1b0868151e6487341c0677a99af15c391a2f964c42dd87aeeddd36c7ec2ed6d0

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe
Size 6.3MB
Sample260819-mnehdasbmd
SHA256 1b0868151e6487341c0677a99af15c391a2f964c42dd87aeeddd36c7ec2ed6d0
MD5 fbce3da71ebfb857371391bc4dd6153e
SHA1 9d9676a10e198811d24d46cc7976f67cd261bd95
SHA512 a1539c7d8016d160a6ff389f96dad7416a3ef78919c8a36d8b124ae2f0ac60e4aa2792203a07d09ae296c21ba1772b1bd9a25b7e7dff83b02a665a6c7ecade1a
SSDEEP 196608:d3PNDeBj7G6/EAxTKqhUNrlfxcy/7up4CAOHFj+3+gVQ0ap5v9pDZDCtWgQcaiOw:d3VDeBji6/EAxTKqhUNrlfxcy/7up4DV
TLSH
T1A4667C03BB42E0FBC04742B0A01D937C9A779518A7068ED3D688ADB869E57E12D7773D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	曙光医疗管理系统.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_106319532\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1950294877\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2144283382\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_106319532\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2144283382\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1950294877\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2144283382\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_1950294877\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_148252615\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2396_2144283382\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	曙光医疗管理系统.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2440	msedgewebview2.exe
2440	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3216	msedgewebview2.exe
2396	msedgewebview2.exe
2396	msedgewebview2.exe
2396	msedgewebview2.exe
2396	msedgewebview2.exe
2396	msedgewebview2.exe
2396	msedgewebview2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4296	2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4296	2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe
3960	曙光医疗管理系统.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3216	4296	2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe	89
PID 3216 wrote to memory of 916	3216	msedgewebview2.exe	90
PID 3216 wrote to memory of 1988	3216	msedgewebview2.exe	91
PID 3216 wrote to memory of 1988	3216	msedgewebview2.exe	91
PID 3216 wrote to memory of 1988	3216	msedgewebview2.exe	91
PID 3216 wrote to memory of 1988	3216	msedgewebview2.exe	91
PID 3216 wrote to memory of 4160	3216	msedgewebview2.exe	92
PID 3216 wrote to memory of 1652	3216	msedgewebview2.exe	93
PID 3216 wrote to memory of 1652	3216	msedgewebview2.exe	93
PID 3216 wrote to memory of 1652	3216	msedgewebview2.exe	93
PID 3216 wrote to memory of 5836	3216	msedgewebview2.exe	94
PID 3216 wrote to memory of 5836	3216	msedgewebview2.exe	94
PID 3216 wrote to memory of 5836	3216	msedgewebview2.exe	94
PID 3216 wrote to memory of 5836	3216	msedgewebview2.exe	94
PID 3216 wrote to memory of 5836	3216	msedgewebview2.exe	94
PID 4296 wrote to memory of 3960	4296	2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe	95
PID 3960 wrote to memory of 2396	3960	曙光医疗管理系统.exe	96
PID 2396 wrote to memory of 4268	2396	msedgewebview2.exe	97
PID 2396 wrote to memory of 4908	2396	msedgewebview2.exe	98
PID 2396 wrote to memory of 4908	2396	msedgewebview2.exe	98
PID 2396 wrote to memory of 4908	2396	msedgewebview2.exe	98
PID 2396 wrote to memory of 4908	2396	msedgewebview2.exe	98
PID 2396 wrote to memory of 2984	2396	msedgewebview2.exe	99
PID 2396 wrote to memory of 2392	2396	msedgewebview2.exe	100
PID 2396 wrote to memory of 2392	2396	msedgewebview2.exe	100
PID 2396 wrote to memory of 2392	2396	msedgewebview2.exe	100
PID 2396 wrote to memory of 2024	2396	msedgewebview2.exe	101
PID 2396 wrote to memory of 2024	2396	msedgewebview2.exe	101
PID 2396 wrote to memory of 2024	2396	msedgewebview2.exe	101
PID 2396 wrote to memory of 2024	2396	msedgewebview2.exe	101
PID 2396 wrote to memory of 2024	2396	msedgewebview2.exe	101
PID 2396 wrote to memory of 4552	2396	msedgewebview2.exe	102
PID 2396 wrote to memory of 4552	2396	msedgewebview2.exe	102
PID 2396 wrote to memory of 4552	2396	msedgewebview2.exe	102
PID 2396 wrote to memory of 4552	2396	msedgewebview2.exe	102
PID 2396 wrote to memory of 4552	2396	msedgewebview2.exe	102
PID 2396 wrote to memory of 1724	2396	msedgewebview2.exe	103
PID 2396 wrote to memory of 1724	2396	msedgewebview2.exe	103
PID 2396 wrote to memory of 1724	2396	msedgewebview2.exe	103
PID 2396 wrote to memory of 1724	2396	msedgewebview2.exe	103
PID 2396 wrote to memory of 1724	2396	msedgewebview2.exe	103
PID 2396 wrote to memory of 4192	2396	msedgewebview2.exe	104
PID 2396 wrote to memory of 4192	2396	msedgewebview2.exe	104
PID 2396 wrote to memory of 4192	2396	msedgewebview2.exe	104
PID 2396 wrote to memory of 4192	2396	msedgewebview2.exe	104
PID 2396 wrote to memory of 4192	2396	msedgewebview2.exe	104
PID 2396 wrote to memory of 2952	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 2952	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 2952	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 2952	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 2952	2396	msedgewebview2.exe	106
PID 2396 wrote to memory of 4764	2396	msedgewebview2.exe	109
PID 2396 wrote to memory of 4764	2396	msedgewebview2.exe	109
PID 2396 wrote to memory of 4764	2396	msedgewebview2.exe	109
PID 2396 wrote to memory of 2744	2396	msedgewebview2.exe	110
PID 2396 wrote to memory of 2744	2396	msedgewebview2.exe	110
PID 2396 wrote to memory of 2744	2396	msedgewebview2.exe	110
PID 2396 wrote to memory of 4916	2396	msedgewebview2.exe	111
PID 2396 wrote to memory of 4916	2396	msedgewebview2.exe	111
PID 2396 wrote to memory of 4916	2396	msedgewebview2.exe	111
PID 2396 wrote to memory of 4916	2396	msedgewebview2.exe	111
PID 2396 wrote to memory of 4916	2396	msedgewebview2.exe	111
PID 2396 wrote to memory of 5560	2396	msedgewebview2.exe	112
PID 2396 wrote to memory of 5560	2396	msedgewebview2.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4296.3272.1867097316990014496 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView /prefetch:4 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x104,0x168,0x18c,0x144,0x194,0x7ffab5275fd8,0x7ffab5275fe4,0x7ffab5275ff0
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1848 --field-trial-handle=1852,i,4882425218162723587,8623953632654756366,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1852,i,4882425218162723587,8623953632654756366,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2340 --field-trial-handle=1852,i,4882425218162723587,8623953632654756366,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=2026-08-19_fbce3da71ebfb857371391bc4dd6153e_akira_amadey_elex_glassworm.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1852,i,4882425218162723587,8623953632654756366,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df /prefetch:1
    3⤵
    PID:5836
- C:\Users\Admin\AppData\Local\Temp\曙光医疗管理系统.exe
  "C:\Users\Admin\AppData\Local\Temp\曙光医疗管理系统.exe"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3960.3500.396384758195379296 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView /prefetch:4 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7ffab5275fd8,0x7ffab5275fe4,0x7ffab5275ff0
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1824 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2376 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2576 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3480 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df /prefetch:1
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4460 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df /prefetch:1
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3856 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df /prefetch:1
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4712 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df /prefetch:1
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4872 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df /prefetch:1
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4652 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4856 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4776 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df /prefetch:1
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4960 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4712 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView" --webview-exe-name=曙光医疗管理系统.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1828,i,5210545866675194996,16376828623532202686,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bba9a19c209f3190387758531663f0c009c236df
      4⤵
      PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2db68d52ad848aab6afba66400b6fbd348ae7244c09ae6fbbbac5f56b18b307c
MD5 f12c5ea4b121c29aa2d0981b5a177401
SHA1 377273609231d0ba98ddfc00bbfedfaf1acd5bb7
SHA512 bc32acac22746db3fcb2a8fb685aeb31179c2bc726df606a3bbd1f56c2cf1ce6d7d29786dff88742a4e3ed87b62e947546a79bd5ca0fcd2b23347d6574b3f6e5
TLSH
T1B7D0123637420234C02021731052A14E0401C20F80198011582D8E2E1E444501A02491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b0f46f26cd4ea05c4bd3132a520f893ffb450987d31592cfa57ca9af862ebd8e
MD5 345267ba0830bc82eb7cccfdaec662c2
SHA1 ff39beea22ee095135e92d70a723770f3f181f57
SHA512 3496c38c4d19adca3a1a0f4396ac30705b9dbf01291f9902fc64f38cfadf348c98bdf8586e9d2099aa010de7f09ebac04e9d388878a686e89cfcfb7707ad03d6
TLSH
T1BFD012363B420234C02022721011A14E0501C10F81198111582D8E3E1E454501A02491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ee5bcca344f57dacd2dd35624d8da6925afe9d493bb35a0ebd64cdc56855c4d3
MD5 c930c508f661b633a0283e65b10507a8
SHA1 bad057a10e8196d9c7c4e708531134da1b94f2e3
SHA512 ff171067c91be481039096b4e6649694a5a88dfa7e60ac29f49d76a8a5bbf92f55758adaea980e4e1cca2e0c69aff967f092990048faaf6eacd59ebbf9653bb0
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 468456974fd86b33647942820dce7284879acfab9e9e6eca008e1fdcf9006fb5
MD5 d1f604157b0745a40453afb93a6caa42
SHA1 3d5d77429b03674ebb0ba34d925ba1b09310df5e
SHA512 0644ce93724a57dedd8aec208e5a038e323a1b9871d5046d58a87c60479626693e6c8f25b7c7f7b60fd35aac133d2e660ecbd8f8d579ad1fc6703ae117a485a0
SSDEEP 3:MsFl/ll+l:/FE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 0ff81bfe8be0518d8f0d6ac60e1782d0c04745701c9ec549404fddf3e0604f8f
MD5 42f45fe60d4fc7b74fca481a35dfb6dc
SHA1 cc94dbd2fc84990d3ca849deedbe78d37331c735
SHA512 c8855091db9b73ca924a8d3c8c84edba9bc5cc4766816872561d7f2b0d09874636247db6f82815f3d8dfd7a2202e8d664f7b8668925af166cb3e4b01163a2bf9
SSDEEP 3:MsEllllkEthXllkl2zEklslMlZll:/M/xT02znEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 3b0f3a92d881413e7e3cb04273bb31393e3f7aef5c344ccbce22405710e6da38
MD5 bc0dddd1dcf5190979ea53f94d385562
SHA1 934295aa88d63ad13c800778cdf2efe43b23ddb8
SHA512 9e4ddd493502eff1858adf38297beb0b2138449fb7e565c390ec5181d9b723edcf736e9e779f528f4e65c004c7ec35db472ed880c90be73c4d7b7b9ad1f86809
SSDEEP 3:LstlNllkll/lJnfhl/:LsX3lEtLl/
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e9736c1e07cf1b08c3e77cc0b0ca9657be20cdeacde01133c124a88b005bbfb1
MD5 b401789f46df805d089b0049b4605491
SHA1 f42a07f4a2ed8d181b68b6cf8531ad1eda1175a4
SHA512 3e0f67918a3127bca2f6976fa4552f493fdcc602593bb26178c091b7a25dcf601d5ef9843770a849c0edd7aa0512600bfee6be3c498d0e3a018f1d52fa1a5039
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 4022152461784570738b81ccc71b84eaa2b7bac3b1663f3a8c4f74245008a8e5
MD5 97852c102a0e1df895d9ab764918dc97
SHA1 e27b293eb568db5b70263f9262fcb010697a77a3
SHA512 22ab8b850ee7f11505fdee30d27359726fe43fe40fa2aad8e11374342509adf754a75e41a21efaaac41630fc16deeb6f50fa98db08bb2c1f81684d12d6a25796
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Extension State\LOG
Size 275B
SHA256 7bea664910d87449f12cb45ee9d4638c5b62c9a0812dba9b4c208dab30436b23
MD5 fc744bdcfd53b46053001b8c412e9547
SHA1 2312bf900c721d1ea4e3ea87128272b8bc9be42b
SHA512 11cea2f4978474ca993712d009bc8b803f1285db5c4b5be527c35e3ad6000ef44734415ec59f40eb451b9a82701b4d86c0d143df593f330ebd26ce6db533ee36
TLSH
T147D02B09248CC8670CD98FF7877B534BCBD23C49B6CE36061FDCEA44A08318A7149781
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 27915ad82dbd8b1d400d8cb728a92d71e93299a5f2a2011180d65af9df1c1346
MD5 1cccf1df5e7633f3d33c9da46db59c08
SHA1 1a55e41f89533c76d140a2ab3b81cc21960f404f
SHA512 198b2393e0d86df42e7d95f85c64c45f9bc83935f648bc1393d01f17976ae657df5fa638241075ade02ad1bd2ebeab5110a2d946f4f39dba59588908faaa2296
SSDEEP 3:LsOllllklkXllr/:LsUlPlr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\History
Size 164KB
SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
MD5 a52a55fd35156c4962d5056465aa9d95
SHA1 c22a74097d6717d550758cf6f7ac16c3a4bce1e8
SHA512 2683277a6451aec89c9e40cc554ec5d16f22cb44c12ff404ea6c13acd8306552861b279f9a4e6aea3b715ece2e0f1969ff4c37f4c2e4b67336c4aa07d0a2adc7
SSDEEP 96:MBaLqL/uejzH+bF+UIYysX0fxQp97sXEHt/DfLVVVN6zRk/E0:MBGqL/tH+bF+UI3iWGVsXWNVVV63
TLSH
T10FF3EA1E5F643722CDBD923668E745B3597CF03F876326856CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Login Data
Size 42KB
SHA256 0c1c2e0223f73fea44686ae44f4e78411de421f7aef7d89617be3837d3fdbc11
MD5 cec405af1bb4df2029eacdcbc7e05fd6
SHA1 835e45888f49095a184a62a229a437399c9c62cd
SHA512 4ce266cc942447ac963f4652c058a28d7641e37a06a5cfa4b290e70d77efb80e00312363ee5adb9e502fa32ad1cf661c18ac9581d1fcb2f83e7cb6429325458e
SSDEEP 96:klpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:klrAG7Iw9ftFqidn
TLSH
T1B213350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB104259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Preferences
Size 5KB
SHA256 b7cbac7b568bd909458880b89a10eca047f67514234883e05c0a3712a51136fe
MD5 7529597cd746b5431cad693c7779f4fa
SHA1 88de05d129a1089654f52b4ba084449435ed17d2
SHA512 a25586f0d0549aa139f9073fead32cb52cd8489d56d629bac0c02dc255e21b1213a204ad3b2d23ce71fb6c8ad83234eb5bec57e288f175a56bd88fa84bc7a091
SSDEEP 96:sth/d48IabD8kxdo5h16ZZs7/x+6MhmuecmjelK+gDdN28XM1C7K:stVy3Go+sV+FijTBG6K
TLSH
T172C164025E64797B4C8BF548FA25BA02E3F9603274951E58EBF8862C18DA5DC2217D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Preferences
Size 5KB
SHA256 c915567276461975d4fbb496a37b043c364204ea5cf383862cc8e942cb7aa251
MD5 b48ff9a2048f1a0259b5f91d1c5f2da7
SHA1 bfad4ff17129d9f6d969d8d850f97f00ca343a7b
SHA512 11e912aeb8fe1385d31b72e5300099cdc65b4c0187e8a661fb255e60f6551418536a89220523c397a5324ae3859bc43489426817fbb0ac90bf81afb2dac4401c
SSDEEP 96:rh/d48IBUb98kxdo616ZZs7/x+6MhmuecmjelK+gCddI8XM1C7K:rVy/1GojsV+FijTQg6K
TLSH
T1EDC186025E64797B4CC7F148BA297A03E3F9603275D52E58EBF8862C08DA5DD6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Preferences
Size 6KB
SHA256 51ab5b9e401936881eeb14ab585b9a609f979724e95810019dfc7912e7ef35c1
MD5 de3ad0a52d7fae00cccd67f59ec89288
SHA1 1fee18c6b2cc7e72f8dcd4338b85314f1c6bdf12
SHA512 5d55e7f6860db2edd1d70df0707ba477f81247400526df5ac220b53250fa346554300e40703b0423ca9edae4f8b0762db57bcca292d8ac9cc6cc2359bf94b917
SSDEEP 96:sth/d48IabD8kxdo5h16ZaSbs7/x+6MhmuecmjelK+g3OdN28XM1C7K:stVy3Go0bsV+FijT9WG6K
TLSH
T10CD185015E64797B4CCBF548FA29BA02E3F9603270951E58EBF8862C18DB6CC2217D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Preferences
Size 6KB
SHA256 f7e2fa076b47a56874cbdc3535eb2b80f1db765a0efd07171c3ccc41676eef50
MD5 1d57beb8cea92b434b72e194e7259b8b
SHA1 0d54ca8b64233eb05ef9cf2cb130d9f0d619971a
SHA512 76e6239e37ae8761507c64eac6208c3022e27b68353b20aca407337f12037423e8acb640f077e5188c931d1db0553e03b0ce490d7fe75276cd468db72280da35
SSDEEP 96:sth/d48/GabD8kxdo5h16ZaSbs7/x+6MhmuecmjelK+gJTN28XM1C7K:stVyNGo0bsV+FijTnZG6K
TLSH
T109D196025E64797B4CCBF558FA25BA13E3F9607274951E48EBF8862C18DB5CC2217D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 83e08d274099bf024420c4e19fd34944eef3989bfddc03a451658cbbd9171b98
MD5 44994e4efb956c4115f5d257501d2b10
SHA1 feeeede6138d4faf942b5ca7301f08395e383fb9
SHA512 de9e1229aa2d665459081271d2395743c2fe15dce8be1662d661f8459fba24eae06cdb3432513cdb59a6b430f84d6f5270c28ffb1e36d7fbb2ef7295573e5e9f
SSDEEP 96:vKiWPlf/ROo1pkF5d1Ki77VaTEv9V5h5pg5+e0qYi82sJCgX7D4:v6vG99lRi82y5M
TLSH
T170C1A5A7492DD175AF444AEBDC287ECADEA601CF89D5480596E2C58806C2EFC20DE8C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 582c45888bc4e45cf8216de2e9fd703668c52b5047edb854371b29b4d1915ae0
MD5 abd3e6b840f039de55ff399fba631d26
SHA1 8aece12ee23edf4d1144dcfef79d5807c65de1b8
SHA512 625eb1632d28ebd47ce4874814517ca6c3a0989bb197ea46bbd52a4379e958271477e1caa62b8205c1e8f8a1f016b999935fe9bcf2b185c61eb9837a50732089
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Site Characteristics Database\LOG
Size 305B
SHA256 85bfd5933aa4016dd4ea4ebd61e332c4241a8557f470670855205590f4b539c2
MD5 51a4087e06e848ba617374724a58e140
SHA1 fc3c88d22e8f47175976134f9f623977ee5d9fc4
SHA512 ad600c5e90d1c591b6bfd4ea3b268422feae314b62888be50ce18240bf8bfbc959abaffb3645d5289d9042752ad1a605b919f8db80bd97b7b50eda3d1149b6cc
TLSH
T13BE0862026C9CA2B09C946EB6236A34EC6A77C06F6EE66262FE8F74461475847046641
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Sync Data\LevelDB\LOG
Size 279B
SHA256 dc710cc3e2ef2c2642c87ed2f9f0b357c856b99ccd25be76454a302b842a262d
MD5 fdbed3cf095ac27e5b5c3b0327f5b2df
SHA1 3871544969cca86e9521a43763181600cf44cdb0
SHA512 d022ffe18b719740203cfbce06cf395349a3568caf8f8573c3816648386bfede7bed6af57c0f2fa799a2e2511abcaa5a4f4fa7956479c9d4ca970d6754463c12
TLSH
T11ED0C2759AC4C9360CC086E74376634AC2F07C0AA7CE3A8A9BCCA644AA47549B469241
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Visited Links
Size 128KB
SHA256 68e2cf8fc1b0cf41e64fc167df0994e937c738ad396b47de1051c4e40345c375
MD5 fb44debd113b7b0c8db92ccdbfb75340
SHA1 2d2cb17d4d8aced45362496e3bdcc28f7a9f7765
SHA512 a70595fa62dee6264b721bee026ecb401b736ac05ef7bfc427abcd71a342d6bb724557bfeb72f52c2a50c4b2c84a1c95a01a2b054b112944418ca242c90bf30a
SSDEEP 3:ImtVclL:IiV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\shared_proto_db\LOG
Size 277B
SHA256 fe837a5deb2bb229c7a21329eb026cefefc42bc6eb5c6979014cd4dfa7d6966d
MD5 deef41f35b8d82e9112e53ab271df13c
SHA1 b822546178faa418742a6378c88a6725e5e79401
SHA512 ad51d93ae48b225812c54d05ff429ece738c100b54e1c55878ab800b7a0981cb7c4b7c37461055e6c87046da2d0e98cf4a9abe7cc69bc0b27e91dcdc524141e7
TLSH
T120D0C201B984C87B08A44AAB613353CBC3953C0ABAAE260A1FD0EA48644314AB44A241
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\shared_proto_db\metadata\000003.log
Size 392B
SHA256 0389d4d6df4f0647381e099298147d3045a7f7d54a50b8371a48f03064da86b7
MD5 7b86e36226442a93427eac626e27c65b
SHA1 7b1b1a92d19519878e4b45aa34c0ad22f6291814
SHA512 99629bd63980b44dfc248addecdf978b53509e46529b013340084d8722b792119b63a9ae54f6c1554b322edc350c3ec4452fd574ba1d4a347f2301b928cd95b2
TLSH
T102E05E52F370C800D41A927A642A6B22A7B8D485CFF8DE4F583AE8202FB66141D4B7D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Default\shared_proto_db\metadata\LOG
Size 295B
SHA256 15184e9c1622dabf419769eadc786953afc2604b51e8fc3a1b5a663d32b00b3d
MD5 5b72d98574eb6f784f4490b9bf1f09b6
SHA1 d7a6588560ea65f0fc15b8dd6bc4914ed8eea5b0
SHA512 fa7f9e8db8d5c7250d790fe96c5e20616feb2de2d8205f0219d51f032980ab54e19e1b5e3bbebddd64419795a7288cb43c927e37be9a9640a94eb455e01a1c44
TLSH
T157E0CD10B944C4BF08A145A7517253C6C3553C4AFA9E2F0A1FC4EE44A45318A744B241
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Local State
Size 2KB
SHA256 e2fa5c6918b862ded5ab00cd953016c11e287a59f8db58cf744831808a52823f
MD5 b114dbbbc8bf4b0bc40c601919522d81
SHA1 800c39d3230c81ccaf3c089c4a5dac7f36baf71a
SHA512 6941eb4c4bd42aa31c4881e4d2a151dfae620b055884c561eb00086342c2bfc7808155fccca7249ccf551ecabe461f4b73cf7cf782a2393610b2ee7916770bca
TLSH
T128517533AC54BF37C5D6AA9579877A239F39A0A2AA421F109DEC4B0C01D619C1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Local State
Size 3KB
SHA256 923c1ba784f929fc83320d46f3d56a3831b2e692cbbab32c9d431b2ea38dffb7
MD5 1ae9a48c5d3175a3205f54ce3eb963cb
SHA1 fc7e17a1fe87ef60121cc3b6bbb487f788d6e3fc
SHA512 afbd18b1e34d1c91197d6e1d230ffcf1695aba6eebee2184defd03c90f50d71a6364a5cdd3d31397286ead7b0bf2de1fd65604ff9fa525640b249cd38e2b7f36
TLSH
T1B5818622AD74B93759F7D945B8867B13AB75A023E5856F94C9EC0F0C01D72CD1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Local State
Size 3KB
SHA256 a00f1e5c8ccf93b65b90e7543df26e78c65155391c4e56c3d372f3d6e428560d
MD5 2249eae78c605ba5f3743074da6f5ea7
SHA1 8c90be48e09aa2991de278a3d13f2e088605a2da
SHA512 cf511bf221303a8091d356de6f079e79f9ec2aaefb547c68c4c4ecfffd48ca35f733c4af1869cf903867a87d58a468840e11cf9a18be9c6fda24b7866ece5042
TLSH
T14D818526A974B93759E7E945B8863B17ABB9A023E5852F94CAEC0F0C01D72CD1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Local State
Size 3KB
SHA256 e35e9fd3073a9a7a72b371b2eb79ae9d62a9b875dd05ee9e6d0ece6827a9b595
MD5 80fc1e4c589081ea76d28cd4b40db464
SHA1 8927044c192f6bcdb682a52c5842f4d0999b9606
SHA512 ec49a2520d4c85ddad7f2e14a5ccaf6fc86ebc1ebc81beedfa7abb8ae658dcc5221d94ab10632381784c6365b779ce73d8a01a4dd1ef4fc88a87cbd4a8783cb6
TLSH
T1A5615637ADB4BA3789E6EA55B9C63712ABA55063E5852F54C9EC0F0C01D729C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Local State
Size 15KB
SHA256 39b8d12c5f987fa547ea3e39fc34bf679869c025b385864c4de027d64c3f4852
MD5 b6cd3563219ceed8163c821b43863524
SHA1 cc4f92814bdc626fd92cdf7d72850595e277e730
SHA512 175cbda6b31c6cefa774860951e22c0acd2e13e4c29debea04728713c404788a68fa3dbec9eaf067dce4caa79beea2bcfcce7fb53bb8b2c9a2f8bebd9737d963
SSDEEP 384:Y+aQikB+z/xvxjg/qhEb3NBS06XVTch83l9zv:X/UxvxjgC+bAxvFv
TLSH
T114729D2B98687E37A5F7F65479591B4BCBBC9462A0C26E784EB95F0906C73D80302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe591023.TMP

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Local State~RFe591023.TMP
Size 1KB
SHA256 d65ce95a4fb33ce775dbb8e2bce7b25b9c920fb142a149a79c62df64cddc1a96
MD5 82a7ba4552e2b8053a8b9b19eab4b86b
SHA1 0947ed4cc34d681a85fefd25bec3be9244a5980e
SHA512 40e47e7f359df37b04523da426edbaf83b18c20a0b383596766149126c6b05d1e9208728b6605e78eaef44de1adcbb83b5f6cf4c23a137ed92ae659327123cb1
TLSH
T1072192B3ECA4BF33A88AAAD6319376136E34606792404F0059ED8B1C05E61CCD726C37
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\ShaderCache\index
Size 256KB
SHA256 2e879e1a8875f8ca7fd4564a07b6cbe88903fac8f6b4cb2341aee63c143085fe
MD5 7af4dcb884c725d1c6090e2eb8e96c59
SHA1 b51c711fe77194efab75e95d895372702602e1f7
SHA512 830cba71f4b7354ce27505213900958984bea67ad8f74343f663e3168342fa8ca29ef14b60b468c0c535c46812356bde0ab805525ecefb63fbc81fb3b9e89f5e
SSDEEP 3:LsOllllklkXll6u/:LsUlPou/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.scrm.dev\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1988-24-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download

memory/2440-542-0x000001F504600000-0x000001F504601000-memory.dmp

Download

memory/2440-534-0x000001F504600000-0x000001F504601000-memory.dmp

Download

memory/2440-532-0x000001F504600000-0x000001F504601000-memory.dmp

Download

memory/2440-538-0x000001F504600000-0x000001F504601000-memory.dmp

Download

memory/2440-540-0x000001F504600000-0x000001F504601000-memory.dmp

Download

memory/2440-541-0x000001F504600000-0x000001F504601000-memory.dmp

Download

memory/2440-539-0x000001F504600000-0x000001F504601000-memory.dmp

Download

memory/2440-543-0x000001F504600000-0x000001F504601000-memory.dmp

Download

memory/4296-178-0x0000000000C80000-0x00000000012D5000-memory.dmp

Download

memory/4764-433-0x00007FFAD6B80000-0x00007FFAD6B81000-memory.dmp

Download

memory/4764-434-0x00007FFAD57C0000-0x00007FFAD57C1000-memory.dmp

Download

memory/5836-102-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download