0088ae2b954114ac1ad0c96a3638449cffa99e8bb0f0ee1fc966f4cb770cecf6

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe
Size 11.7MB
Sample260819-e9g7dsdp2y
SHA256 0088ae2b954114ac1ad0c96a3638449cffa99e8bb0f0ee1fc966f4cb770cecf6
MD5 b41b0a19d854f14bbcbf429e94ab9fe3
SHA1 fcc35ccf3a3494e3afe132f2741e28b464736b26
SHA512 50cf0f673a6c81be660c306bb300dcc1f564f6e81ebd7946c792dd29f98c2bb6deddbbef51710d3ede12f0786a44738fe7e5c2baf72e8c2442d3235ba9a3f9af
SSDEEP 98304:GhbZZg/AaMw5OfMh+Ugoo56sH7r41u7RAIOFweI/KIUOQiFfpuG73PYYY5oAoK15:KbZZG5OfMh+UgCE75jNUODFfpue8H
TLSH
T13EC61911BA5F997CD09AC8B1834A47674E2170DB1A36B8AF41C4523C3FBDBF46B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_443170890\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_443170890\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1569343688\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1569343688\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_643697874\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_643697874\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_443170890\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1569343688\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_643697874\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1569343688\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1569343688\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1101099794\english_wikipedia.txt	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5392	msedgewebview2.exe
5392	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4960	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1296	2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4960	1296	2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe	89
PID 4960 wrote to memory of 4928	4960	msedgewebview2.exe	90
PID 4960 wrote to memory of 4740	4960	msedgewebview2.exe	91
PID 4960 wrote to memory of 4740	4960	msedgewebview2.exe	91
PID 4960 wrote to memory of 4740	4960	msedgewebview2.exe	91
PID 4960 wrote to memory of 4740	4960	msedgewebview2.exe	91
PID 4960 wrote to memory of 5852	4960	msedgewebview2.exe	92
PID 4960 wrote to memory of 4332	4960	msedgewebview2.exe	93
PID 4960 wrote to memory of 4332	4960	msedgewebview2.exe	93
PID 4960 wrote to memory of 4332	4960	msedgewebview2.exe	93
PID 4960 wrote to memory of 3132	4960	msedgewebview2.exe	94
PID 4960 wrote to memory of 3132	4960	msedgewebview2.exe	94
PID 4960 wrote to memory of 3132	4960	msedgewebview2.exe	94
PID 4960 wrote to memory of 3132	4960	msedgewebview2.exe	94
PID 4960 wrote to memory of 3132	4960	msedgewebview2.exe	94
PID 4960 wrote to memory of 5172	4960	msedgewebview2.exe	98
PID 4960 wrote to memory of 5172	4960	msedgewebview2.exe	98
PID 4960 wrote to memory of 5172	4960	msedgewebview2.exe	98
PID 4960 wrote to memory of 3220	4960	msedgewebview2.exe	99
PID 4960 wrote to memory of 3220	4960	msedgewebview2.exe	99
PID 4960 wrote to memory of 3220	4960	msedgewebview2.exe	99
PID 4960 wrote to memory of 4896	4960	msedgewebview2.exe	100
PID 4960 wrote to memory of 4896	4960	msedgewebview2.exe	100
PID 4960 wrote to memory of 4896	4960	msedgewebview2.exe	100
PID 4960 wrote to memory of 5392	4960	msedgewebview2.exe	101
PID 4960 wrote to memory of 2192	4960	msedgewebview2.exe	102
PID 4960 wrote to memory of 2192	4960	msedgewebview2.exe	102
PID 4960 wrote to memory of 2192	4960	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1296.1272.2925466247216501573 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView /prefetch:4 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff95d585fd8,0x7ff95d585fe4,0x7ff95d585ff0
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1772,i,16319151706841096797,15187379169609239027,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1772,i,16319151706841096797,15187379169609239027,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1772,i,16319151706841096797,15187379169609239027,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1772,i,16319151706841096797,15187379169609239027,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982 /prefetch:1
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3608 --field-trial-handle=1772,i,16319151706841096797,15187379169609239027,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3608 --field-trial-handle=1772,i,16319151706841096797,15187379169609239027,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4548 --field-trial-handle=1772,i,16319151706841096797,15187379169609239027,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4460 --field-trial-handle=1772,i,16319151706841096797,15187379169609239027,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView" --webview-exe-name=2026-08-19_b41b0a19d854f14bbcbf429e94ab9fe3_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1072 --field-trial-handle=1772,i,16319151706841096797,15187379169609239027,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fbcdc435761255323ac9b1743f90536acedca982
    3⤵
    PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d756b57d4fc384d18454a1cc7fb5a8196365eb3b9a16b987eb13cb89b7851e99
MD5 ac6867c265c833a4337445d8fcc74440
SHA1 e79f864e11c74dddce4049412711242b0f4fa6e8
SHA512 2ec8b1dccfc81911d6b2a9ddb47a69ea853f322f8e2f0f402f22ea4c3afc3ae7822909ec3f38e0869914395f9f59ecc1f8b83969ce686210ecffc376b28b03cb
TLSH
T11DD0122332050535C0302533020376485861C60B8005C1005529961D1B544F50912841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eecb2c7f0d6c010e97154e8944940f428b9f0a47ecfd4c03d1ca263d9a6d22f1
MD5 67e0b5a962baf635f8cfa7f0de9c7804
SHA1 248fe2b8592757c331ef53ebc83fc87a67db0d05
SHA512 091628225e26bae3d97330d7fdac3b25eb3d7aa69ab80ef013f214166c905a234cfc182bd7c8ee1917640013cc4783ae66d2a9840ec5e45a360d0319dcf65385
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 b7c42614b0df0d5fb4719a78e24eec8a56bcab76739faba9274002b86f4804e2
MD5 aae831b3927f1756b7f8fd157e8ecb9c
SHA1 83da3dab093ea3931132fc9cb6246fb8d49822e6
SHA512 c021212d43fe1974c46e5fafa7deae677aec75e782e0f487f6f3466a7cf3275efce9eb6c5275f280795d923feb8ae7532f64f874f488f4a65a06527825702c40
TLSH
T1D3C092D5DEC4845AC314613199E4BDD2B7300AA401C3CD7203F40C3780D9F218793680
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59abc7.TMP

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59abc7.TMP
Size 48B
SHA256 233e83c19333b2762cd4987db67abefc6dc2bf59859f4832f86611c374b424ac
MD5 f6f8a626957835fefbafe71404f0c3e5
SHA1 e72123958e0874629a3b40ffb8b128aa061f7ba7
SHA512 da84fb58a4e701bcf27347d8c37e0ae3e6fb0e4713d5c61fd67b6d039624564aff24dbf8f7d1ed56751d2078e280e1efc7080f66fb9c1af113871bde2caa7143
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Default\Extension Scripts\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8166.TMP

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Default\Network\Network Persistent State~RFe5a8166.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Default\Preferences
Size 6KB
SHA256 9ed1a1c3459dbe821d329f6bfa83e920a1049a6382860ec80174d11e0236719c
MD5 7bd285e262f8f5659285996639d77beb
SHA1 eaa478545296d6dcfde4674f00b48fd40c498840
SHA512 34f8b8c39591d7b88d98c60cba6e989229f6eed897fb226946b16784c19adb2b3585401857560af4aee4d0194e194003bd0d1a9d1c542569b0fb1fab8143faae
SSDEEP 96:stos/d43eGFdvb9IkPo5h16Z05s7/x+6MhmuecJnU1eje8K+gX28XM1C7K:stogy38con5sV+FdnUQjolG6K
TLSH
T1EDD197026F24797B4CC7F219BA69BB13E3F5607265E52E58EBF8451C04DB6DC220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8e213c4-f426-4914-a9bc-9c90e6d40818.tmp

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Default\f8e213c4-f426-4914-a9bc-9c90e6d40818.tmp
Size 6KB
SHA256 ca67e17e0f13766d020313bfe884374ca66a0c18af3b18ae9989f53798d6ae92
MD5 49a827da1e1334cf67db5a731f89a4d2
SHA1 7196802534970b3d51f3bfb56c57e2a2faa3a185
SHA512 66f39fe54c369b97fae311c9afbbc2f3fa6492816d31d331bfc5680761c7eccd08bce889aa01ad21fc06672ec062854484e7fda29149e9240fe7808b8eab0fc9
SSDEEP 96:stos/d43fFdvb9IkPo5h16Z05s7/x+6MhmuecJnU1eje8K+g/28XM1C7K:stogyN8con5sV+FdnUQjoZG6K
TLSH
T12AD196026F24797B4CC6F209BA29BA06E3F5607275D52E58EBF8452C08DB6DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Local State
Size 15KB
SHA256 1f0aee8b6573fe7defd6d67777c77f40a93e65d81d558433297192cc61e1156f
MD5 5ccf625531c1863d98c6b82c335d6d52
SHA1 294613b44fd75791ae4e7c55d8d288513076daad
SHA512 4280d29e72d4a23d39f11c77872a0b3b76090f4689de905aa1a54e36b848b3ac02e273745765f74da305fa8cafbb98b5ba4707fbc22b913d57fa7e0b0c6c5607
SSDEEP 384:U+aQikB+z/xvxjg/qhEwNBSO+x+sNjGMrBKiuEp:z/UxvxjgC+mRKV
TLSH
T1F8728E2BA5A97E23D6F7E604798E5B5BCBB4847291817EB84EFD5F0E06872D41302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Local State
Size 2KB
SHA256 76f88b6bf42b23da6608fdfa7bec86bf62025fe4cc7cf340bd5066229a6bdd30
MD5 4832ec8b330192739cf57ae504eba32e
SHA1 2399efbd4ab0757e2f540f90d923d38843188f2a
SHA512 9a795cca13c480a6b66f9c3de5c5664de06ee7801bb9ebe9e6c8add0a9c290c7f83c27036bfc151a5fef86cb1d69548bcf8c0f54ced62b2c5d4c8a5e807b8a63
TLSH
T1025151327E647B378AE29748798A6B12CF399066EA613F519BEC0B1C02D759C1302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Local State
Size 3KB
SHA256 93c2fe7c064db54420bb6eb5442bf7c6e9eefa21c9a4ffa163400a6b853eb2dc
MD5 ee90f4c0941a192e74484ea27f812c78
SHA1 d9f67285020781f557be45801703aeffa8addc44
SHA512 f8b5c975dbb5f95cf5f7952656c09c57ceb8182c56833fedb64eb51fb2c62f4772b6076057572f163c3e6872fd5f6d3b8aec1d48e1dfb214e39c24819928fd05
TLSH
T1FC6155367E74B6378EE39B05B9C62B12EB659027E9913F95CAEC0F1D02D72981342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595990.TMP

Path C:\Users\Admin\AppData\Local\de.semicolonsoftware.omnikee\EBWebView\Local State~RFe595990.TMP
Size 1KB
SHA256 c8ca961eff04743eaf2921eadc9bd9df9f4a810103a5abd2d8abbc67b3750bf8
MD5 b2d019ff0c59cc8eb166ec1609d1ca0b
SHA1 c0492d569d3113a047c5d5710b5e619b9fc41564
SHA512 34b2d6ba9931af2eb3913cd8211d8aa00ae01694e6b0f861bbb3dfba09ab5cf4247b75c24568fc5027b927f09f2e521bc5a46cd3527fc7b0944a4dddc75442f3
TLSH
T1CA213572BBB46B33EDD263457582A7138F20502BC6205F4496ED4A1D03E718C571BC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3132-96-0x00007FF97D910000-0x00007FF97D911000-memory.dmp

Download

memory/3132-204-0x0000022E874B0000-0x0000022E875C6000-memory.dmp

Download

memory/4740-217-0x00000154C0000000-0x00000154C0116000-memory.dmp

Download

memory/4740-262-0x00000154C0000000-0x00000154C0116000-memory.dmp

Download

memory/4740-203-0x00000154C0000000-0x00000154C0116000-memory.dmp

Download

memory/4740-390-0x00000154C0000000-0x00000154C0116000-memory.dmp

Download

memory/4740-26-0x00007FF97D910000-0x00007FF97D911000-memory.dmp

Download

memory/5172-234-0x00007FF97DE30000-0x00007FF97DE31000-memory.dmp

Download

memory/5172-235-0x00007FF97DE70000-0x00007FF97DE71000-memory.dmp

Download

memory/5392-360-0x00000188859A0000-0x00000188859A1000-memory.dmp

Download

memory/5392-361-0x00000188859A0000-0x00000188859A1000-memory.dmp

Download

memory/5392-364-0x00000188859A0000-0x00000188859A1000-memory.dmp

Download

memory/5392-363-0x00000188859A0000-0x00000188859A1000-memory.dmp

Download

memory/5392-362-0x00000188859A0000-0x00000188859A1000-memory.dmp

Download

memory/5392-359-0x00000188859A0000-0x00000188859A1000-memory.dmp

Download

memory/5392-355-0x00000188859A0000-0x00000188859A1000-memory.dmp

Download

memory/5392-353-0x00000188859A0000-0x00000188859A1000-memory.dmp

Download