efcebdf8d843a02bb26ad9399d16844f8559eb629e82f55cbda7c46e1f751344

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 4.2MB
Sample260815-ejt39syzdx
SHA256 efcebdf8d843a02bb26ad9399d16844f8559eb629e82f55cbda7c46e1f751344
MD5 4eb07add0a59d881a347fa14326a0f85
SHA1 f3bd45a7cb29cd5924d98c5595b1b5cd56cbc491
SHA512 0944f15d997d54adace4f2ef43c3e2ec48ec7406e9f88eb59ea7819c2ed3a64253cae192f3a5ffbabf176564566e338b9e0febbc91e1689ca1c8773eb160173e
SSDEEP 49152:1K2fViG3KP3Ou5eSYxZnH70yWwHffYNfIYOelCQAcGkzgPQ70GNLhwRNq+gu6823:1wR/Lkdg3ckzgksWZzjid
TLSH
T1A9264A47F66290FCC569C036931A6232FA22BC8E47353AEB5BA04B213E55FD06B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1660220076\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1160001792\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1160001792\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1660220076\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_330483136\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1160001792\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1660220076\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_330483136\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1901795128\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1160001792\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5524_1160001792\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	msedgewebview2.exe
1960	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5524	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3824	2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 5524	3824	2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe	89
PID 5524 wrote to memory of 4196	5524	msedgewebview2.exe	90
PID 5524 wrote to memory of 952	5524	msedgewebview2.exe	91
PID 5524 wrote to memory of 952	5524	msedgewebview2.exe	91
PID 5524 wrote to memory of 952	5524	msedgewebview2.exe	91
PID 5524 wrote to memory of 952	5524	msedgewebview2.exe	91
PID 5524 wrote to memory of 4936	5524	msedgewebview2.exe	92
PID 5524 wrote to memory of 2348	5524	msedgewebview2.exe	93
PID 5524 wrote to memory of 2348	5524	msedgewebview2.exe	93
PID 5524 wrote to memory of 2348	5524	msedgewebview2.exe	93
PID 5524 wrote to memory of 756	5524	msedgewebview2.exe	94
PID 5524 wrote to memory of 756	5524	msedgewebview2.exe	94
PID 5524 wrote to memory of 756	5524	msedgewebview2.exe	94
PID 5524 wrote to memory of 756	5524	msedgewebview2.exe	94
PID 5524 wrote to memory of 756	5524	msedgewebview2.exe	94
PID 5524 wrote to memory of 360	5524	msedgewebview2.exe	98
PID 5524 wrote to memory of 360	5524	msedgewebview2.exe	98
PID 5524 wrote to memory of 360	5524	msedgewebview2.exe	98
PID 5524 wrote to memory of 2492	5524	msedgewebview2.exe	99
PID 5524 wrote to memory of 2492	5524	msedgewebview2.exe	99
PID 5524 wrote to memory of 2492	5524	msedgewebview2.exe	99
PID 5524 wrote to memory of 4540	5524	msedgewebview2.exe	100
PID 5524 wrote to memory of 4540	5524	msedgewebview2.exe	100
PID 5524 wrote to memory of 4540	5524	msedgewebview2.exe	100
PID 5524 wrote to memory of 1960	5524	msedgewebview2.exe	101
PID 5524 wrote to memory of 4312	5524	msedgewebview2.exe	102
PID 5524 wrote to memory of 4312	5524	msedgewebview2.exe	102
PID 5524 wrote to memory of 4312	5524	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3824.4716.13712002726478773855 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView /prefetch:4 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdcdb25fd8,0x7ffdcdb25fe4,0x7ffdcdb25ff0
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1868 --field-trial-handle=1872,i,15955108229764325605,1225073959338583404,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1872,i,15955108229764325605,1225073959338583404,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1972 --field-trial-handle=1872,i,15955108229764325605,1225073959338583404,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3400 --field-trial-handle=1872,i,15955108229764325605,1225073959338583404,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa /prefetch:1
    3⤵
    PID:756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=1872,i,15955108229764325605,1225073959338583404,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa
    3⤵
    PID:360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=1872,i,15955108229764325605,1225073959338583404,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4512 --field-trial-handle=1872,i,15955108229764325605,1225073959338583404,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=836 --field-trial-handle=1872,i,15955108229764325605,1225073959338583404,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView" --webview-exe-name=2026-08-15_4eb07add0a59d881a347fa14326a0f85_akira_cobalt-strike_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2888 --field-trial-handle=1872,i,15955108229764325605,1225073959338583404,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b44d8d49d459441c67d52f8b6ae28d2f8f0d97fa
    3⤵
    PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a4a3cdf688638d529ac1583e0b42f952fe580fa88784d7de44d06c2a0c09f6ba
MD5 97291ddf3d9105a9605a26edbfc08f2b
SHA1 4f8c8ffd06f98633f0a4640bfb6124c7ac7cf884
SHA512 f8676a38a4360fc831f492f0d6e1263b80e6120d9f7422404ecd2be9dc465664153c528b7f18cc0cdef32d142a17f0553e99872ad179bed5d54fa19c1ed0a4c0
TLSH
T111D02223B30203F8C020B0330283F20C0A02E22F800A8200AC3CEB2FBF280A00F23882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5e966c2ce1c137802305bd958e9f281577990437fb498e1a316628990bc15437
MD5 650568384e62edbe14ccbd071a0fef1e
SHA1 f9fe660cd8f5a566a1e4485b3e50d947e161c17d
SHA512 eaab3a1d14fcb40abcad9d54a5120f092f73a0dd78a2f4bbd73d0ab00d6dd5a25529dc7d4aeab46a145027f048fa41c0864f6a0c0ee5b9eaf0163a098814b331
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

18bf2813-64f9-4266-bc60-a39e19b8c503.tmp

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Default\18bf2813-64f9-4266-bc60-a39e19b8c503.tmp
Size 6KB
SHA256 a7b5354619b9e4a835e72d6f136729efbd3a7a881cf3f0667d157c6b550416ef
MD5 a9a489ac3eda775648435daa7d4c769e
SHA1 1ac7bdf2a8ca49cc47d95f68989005a3aed05e0d
SHA512 27146d5c700393851693d14a831a605d04e849923a661da6720c5a8c8036ae0631ef302c7f4d8cea1b002bcb03e5211261c79532bf3b275d6189bedc05eb55ab
SSDEEP 96:stjD/d3d1wjYRb9+k1o5h16Z03Bgs7/x+6MhmuecJ3BGT71ejejK+g/qcBK8K+2z:stj7j1oionasV+FdgfQjJvK+G6K
TLSH
T14AD194056F64797B4CC6F109BA29BA46E3F5507271E11E98EBFC862C04DA6CD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f3b047166b024eb863b1ed19e6371aa6870244af0c38c4711fede73769291f77
MD5 6315d2bcd4db028dfbade9a0dee3d086
SHA1 7d0307281e9736d539899d05f6b93e2706570cd7
SHA512 2d0773d7bd6287b2682274c9c99f3125372b819ea80478fb84bc3bef0419f87c082c0f8fc568f4a9d2f503e49b1be7d856c97452b4425c118351080f19b477a4
TLSH
T176A0022A05800916C12513B250C94350F7345811022B161163DC45A699A935483138C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c682.TMP

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c682.TMP
Size 48B
SHA256 c5fa76514adeeef4bb3ecb4a537984cf54b590f63ebf3e263fe49ba00106cdb0
MD5 9764355788d861fb19170b56f9ce14cd
SHA1 fc76da29cd923e4a1900f2cc6a028b308e3e5037
SHA512 dcad50415aa46f8ffc92e0c2c397390f4bde2d64d8c07cd3478bfc69c7da87cebfd5eedd578fb4821a71f5ca1ec79d99e49b63c14f7fd912c1463561556caec5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa0d5.TMP

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Default\Network\Network Persistent State~RFe5aa0d5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 56edda788d2650f7f875fc32463576f535fbc82ac5296cee77c8de47da4b58ed
MD5 557e7eb6a4b73ffc30d3e3fe3dbea9de
SHA1 b89294588973585f508fcd5b4275999caa98f309
SHA512 562265bbbf92f8872fcc646bc8c74cd5aa24222c914616190c142f2928cd5c25ea88b08d0edc362c881675b87bc7a3a80f732e2ce7aeea158e6ab4f135dc6566
SSDEEP 96:stjD/d3d1wjvGRb9+k1o5h16Z03Bgs7/x+6MhmuecJ3BGT71ejejK+g/qcBld8jJ:stj7j1WionasV+FdgfQjJ6j+G6K
TLSH
T11ED1A6065F64797B4CC6F109BE29BB56E3F5507261E11E58EBFC862C04EA6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Local State
Size 2KB
SHA256 67a129abd88fd7bb4fb8d1121f4752fed4a32304b82424b7517e270e289f6ee8
MD5 d79715e52fd015f9a85e503e5c383e62
SHA1 61a70723330a619fd2ceb57cb3e9b41939ef6a93
SHA512 490c48880629e545527019b6fbea7d53c1a78a7ac979803347429d624642b65777c7b4119f7e204f1dd6a0a1062e77606202875e3fb8f1ff125ffbf28c0f7d7d
TLSH
T104519833A954AB779BF26645B84A3F138F7581729A622F90AEDD071C01D724D2702C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Local State
Size 3KB
SHA256 145413296cfc17de1c5f223c102781507c75671298bc0af3850f578f76ae7a4b
MD5 703d8e9218dd0aa4e15b6d29654b60c6
SHA1 b3f0eb6d3f62f22ff974b2c82b955ca27b7c0c9a
SHA512 3bb9cd66ba27ca3f3ebb3787dfe4384641da230ae864b91185cbd1b38a86ac4d67d9e4bf140108aa60f8111e9cb679b178171078d5b3c0f533e9d1774d0632e4
TLSH
T181616737AA74EA375EF2AA05B8462B12A7A58137E5953F95DAEC0F1C01D73881342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Local State
Size 15KB
SHA256 c0223f821063e45758a6c26cf99f28aea40b10090be30c4b870960c19b5aa544
MD5 acf6935aca99ba628e5003e1d37365fd
SHA1 e80dafc46f39379fdb696c17a1eb8350b69a7314
SHA512 a4c05415e4fb5f41eee5f53237ed8e91a981b47ebe4f9a095ab53c49a518361e773115c3fdc176f509f0aa5bd12c3df3de05cb03333d27f2e2d555e0a6e39c19
SSDEEP 384:l+aQikB+z/xvxjg/qhEwNBSEsHws5AVdpY9zW:w/UxvxjgC+scb5UYFW
TLSH
T1F0728E2795787E33A6F3BA05B95D1B8BCBB9C4B350816DA44EBD5F0D02C72981342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.litecodedesk.desktop\EBWebView\Local State
Size 1KB
SHA256 7b3eab09edb4c907a2287ed3a20036f26c760b6768e6c5e4fe88932b93c47254
MD5 a418afa53311740f27c33bad36a7da03
SHA1 408f7cd24bc72abcf8166ab0f2f4254d15b25201
SHA512 b71626d4de91ff5b966ab1cca23197c95c59c197cd82c346c9ab4ca40117fc73bb5cf14b55996e8746266c4d4474ca593a4a713c883d2d4d0c18902264a01cf2
TLSH
T17B216532E268AF73BED27657B01A7B535E31817B81210E44B9DD472D02E724D5527C73
MD5 SHA1 SHA512 TLSH

Submit Download

memory/360-249-0x00007FFDEFA20000-0x00007FFDEFA21000-memory.dmp

Download

memory/360-248-0x00007FFDEEFD0000-0x00007FFDEEFD1000-memory.dmp

Download

memory/756-79-0x00007FFDF0210000-0x00007FFDF0211000-memory.dmp

Download

memory/952-26-0x00007FFDF0210000-0x00007FFDF0211000-memory.dmp

Download

memory/952-198-0x0000015009E40000-0x0000015009F13000-memory.dmp

Download

memory/1960-343-0x0000023B84600000-0x0000023B84601000-memory.dmp

Download

memory/1960-347-0x0000023B84600000-0x0000023B84601000-memory.dmp

Download

memory/1960-352-0x0000023B84600000-0x0000023B84601000-memory.dmp

Download

memory/1960-351-0x0000023B84600000-0x0000023B84601000-memory.dmp

Download

memory/1960-350-0x0000023B84600000-0x0000023B84601000-memory.dmp

Download

memory/1960-349-0x0000023B84600000-0x0000023B84601000-memory.dmp

Download

memory/1960-348-0x0000023B84600000-0x0000023B84601000-memory.dmp

Download

memory/1960-341-0x0000023B84600000-0x0000023B84601000-memory.dmp

Download