00000165B6B01000-memory.dmp

Download

memory/1852-307-0x00000165B6B00000-0x00000165B6B01000-memory.dmp

Download

memory/1852-304-0x00000165B6B00000-0x00000165B6B01000-memory.dmp

Download

memory/1852-305-0x00000165B6B00000-0x00000165B6B01000-memory.dmp

Download

memory/1852-306-0x00000165B6B00000-0x00000165B6B01000-memory.dmp

Download

memory/1852-308-0x00000165B6B00000-0x00000165B6B01000-memory.dmp

Download

memory/1852-309-0x00000165B6B00000-0x00000165B6B01000-memory.dmp

Download

memory/1852-300-0x00000165B6B00000-0x00000165B6B01000-memory.dmp

Download

memory/2324-345-0x000001CBE3CE0000-0x000001CBE3D0F000-memory.dmp

Download

memory/3372-200-0x00000277DB420000-0x00000277DB4D2000-memory.dmp

Download

memory/3372-374-0x00000277DB420000-0x00000277DB4D2000-memory.dmp

Download

memory/3372-30-0x00007FF9C7C60000-0x00007FF9C7C61000-memory.dmp

Download

memory/4872-282-0x000001D798DB0000-0x000001D798DDF000-memory.dmp

Download

memory/4872-270-0x00007FF9C6FD0000-0x00007FF9C6FD1000-memory.dmp

Download

memory/4872-271-0x00007FF9C6DC0000-0x00007FF9C6DC1000-memory.dmp

Download

memory/5492-97-0x00007FF9C7C60000-0x00007FF9C7C61000-memory.dmp

Download

memory/5492-201-0x000001D9CD830000-0x000001D9CD8E2000-memory.dmp

Download