d78c92a73c2bf7be462fefad4c50d697c72cc7e5461a5b2054a97e3ff5834306

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe
Size 22.6MB
Sample260810-fg587abl6v
SHA256 d78c92a73c2bf7be462fefad4c50d697c72cc7e5461a5b2054a97e3ff5834306
MD5 59b3b799129cc08a8f1ef4ae7e2229fe
SHA1 910ac948325a004fd7924dc9b63728aa0704a87b
SHA512 937b186a26ccf4c5037e76d4c06646c6cc3fdba5b553a097b9f4b62c01c612e1f9bcbbd791e3b31f75446ea2ae0e00530c9a954a7405f352dc30c6635306e901
SSDEEP 196608:JOMYoDkf3wPhNGxd+wMLhp8+fsZbJ9mR78IAfMgwlCWPiYk:F74f3wPhNGxd+wMLhp7sNmVXVgwCOiH
TLSH
T12537F7257A5B996CD09AC474834B8A724A7130DF0B35B9FF448896383F6DBF46F38219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2608_2095211976\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2608_2095211976\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2608_2095211976\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2608_1647350837\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2608_1647350837\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2608_1647350837\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2400	msedgewebview2.exe
2400	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2608	msedgewebview2.exe
2608	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3712	2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe
3712	2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe
3712	2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3712	2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 2608	3712	2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe	89
PID 2608 wrote to memory of 6024	2608	msedgewebview2.exe	90
PID 2608 wrote to memory of 364	2608	msedgewebview2.exe	91
PID 2608 wrote to memory of 364	2608	msedgewebview2.exe	91
PID 2608 wrote to memory of 364	2608	msedgewebview2.exe	91
PID 2608 wrote to memory of 364	2608	msedgewebview2.exe	91
PID 2608 wrote to memory of 2492	2608	msedgewebview2.exe	92
PID 2608 wrote to memory of 2672	2608	msedgewebview2.exe	93
PID 2608 wrote to memory of 2672	2608	msedgewebview2.exe	93
PID 2608 wrote to memory of 2672	2608	msedgewebview2.exe	93
PID 2608 wrote to memory of 2220	2608	msedgewebview2.exe	94
PID 2608 wrote to memory of 2220	2608	msedgewebview2.exe	94
PID 2608 wrote to memory of 2220	2608	msedgewebview2.exe	94
PID 2608 wrote to memory of 2220	2608	msedgewebview2.exe	94
PID 2608 wrote to memory of 2220	2608	msedgewebview2.exe	94
PID 2608 wrote to memory of 1672	2608	msedgewebview2.exe	95
PID 2608 wrote to memory of 1672	2608	msedgewebview2.exe	95
PID 2608 wrote to memory of 1672	2608	msedgewebview2.exe	95
PID 2608 wrote to memory of 1672	2608	msedgewebview2.exe	95
PID 2608 wrote to memory of 1672	2608	msedgewebview2.exe	95
PID 2608 wrote to memory of 4240	2608	msedgewebview2.exe	99
PID 2608 wrote to memory of 4240	2608	msedgewebview2.exe	99
PID 2608 wrote to memory of 4240	2608	msedgewebview2.exe	99
PID 2608 wrote to memory of 2400	2608	msedgewebview2.exe	100
PID 2608 wrote to memory of 2384	2608	msedgewebview2.exe	101
PID 2608 wrote to memory of 2384	2608	msedgewebview2.exe	101
PID 2608 wrote to memory of 2384	2608	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.5.9 --user-data-dir="C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3712.5756.10500203500839437358 /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView /prefetch:4 /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8e6665fd8,0x7ff8e6665fe4,0x7ff8e6665ff0
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView" --webview-exe-name=2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.5.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1656,i,434518112746712627,17484392407172740084,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView" --webview-exe-name=2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.5.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2136 --field-trial-handle=1656,i,434518112746712627,17484392407172740084,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView" --webview-exe-name=2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.5.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1656,i,434518112746712627,17484392407172740084,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView" --webview-exe-name=2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.5.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3388 --field-trial-handle=1656,i,434518112746712627,17484392407172740084,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView" --webview-exe-name=2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.5.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3676 --field-trial-handle=1656,i,434518112746712627,17484392407172740084,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView" --webview-exe-name=2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.5.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4792 --field-trial-handle=1656,i,434518112746712627,17484392407172740084,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView" --webview-exe-name=2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.5.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4924 --field-trial-handle=1656,i,434518112746712627,17484392407172740084,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2400
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView" --webview-exe-name=2026-08-10_59b3b799129cc08a8f1ef4ae7e2229fe_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.5.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4504 --field-trial-handle=1656,i,434518112746712627,17484392407172740084,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3625fdbae17d70f636c8ddb5d2dda93f5c2cb850
    3⤵
    PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a21fcc494b9bce53761070a27dabaa1e9f996e5e399d4e1b5df34c49433c054a
MD5 5591146c8aa26a686686a84ecb989f49
SHA1 c724ccabf8bd9068bbe8361ee3386bbcf97104fc
SHA512 cb185b6e894d3dc322c036b1cab71b54e44217d274673982282e04725d46ff39d561324cc39b65e62365788f5be28221a6e3571262131cd371d6ba5213a7cc5f
TLSH
T1FFD0122237858634C01074730042650C1884D10B524D4104543ADA1E1A44090090A885
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 549315f8376e0fb688f46cb47e2b8a3c14a05108845ce39f0cb123eee05c1b44
MD5 b14749a113196d744624a3852faf2312
SHA1 f957a71ef5ecb047c9ef83650a8bd2efad3eb1d9
SHA512 5d3a8581d033da9ca4690102328c5e2d2ae421648e865d777db10a0e73169803b877e9043afa5fda5c0b391eccac8faa4b3750ac1b902933b135ef66c3252127
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 bde84a8a063f637e9eb91a72b48a8a560be8b4f2614e43044b2e3e90ca9a157d
MD5 d375ceb71a5e79e218cdb408441e9bf0
SHA1 9fb846d062ab2131c9a749ac0486a52ed3a6acd9
SHA512 9199f50db06ce95fb8b290c1886da3d8c128aaf71f06fc0fe19be4098978b4af58ddecde657cfbfecbe648b6259a585be6a644217fef916b6a20781adf86559a
TLSH
T1BFB01234DC005006C60E1B7018B2030435211CB832520B8152580EB48C003404797104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c9bf.TMP

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c9bf.TMP
Size 48B
SHA256 b4210aac602c340bbba29157caf5eff1f6400d2aa2175847299320b631b9f363
MD5 2d7efc143b36455544d1fa50119af2d4
SHA1 4316271571c751c30c2737689948d8c54e888161
SHA512 99afc63352abe17abb97d85fc8614bdf08ce2e6881e5b4833a1f0e29574eb2464eaafcbbcd78f90a97d9478c89b7982091d66ffa1e853e0dcb01d204cd529ff2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Default\Network\Network Persistent State
Size 238B
SHA256 3a984152f56639262684ec2a65b582620ebbeb7df0cfbb804d71f221deb99dec
MD5 1622076891508cc87d79647883de8e03
SHA1 4e9cfe9e9c4e7b23d1f6bac53243da49ba15d1ca
SHA512 c3942375f04586dfcdeab5af50217f076b1309b80e8e6845ee6e941a99aa05bb6e35833dad309d406f44dcdbc856ed1a67842ed05a81e3236d033c7076428655
TLSH
T1B9D097A2427098FE8B4093A01A287903CA7E0002931C8E7ACAB9B7758AA20B9D024807
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8d0f.TMP

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Default\Network\Network Persistent State~RFe5a8d0f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Default\Preferences
Size 6KB
SHA256 e170219f4d9edb6494a4cd3d12deb6cb54b5089705cf2c42859eeeea30e6cccb
MD5 fb5907812adf35035514e3ee8dbf0cf2
SHA1 745a5aa672959bf42b23ecafca11f0d7f1d4aaf0
SHA512 8b607b46f46f0e3dfe2a9b2d057dea978a7f34ad64c9491dcf69603e604b72fb6c4e1eefdb4e12f0e1f9caece0b728dfe61ef800b51b3a109548ba58e44f69e1
SSDEEP 96:stY/dtgRGOb9ekpo5h16Z0Ns7/x+6MhmuecJHkMkkjexK+ge+28XM1C7K:st8/nionNsV+FdHkwjrg+G6K
TLSH
T13AD1B8025E28797B4CCBF519BA297B1BD2F9903261D11F58EBF9492C04EB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0062868-2c18-4711-b6dc-8dd651afb452.tmp

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Default\b0062868-2c18-4711-b6dc-8dd651afb452.tmp
Size 6KB
SHA256 3d30caee64575f6ff31943b33f14904ae3c9e65f1c99e841e2514fe3c14f1f32
MD5 67b31fa149c20b5a9a1aba12f5462a93
SHA1 1b8e88f8ec5a25c2d30b4ac85f9f7857b4ed81d9
SHA512 11ed36e06cb00b81694d1130458bb44cc2b8a29de719126084bbb09b4b2f7c1118fbb9b4aad5119e2712f7aacee916e410cf963923bdea043e9cec7bec76b43a
SSDEEP 96:stY/dtgKOb9ekpo5h16Z0Ns7/x+6MhmuecJHkMkkjexK+gC+28XM1C7K:st8/VionNsV+FdHkwjrs+G6K
TLSH
T1CFD197025E28797B4CCAF519BA257B0FE2F9903270D51E58EBF9492C04EB5DC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Local State
Size 2KB
SHA256 25e1fcef623bb32cacd83d166dab2c157babc69743ea542ed23841fa67401035
MD5 2be9aafbf6491012d544cd8fc5c6b44a
SHA1 63f822a08a2aafa4ad648ee92e5c0eeda9c97a9f
SHA512 350b7e7fd9abd34cf476f71384c65e62c69dc5f6cea0d37d5aabd4f1ffe86fcf887fd77265e48f795b47c65680cf62432780c312a376dad32b67f3cb81186e7e
TLSH
T1C451A87379286F378DE6465C794A3F2BCE7A9061CA511F509AED0B0C01D756C1306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Local State
Size 3KB
SHA256 ce63d8a118bb1d13dcc8d6de4fb371f22c69fcaf410249e6d121a18442cfe048
MD5 575f4804a0850aa5210c9bebe3523fdb
SHA1 bf6d78beb98b6766400c0ea547ec658285992030
SHA512 9c4d43d32991580ead8aa03c95e4d156c2c27e40f9566c482dd5998fc2619465cdbe085fecbbd8014ef2b9b71f308de155dd2d9171e33173a7f584e2b590565d
TLSH
T1DD6188776974A9374DE69A5879863B1BEBA55023D5C13F55CAFC0F0C01D73981302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Local State
Size 15KB
SHA256 eaf889557c98d1720b5be26c52ebe9ac2ddce9e7e996ebaf20a4ed9079c73610
MD5 982e979809762dd282dd56ef23b6812d
SHA1 c7028db05c5b14b1dedf193fdd8a7d9d479a3acd
SHA512 c87356848b1dbbad02343a0db58d5c13f9096383833a7b99a01703df1bc1148bd1d6f8a862ea5c4d6e392297e9f0fb135694c667f1aac5457bf4d7127a4e7fb6
SSDEEP 384:F+aQikB+z/xvxjg/qhEUNBSAIyJ2FE2AVdph+t9zS:Q/UxvxjgC+EIRe2UhSFS
TLSH
T1FC729E2795393E37A5F7EA18794D0B9FCBB884B280C16EB84EBD5F0D06C72981302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597640.TMP

Path C:\Users\Admin\AppData\Local\com.nexus.v2\EBWebView\Local State~RFe597640.TMP
Size 1KB
SHA256 2d92fe20928f5cfe29be9f3bdf9c856a2c532b7e5c7b9a7eb5d6603c2de5b6df
MD5 1408e594ff1ebb3395eb13987eef546c
SHA1 a319792f3abefd61ac16eb02e330ce2c7bb0d055
SHA512 8c6cb7c9f694f45cdbafef58e0f9359a3bdc8c3c0f569a27c8aa551a6d92ddebffd6186e9a5c5f4be4ffc6e9ecd941ff2a6ef34f980ec6fd3f589554e09e7a6b
TLSH
T10921C5B3E5681F329C8553D93206BFAF8E72507682404F04A6EE0A1C02E625C421AC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/364-212-0x0000013366AB0000-0x0000013366B86000-memory.dmp

Download

memory/364-26-0x00007FF907E70000-0x00007FF907E71000-memory.dmp

Download

memory/1672-214-0x00000271F2320000-0x00000271F23F6000-memory.dmp

Download

memory/2220-213-0x000002A42DC80000-0x000002A42DD56000-memory.dmp

Download

memory/2220-63-0x00007FF907E70000-0x00007FF907E71000-memory.dmp

Download

memory/2400-370-0x00000202E3D90000-0x00000202E3D91000-memory.dmp

Download

memory/2400-368-0x00000202E3D90000-0x00000202E3D91000-memory.dmp

Download

memory/2400-376-0x00000202E3D90000-0x00000202E3D91000-memory.dmp

Download

memory/2400-379-0x00000202E3D90000-0x00000202E3D91000-memory.dmp

Download

memory/2400-377-0x00000202E3D90000-0x00000202E3D91000-memory.dmp

Download

memory/2400-378-0x00000202E3D90000-0x00000202E3D91000-memory.dmp

Download

memory/2400-375-0x00000202E3D90000-0x00000202E3D91000-memory.dmp

Download

memory/2400-374-0x00000202E3D90000-0x00000202E3D91000-memory.dmp

Download

memory/4240-332-0x00007FF907F50000-0x00007FF907F51000-memory.dmp

Download

memory/4240-331-0x00007FF9076E0000-0x00007FF9076E1000-memory.dmp

Download