2ed072e85134bcf7677b690885e066d3b912b33f13a45949e031c5f7bb1761df

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe
Size 22.2MB
Sample260825-de1vksfg39
SHA256 2ed072e85134bcf7677b690885e066d3b912b33f13a45949e031c5f7bb1761df
MD5 b95d0d3a60db4a9a25a150e280355159
SHA1 dc3fca9e01e86be393b808be7ad13d1b1343d8f8
SHA512 8a77d86c9abf60983ffee295b94a5a7e381252cde477015d696e4b18087693b7bdaaf8756488bb3e163be6c60c2025bfca9fd884a3d7926e4c5b37b23fc965a7
SSDEEP 393216:9liRuyFiF3O5acsy5GDulh4vTK4QBRiq7hyXKmgt90nRw+l01KxMgqWJ:0jFikaMoqcKnBQWhya3nOK1KCgT
TLSH
T1EB371203F2A691E8C46EC0B4D31AA637EB32B889453576EF27941B213F1AF906F1D745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSRecommendationDaemon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msrd80f3278a-63a1-4001-87cf-095c190dc301\\MSRecommendationDaemon.exe"	MSRecommendationApp.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Executes dropped EXE 3 IoCs

pid	Process
2476	msrec-sidecar-5904.exe
5000	MSRecommendationDaemon.exe
6124	MSRecommendationDaemon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{24E3DD7B-029C-4567-B055-196B395773E2}	MSRecommendationDaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe\MSRecommendationAppStartupTask	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe\MSRecommendationAppStartupTask\ShowNotification = "1"	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe\MSRecommendationAppStartupTask\State = "2"	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe\MSRecommendationAppStartupTask\UserEnabledStartupOnce = "0"	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5904	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe
3136	MSRecommendationApp.exe
5000	MSRecommendationDaemon.exe
5000	MSRecommendationDaemon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1088	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2896	wevtutil.exe
Token: SeBackupPrivilege	2896	wevtutil.exe
Token: SeDebugPrivilege	3136	MSRecommendationApp.exe
Token: SeDebugPrivilege	5000	MSRecommendationDaemon.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5904	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe
3136	MSRecommendationApp.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 1088	5904	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe	89
PID 1088 wrote to memory of 52	1088	msedgewebview2.exe	90
PID 1088 wrote to memory of 5980	1088	msedgewebview2.exe	91
PID 1088 wrote to memory of 5980	1088	msedgewebview2.exe	91
PID 1088 wrote to memory of 5980	1088	msedgewebview2.exe	91
PID 1088 wrote to memory of 5980	1088	msedgewebview2.exe	91
PID 1088 wrote to memory of 3304	1088	msedgewebview2.exe	92
PID 1088 wrote to memory of 5316	1088	msedgewebview2.exe	93
PID 1088 wrote to memory of 5316	1088	msedgewebview2.exe	93
PID 1088 wrote to memory of 5316	1088	msedgewebview2.exe	93
PID 1088 wrote to memory of 1132	1088	msedgewebview2.exe	94
PID 1088 wrote to memory of 1132	1088	msedgewebview2.exe	94
PID 1088 wrote to memory of 1132	1088	msedgewebview2.exe	94
PID 1088 wrote to memory of 1132	1088	msedgewebview2.exe	94
PID 1088 wrote to memory of 1132	1088	msedgewebview2.exe	94
PID 5904 wrote to memory of 2476	5904	2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe	95
PID 3136 wrote to memory of 5000	3136	MSRecommendationApp.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5904.4560.10387942623531993063 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView /prefetch:4 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdcdb25fd8,0x7ffdcdb25fe4,0x7ffdcdb25ff0
    3⤵
    PID:52
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --webview-exe-name=2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,6299213721964291097,2819986181564038959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021
    3⤵
    PID:5980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --webview-exe-name=2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1768,i,6299213721964291097,2819986181564038959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --webview-exe-name=2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1768,i,6299213721964291097,2819986181564038959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --webview-exe-name=2026-08-24_b95d0d3a60db4a9a25a150e280355159_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3408 --field-trial-handle=1768,i,6299213721964291097,2819986181564038959,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021 /prefetch:1
    3⤵
    PID:1132
- C:\Users\Admin\AppData\Local\Temp\msrec-sidecar-5904.exe
  "C:\Users\Admin\AppData\Local\Temp\msrec-sidecar-5904.exe"
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Program Files\WindowsApps\Microsoft.MSRecommendationApp_1.1.3.0_x64__8wekyb3d8bbwe\MSRecommendationApp.exe
  "C:\Program Files\WindowsApps\Microsoft.MSRecommendationApp_1.1.3.0_x64__8wekyb3d8bbwe\MSRecommendationApp.exe" microsoft-msrecommendationapp:
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Users\Admin\AppData\Local\Temp\msrd80f3278a-63a1-4001-87cf-095c190dc301\MSRecommendationDaemon.exe
    "C:\Users\Admin\AppData\Local\Temp\msrd80f3278a-63a1-4001-87cf-095c190dc301\MSRecommendationDaemon.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5000

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.522.1444.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.522.1444.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.522.1444.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:true
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Users\Admin\AppData\Local\Temp\msrd80f3278a-63a1-4001-87cf-095c190dc301\MSRecommendationDaemon.exe
C:\Users\Admin\AppData\Local\Temp\msrd80f3278a-63a1-4001-87cf-095c190dc301\MSRecommendationDaemon.exe
1⤵
- Executes dropped EXE
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSRecommendationDaemon.exe

Path C:\Users\Admin\AppData\Local\Temp\msrd80f3278a-63a1-4001-87cf-095c190dc301\MSRecommendationDaemon.exe
Size 79KB
SHA256 541cd0b94d57b0cbcd29a366daf0fdfcb4938fe9b906e5484ae2717236298c97
MD5 ce2fe396749360de5c40286946dbcaad
SHA1 c198d8083f1f1d896462e476564ac058238225c9
SHA512 5e7ca7091acd5c85ab6d3301c420c82a2f564d04b1be55935b1bcbf35654d32061e806a1b3ca536fe083c93f51ce47c3312fca5e7651ef9e5a0e6a8ba6f1f99e
SSDEEP 1536:5DXqkzluC5K6C0FYqQBih+v8DUyKwG0ZNUKItcPPzG:5jqeYc5Cqh+v+FKwrZmKIWPPq
TLSH
T15F836B40B3EC8923D9AF9D7ED93403064B77FB066806E78E54CCA8DC28977D19A12767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msrec-app-5904.msix

Path C:\Users\Admin\AppData\Local\Temp\msrec-app-5904.msix
Size 13.3MB
SHA256 ba4c7dc0a0dc682c8116d9b28bcecd7ae5b087d4562a6ef2bdef510831fdbb70
MD5 b766111301a76760a4954015a144e0d9
SHA1 940044da12029d550bc33b5800e25b6d39086880
SHA512 eb1c14fc78efee6b91bc2824835c085bc2f6f4a6f90cee8f257a078a26e5b878d21c9f230c6358c8abc39864f0bccdcab2dde4d5e53dcc93ca80e0905433e0ae
SSDEEP 393216:IO5acsy5GDulh4vTK4QBRiq7hyXKmgt90nRw+l0G:NaMoqcKnBQWhya3nOKG
TLSH
T17CE63335DEAD7AA5DC5B1C32C40F688FCE8B9A40A213685E3E0397552C5A6C95C933CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msrec-sidecar-5904.exe

Path C:\Users\Admin\AppData\Local\Temp\msrec-sidecar-5904.exe
Size 8.8MB
SHA256 9831634e370e1f76e2c2a40853a55e86b9ca210cadecb40efed666f7bc111d79
MD5 8b740781609b27e9fb8013e6749ebf38
SHA1 f0f997c0c9d174ff5c49debb5bf296d0202ba4c2
SHA512 94c95b927802ab44ed40f410b3c51be40f0d03fb462559230a04a6736aaa5033c6fef5b00a292b3953a7968aac29956abc0d6737b7ab0f23f18e07833e509426
SSDEEP 98304:T45w+4rSEH6A1m5zEyD+N/bLX/xpRfm/Fz77CEM:c5w+HK6A1UzHD+N/bLX/xm/Fz77k
TLSH
T1CA96AE09A3A500B5E92BC738CA55C733CAB8BD925635D14F085CF7C61F73A628B2F625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f25e98855f6dfb7d84a022f9cbe1953fe0ad1ec834fc3ec4ed25a9fbdbf6cda8
MD5 536db69be29a143e546e839018312376
SHA1 757eaecf8609abae36157d52f6bb309186505310
SHA512 c92b6a7fdcefb07a302ad1aaea68e6bda52b3655c26f99dab021cdb0236b9dd7ef575c83a3d7b37651e69389a4c6f1f64b9465b009375376b404f6c8670a87ee
TLSH
T1A0D0126332420935C0203533140265080501C51B40098140942DA75DAA04060090A851
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1448aea012b717287e9dd7d0fd2a8d6caf3b0a07ab099e5f8d71cf5b5ce73ec2
MD5 8cc448f9da2edb06051a1c80ae2dfab6
SHA1 f597cbac038c34d936d192a68d19d889807ae55e
SHA512 e6c59f8560ecf831e218eb7ad63789a61b892b0f23d88256b4a503fcaf7f3e4b8f73d11fd6b6f8ce1f14f210f16d7077482ef249eb7c923c1692a1017389839f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 27faeea63be7a2eb5c5b1c250a9d4d4b8efbfeeca5d2a4873a434d44c6d37394
MD5 458c5f8acf34d9b169f676aa58bab742
SHA1 f654c86e930c73daf43521d1d55ee6e09f3f5db4
SHA512 dae465dadd0ce43d429fa9f73400a0166d846ec62acd970c005e2336934e60054429b5978b4dbbda4c56a9b9dc3504962feec76073e4619bdc9ec6b965b8d9b1
TLSH
T187A0025025AB8109E54197B95086034172325C5042434B4980905B69C8513404326966
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a186.TMP

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59a186.TMP
Size 48B
SHA256 3c7ec6a899a0f1dc61029573100b569b0c1f0b5397c7961efa72497d8568669a
MD5 ee6bf37c4e80352193c9ef25f2ea2031
SHA1 b5fcf18cd4fa2a2d4c36f4cada8f9b156d91095a
SHA512 bcacd8a196dd9345dbc182c94d40f80315c88a88b8e3fe1466dfe18e242fac7ef410f682daeff22ed6afb8dca6527dd6c64ae90d7172abd8ac228afe6f7c362b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59a3e7.TMP

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Network\Network Persistent State~RFe59a3e7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Preferences
Size 6KB
SHA256 ff9bd98e8fa89ec411cb79bb40800cc1abd645df935b503dd28f6f4d29aa5676
MD5 cc41e0cd0d9e0a8afa95a55bdb0c4253
SHA1 9fceec96abada2fa58aca9ac3b7df7064b1f8831
SHA512 585800b21c8c6d2527fae6801241672f6d717a6498de790bff0b8e61cabf5d1adb6af15cfe4f3ebd95c35623dca242d29aa36cb604146de3530b0c7b0dac15eb
SSDEEP 96:sth/ddz7zWb9kk+Ro5h16Z0Ps7/x+6MhmuecJ7p1ejej/K+gi5I8XM1C7K:stVfDdonPsV+Fd7pQjhUg6K
TLSH
T1C0D1A6055E68B97B4CC6E118FA35BB13E3F5607231D51E58E7F8852C08DA6CCA307907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59a186.TMP

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Preferences~RFe59a186.TMP
Size 6KB
SHA256 ab3abff6eb18da821ead304bebdd784c6b21791469c6f8b7fafbf990d95dbb2c
MD5 33bc3d5f84872f2096e4e9087622be6e
SHA1 2a593a02c7ca9901005af7dda7ed7f7a658f7ef2
SHA512 37469a0c4008adfe75bb33651beb65f6feed628c5b424e76bdd3f881e6688ce7be754c1cf52e5ae336d0148e19e7f2a3eb6a8c93a4409fa4a83900301ac63f2b
SSDEEP 96:sth/ddz7zWb9kkDo5h16Z0Ps7/x+6MhmuecJ7p1ejej/K+gj28XM1C7K:stVfDconPsV+Fd7pQjh9G6K
TLSH
T14FD196015E68797B4CC6E509FB39BB13E2F6607261D51D58EBF8862C08EA6CCA307D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State
Size 15KB
SHA256 468157af5976ba20bde9ab33b9bb9afaaafb29c4932241c33c90918a7e5e8c81
MD5 997f5cc0d75f379e94d18c1c99cf08c3
SHA1 44333032498d58fbb15a897042ac95746c993cee
SHA512 d013dfebe7015ac7e0bec32c2f5245ab455e66b5faa64746579892aadb10ca248f9f8160d24b397bcabb6c92a9db98978785bc177046ab40514fbd779b2d86e1
SSDEEP 384:u+aQikB+z/xvxjg/qhENNBSgVZcNRd4jG9zW:5/UxvxjgC+/Wf4KFW
TLSH
T1EF72AE2B96797E2799F3E6047A0D1B4BCBB994B291C22D784EAD9F0C06C73DC1306813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State
Size 16KB
SHA256 b97d90088ece5eb62fa6d824d6aa86c967777b6cf57aa66a4ccb451a747cf1a0
MD5 7e85be663bcae1836ba4140177460349
SHA1 9b52579864be4f44b60dd62eb7d8781502115c16
SHA512 f71cbcff37d19b06a06b30d089725c5507e81b2fdf5fe8c3a489a56d390536e44d54a7c0cc5d96a87eababd5f6bba864df90b226c3ac7ca24cc00baaf905a4ce
SSDEEP 384:/+aQikB+z/xvxjg/qhEZ3NBSghPcNkd4jG9zW:O/UxvxjgC+ZrWM4KFW
TLSH
T16B729E2B9A797E2799F3E6047A0D1B4BCBB994B291822E744EBD5F0C06C73DC1306917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State
Size 2KB
SHA256 50a7a28b5d836276916b8141c0180bf70f868783d0a85b7f1065a0690e199cda
MD5 d87dffd2b03757a1fb9799737bc7d445
SHA1 5d85583d6a5b226cd18c9bf8264cdc35a57d9b94
SHA512 028ef64216a277795188617f71d685c362bed524bbcf9d77d5b10bf1de8c51f7ce713923a6f809d69bbca0a8c9a944409db26bed53c78db79f160f712c81123f
TLSH
T17B519573B924AB3B8EF247487A4B3A23CE7681559B522F10DAED4B1C01D625C5305C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State
Size 3KB
SHA256 5c27ed34c0f086d2b84a5e598f50939284eedcb74f6e9939ee87728941e7228d
MD5 7342050193f90a65bd2b5d513f1b2e77
SHA1 8ac4d76b7c8fa2e653c2150e7422ab5e47d53908
SHA512 703f0bf4f0bc38c592206796a3074250155899f9b38f5c0a643fd93a8196122ac6fae33a78c15097e48c6e531eacaaa9885cb1cfbe0f98a5c37ad6490a01ee04
TLSH
T160617873A935A92B4EF38B04B9863B13ABA69127D5913F54D6EC0F1C01D739C1341C57
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597517.TMP

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State~RFe597517.TMP
Size 1KB
SHA256 0707f90b36908821aedadaa1bd1dc99b5428b39b0259b55d53f3c6327599710c
MD5 b0c845481a6af650fe1ff4848c894086
SHA1 c44a4710fd19eba648f1ed8cbf8c74a7f6497d3d
SHA512 8ae4e468dff007bd92571b2b7e45d944ab95f68dbff003d706ca16a396752b11192797848a3e024cfa9fef69649ef3459ddbc62ba99969351b01782c186760c0
TLSH
T1B32154B2F6396F379DD25759374B7A639E32405BC3114E08A2DD8F2C02E619CE629837
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1132-102-0x00007FFDF0210000-0x00007FFDF0211000-memory.dmp

Download

memory/2476-180-0x000002A7027A0000-0x000002A7027B0000-memory.dmp

Download

memory/3136-206-0x000002B1EBA40000-0x000002B1EBA50000-memory.dmp

Download

memory/5000-294-0x00000213F1A80000-0x00000213F1A98000-memory.dmp

Download

memory/5000-295-0x00000213F41F0000-0x00000213F43B2000-memory.dmp

Download

memory/5000-361-0x00000213F49F0000-0x00000213F4F18000-memory.dmp

Download

memory/5000-362-0x00000213F2000000-0x00000213F200A000-memory.dmp

Download

memory/5000-363-0x00000213F2010000-0x00000213F2018000-memory.dmp

Download

memory/5000-364-0x00000213F4170000-0x00000213F4196000-memory.dmp

Download

memory/5980-26-0x00007FFDF0210000-0x00007FFDF0211000-memory.dmp

Download

memory/5980-205-0x0000022D6CD10000-0x0000022D6CDE3000-memory.dmp

Download