f7b5b9cf4701e2b0e638c2329af89956e14419f670e0cec5ecc5aa08e0ed116c

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe
Size 12.3MB
Sample260827-3gspesbc68
SHA256 f7b5b9cf4701e2b0e638c2329af89956e14419f670e0cec5ecc5aa08e0ed116c
MD5 08a4207314cbe3b6013057a0316061b7
SHA1 9b3bbb9ebd1d2872fea6ba39717d1369908c84fb
SHA512 463458d471b5886195f5b6d408dc7a53493f89d44b0044997d3b78258b8c5e2604656f4713b2d217498cd9dcdf2412be3396bb13e5fc5d341423ea268a7654c8
SSDEEP 196608:5visHdNTz3RNwfQ6+TfX4H6+PM51sMMP:5vnTz3RL5XA6Wp
TLSH
T1AED639217A5B996CD09BC4B4834B4A73497170CB0B36B9BF449492382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_19037087\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_19037087\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_2091569687\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_2091569687\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_2091569687\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_2091569687\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_19037087\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_1416666588\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4092_2091569687\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1460	msedgewebview2.exe
1460	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4092	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1368	2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe
1368	2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1368	2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 4092	1368	2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe	89
PID 4092 wrote to memory of 5272	4092	msedgewebview2.exe	90
PID 4092 wrote to memory of 4868	4092	msedgewebview2.exe	91
PID 4092 wrote to memory of 4868	4092	msedgewebview2.exe	91
PID 4092 wrote to memory of 4868	4092	msedgewebview2.exe	91
PID 4092 wrote to memory of 4868	4092	msedgewebview2.exe	91
PID 4092 wrote to memory of 4976	4092	msedgewebview2.exe	92
PID 4092 wrote to memory of 2816	4092	msedgewebview2.exe	93
PID 4092 wrote to memory of 2816	4092	msedgewebview2.exe	93
PID 4092 wrote to memory of 2816	4092	msedgewebview2.exe	93
PID 4092 wrote to memory of 5912	4092	msedgewebview2.exe	94
PID 4092 wrote to memory of 5912	4092	msedgewebview2.exe	94
PID 4092 wrote to memory of 5912	4092	msedgewebview2.exe	94
PID 4092 wrote to memory of 5912	4092	msedgewebview2.exe	94
PID 4092 wrote to memory of 5912	4092	msedgewebview2.exe	94
PID 4092 wrote to memory of 4760	4092	msedgewebview2.exe	98
PID 4092 wrote to memory of 4760	4092	msedgewebview2.exe	98
PID 4092 wrote to memory of 4760	4092	msedgewebview2.exe	98
PID 4092 wrote to memory of 3680	4092	msedgewebview2.exe	99
PID 4092 wrote to memory of 3680	4092	msedgewebview2.exe	99
PID 4092 wrote to memory of 3680	4092	msedgewebview2.exe	99
PID 4092 wrote to memory of 1460	4092	msedgewebview2.exe	100
PID 4092 wrote to memory of 2320	4092	msedgewebview2.exe	101
PID 4092 wrote to memory of 2320	4092	msedgewebview2.exe	101
PID 4092 wrote to memory of 2320	4092	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1368.2864.6747644921693936979 /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView /prefetch:4 /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x164,0x188,0x18c,0x140,0x194,0x7ffd17645fd8,0x7ffd17645fe4,0x7ffd17645ff0
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView" --webview-exe-name=2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,6988350760795526998,15344524156608555962,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView" --webview-exe-name=2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=1768,i,6988350760795526998,15344524156608555962,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView" --webview-exe-name=2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1768,i,6988350760795526998,15344524156608555962,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView" --webview-exe-name=2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1768,i,6988350760795526998,15344524156608555962,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199 /prefetch:1
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView" --webview-exe-name=2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2068 --field-trial-handle=1768,i,6988350760795526998,15344524156608555962,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView" --webview-exe-name=2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4616 --field-trial-handle=1768,i,6988350760795526998,15344524156608555962,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView" --webview-exe-name=2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3400 --field-trial-handle=1768,i,6988350760795526998,15344524156608555962,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView" --webview-exe-name=2026-08-27_08a4207314cbe3b6013057a0316061b7_akira_cobalt-strike_megazord_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1048 --field-trial-handle=1768,i,6988350760795526998,15344524156608555962,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:37ba8767df5cb4cf1964fa19852fa28464909199
    3⤵
    PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8a7b9d3f6577f90ee9006c7da0a2a19da5074a4c153b5a6d4c4a8c5eee65a1af
MD5 8a0edaeec951c4af2942c5ff1cfccfde
SHA1 85dd3c04e40d56fe3737944f1ab3cd1df7283a3d
SHA512 59addb8939003ffb963301e3009c0fda50c3bb233e5626e0b4762c44dc15ff492cb3e60bf3e6685ee73ea534dd3d221f7a3600d7454e30d262f7536bf8109a7c
TLSH
T132D0122232510234C01434730003B1890800C54B41058040543CA91E6A680600A1F941
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4b2fa1cb8dd46e9958bb45b2dbeebc439c619e1da1eb2c632a7269a654eb6d57
MD5 64587d57c4c17102e74b963b8a1a942e
SHA1 06d8b6ea14d90f15feb4150b9fc7d2f41227c775
SHA512 ee7a269f5d32ec9cb51d805c14f908e33fe5f518d38e4d6a5dcf03b817d353010acf1d57039dfe2f648aa6658d72483296e15466a6b703a9ef97b0d40d375624
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

296f2a91-d593-447a-a8a6-fa6851a7edce.tmp

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\296f2a91-d593-447a-a8a6-fa6851a7edce.tmp
Size 6KB
SHA256 99e6b966467b10b917f1e4af38539ac11a8cfb7d5fc9b63e5928835b5485e109
MD5 b43937bb8af68e1fdda4cf5581bf2b79
SHA1 1ce101c17c3ef89ef0405f19eb6b99caec7655e5
SHA512 328df0de48b5d3072299f11fe65cc979ccd7943d94ba31c59a5c6c942756adc4f828f6a832dfba88bf6b05f664dc0f5b13d311781d353cb316d1c53f40c04493
SSDEEP 96:stF/db7Ldb9zkBo5h16Z05s7/x+6MhmuecJTzv/1eoGejK+gaOsz28XM1C7K:st5BLaon5sV+Fd/XQoG1sG6K
TLSH
T184D1B6026E28797B4CCBE558FE297A17E3F9607165D51E48EBF8862C04D6ADC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 1a55fd21d8a775fdfe2c6255696013cb3a5ecaf0ad89aff7c23b7a1c0f9f82e7
MD5 16e20d4dfeec50483572d2ee6221a9d8
SHA1 871b192fb31a377ad67a63b2737c26976c71ccc3
SHA512 65bc4da905b4a94b8ddf4557411092a19cdbbf850690f729657d8b2b5e22eae07c73ea615801df4c52f693eada26e976dfd487ecbc5a2bbe9fed77983ccf0637
TLSH
T1EA110A910CAC2D11DB623DF3F5D90C80B835BB2E82539FC6A66250F886967D8A64533F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598c48.TMP

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe598c48.TMP
Size 48B
SHA256 d215b144e3782098fe6d14767cb67d1eb25bc52fc7222aadd1e94bb814f9577b
MD5 c0a1cc5e3a6175f6b4ee7840befcd6bf
SHA1 13c44869ad5d702b6733ace44c2c7fb5d0afd5c1
SHA512 0305baee6a8985b941d26991dcbb922e6232f62f7a901d2bc8a59bff2bbf5f1a0394a51a55a011119b7f34e399ba89606e2c41a7b5d06c3569d15984b16285ed
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Extension State\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 4f8cc826872adb3a6e73d7d5479babe56d0ab9533568bda6fe64f05030e24938
MD5 9eae309b84c14a488b1d8fc8a515ac9e
SHA1 1a6a64b862e7bb4c8740af915a40e2e48c28af99
SHA512 f53700c7b3104682469d5d3fe4dc5e44a0d5b725812dfe68bab4fc1e47d5e67f58f59f4e52d6ac2d1b9da231c95604d8ce53d732031e4ad5d3d8a98260c02182
TLSH
T16721B1A783E4C63D8B1166F467343D27CD3E0519932C6E27CDEAEBA62BD2471D22050B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4e31.TMP

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\Network Persistent State~RFe5a4e31.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 a0504028b82fedcd1250a425d9e8c04991ef3522ae661c8a23a552e2d93ffeb4
MD5 4ebd2578182c8234d4a6d2c0c7e81c0b
SHA1 b13c7e84806c0c4e0d0aed1462b285bb70495c17
SHA512 806efa017f13c5ceea591e187178c051d5df7956cc76cb302ed162669aa727b1d30466fbf7610035f4fdaa2437d98c60d7547188be7ff5184c9292931c804c30
TLSH
T19511CCA3D67FE877903909B62D44FD051826B0328151CCFDDE97D17CB0506BB0602427
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 283aee5b2325213df0fdd392791ef280608a38aabab46d824df806c48173ff44
MD5 374a32a5e51d7febd8eef3301ecc7474
SHA1 cbb54f1300992e1344fb58c0e6727a5247364c81
SHA512 3f429f3197f776e7cedc236bbadc6ed7673d9328ca8b6cc4fe66886eb17f8090487c9ee70f5cdd01790038fc8c49da53ead4523b68ca6ca83b0a3016964d6d10
TLSH
T1A1118C63C6BFE977507D09F61D84FD051866E4328151DCFDDA9AD13CB05157B4913027
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 79c9833577d24e01c090786f6e919d80b8bebea53648d1746ca2568c365b4d3f
MD5 80e12dbcd1bfc2d3ee236b3c384ac69d
SHA1 2cfbb99558f1e021651639d445a164371d488b24
SHA512 7013b8c702be041f06711f99301275c36c2c80d399b3bf4513de644915bad7d8d745c3ac806f83ae28367f8fffcf2dde97f6ea10a74dd7a7268f9832ba65f25b
TLSH
T14011C8A3C6BFE87B903909B22E44FD152826B43282418CFDDE97E27CA0516BB0602437
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 d399720af56268f34c24a108bb2634ae6405a3e8894a87b3c982a4095ee0b38d
MD5 8b59cdc656772cf5f2e70a53f655dd9f
SHA1 bbf9f486df733c16d14749e33a6c99eff982be4c
SHA512 016845d74cf19d4cd19ab099b6945590020ce3d027ef1895aa05e56a13d1c56b3784174b0aedffb0979a0dc5336bcdc99a0859f2a1d6baad46b1f1d427a094b4
TLSH
T10C118C63C67FE47B507D09B61D84FD095866A43281418CFDDADBD13CB0515BB5902027
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 f9d9b81aabe5b4dc44c9bc6d9f8ea8e20f88fec84f836325c6f90b172e8a4357
MD5 5fef70bab1e39ec940dd0a6404b6443d
SHA1 3d24db83915d5dfdb0c74ab854a00dda937a6137
SHA512 b3a9723f3609b035975119dc7cad17973d39550d17fcc05ad0d148d89b519f6aa8dbe746fae7909edd995c7aedfb8782dcb0b1437a9190fe7c52399399e161e1
TLSH
T1C811CCB3C67FE877903909B22D44FD095826B03281418CFDDED7D27CA0516BB0602537
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 30b4178ff0fc5c66cf0fe41d71ba373a9b1cffc12b257b26d2bfaabcf8fe87f5
MD5 fbdb7b5e84c220f3488ceb51906d646f
SHA1 b2fd4d5af319db6117ce7c0544e349da5dcb8ecf
SHA512 d5e1274f2c4dbcf850b47df0c2939b95697595530d30e76fa9f79a9dc1781951cf61e66821f75ba48dd0cb99ad977f65f067280fc40f3a3ddedc9b2cb1da26da
TLSH
T19D11C8A3D67FE8BB903A09B22D44FE055826B03281418CFDDE97E27CA051ABB0602437
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 4c2bb15b3692fafff3111869fd4b9424f4d982f703ed4ada8a1864342523d11f
MD5 16e24e2c4271cf14b483af7bed0f3834
SHA1 c96dce4401dfa644d37a408beabd59e812aa18d3
SHA512 5813c569aee3ec4dca96d196bc981fee118a80eff908effa5bbc008b774469c7bfd85abc9b9fdd9933ad8ea1be15f5747be214fc4d6e11a23d2a0554127fbcac
TLSH
T1B8118CA3C6BFE467507D09B61D84FE051966A47281418CFDDF9AD13CB05057B4902427
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\TransportSecurity
Size 856B
SHA256 5d537dde04faceb1dd2e76cdd968314e6fb3b2bfdf913e9be7ebe48654e48802
MD5 8e37c3ff5a62671fc762b0aa22939622
SHA1 5dfc8e5490ee44e790191c8b6488f48f4f2636dd
SHA512 e81031c22ce2c2541ce3af6213c73c6169b12b48fff9ad1741345965af9cd5bf3ffa2abd463153145d13a872386269dc64d3a3aba122473c496bda4807d57cef
TLSH
T1FE118CA3C67FE467907E09F62D84FD491866A47281518CFDDEDAD13CB0505BB4902027
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe598d23.TMP

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\TransportSecurity~RFe598d23.TMP
Size 856B
SHA256 e952bc95b640019985ce46a177e7bdfb63b4f63356ce618f23fd53e5803ec3d0
MD5 92317cb7a7bf04e95eff5b424dd6f82a
SHA1 bdd0b4e7e39126827387c66a9f60469b04a1596b
SHA512 cf9623b1a687bddf985a87a5a85852ca7aec1ffb45e5cbb8bdfdc0fd811e789d11637a7253bfe1071144946befbd2120ac399b7ee665ecb71e2d8b9a4f12cc7c
TLSH
T15E11C8A3CA7FE97BA03909B22D84FD155826B03281518CFDDE97E27CA0916BB0602437
MD5 SHA1 SHA512 TLSH

Submit Download

f0c64d0f-7c5d-4a4b-b07d-9b2ba66716ab.tmp

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Network\f0c64d0f-7c5d-4a4b-b07d-9b2ba66716ab.tmp
Size 856B
SHA256 e4ba9b398691e6381d48756079c5b65831d4b385c1477be29e7d5329f72072d1
MD5 46b45e86c890c17586e19d43066a91dc
SHA1 f9efd62e36847f00282ee4373a5a384ea3e0a47d
SHA512 62bf28a4473feca72c00e87ce5041cf6be97d13813cb68aeba0b24023c00b3d2cfc54572d719f9ed0802709dc9afb65ef08914bb1bacfb8721fa34b7f80efc1d
TLSH
T128118CA3C67FE867907D09B61D44FD555926A43281418CFDDA9BD13CB0506BB4902027
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Default\Preferences
Size 6KB
SHA256 85921b85cc0d5e84921309fc39a702917cfd2639e65d25b42546becc7ceee7b5
MD5 18dbb5953db10a70c12445cba27996a8
SHA1 1f8544e9d439e0cfacb15a35eaa3fb7fcefc4278
SHA512 212893c3ee47f46a8cdd53281a7fc4b48f989f446e493bcaa38fcce4a4eb9fa0e6aa5eea13590c7dc2c5a0b2d0f42f7c761d05df81aa6c10a078bd1b3f6cb204
SSDEEP 96:stF/db7aGdb9zkBo5h16Z05s7/x+6MhmuecJTzv/1eoGejK+gaOlG28XM1C7K:st5BRaon5sV+Fd/XQoG1sG6K
TLSH
T19DD195025E28697B4CCBE558FE297A17E3F9607165D51E48EBF8892C04DAADC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Local State
Size 15KB
SHA256 7dacf1d3255612d8b9c641bf76ad2bfb14d00f4ae864131c363dfd9f3aed7db0
MD5 85699a907e6005014d7dfb683bbe244b
SHA1 8d885fa465427ef695ee1679cf4d90dc9eb226f4
SHA512 70944442698780ce25f0048074135a4842c682128ea0d57aa928ee1271a20bf514a98fa13901a57ba189f41d769d016d288b03127ef80c12d2037088554f6c7c
SSDEEP 384:j+aQikB+z/xvxjg/qhEwNBSv5Vh7EeAVdpJrw9z2:C/UxvxjgC+bSeUyF2
TLSH
T1C372AF27593D7E33A5F7EE05B94D0B4BDBB894B290C16E684ABD9F0D02C72980342C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Local State
Size 2KB
SHA256 486572057daef6fdaddb706867d4522c3da3e7bec11ff53fcdfdffcb7aa14b18
MD5 dc1c1629f44b2ebdf185b0b0ef88d1d7
SHA1 9778a8552af30de8bd4573382a95946562873bae
SHA512 a46e07fcfe0561fcb6391e85fe081a1cfe9310393a1302aea40defbdae1404a011ddc2278ca674991b83d43993566b0d4fa0bbc3efdb2743ee916e25f338e9e8
TLSH
T17C517433AE18A777CAF64A44F98F2B23DA3990A29A521F1499DD0B0C01D651C1745C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Local State
Size 3KB
SHA256 d1820f04ee56093060fd2a837e2a0c4323330b2081267580789caa712fe85536
MD5 12cf66577bce745d3716b11ac47854a8
SHA1 290f6c26c8960eed8cd53c69da5e27cce6b3bdcd
SHA512 be0df234e91b4728ebb604107f3be7ecf719a274b74c4a33263022ce235f538446010c7b51e90997e9edcdc9e45b3c3d803a1d6f3b8e872a2b0740a7b98d9769
TLSH
T107618733AA38A7378EF69A05F98A2B17B7659063D5813F59C5EC0F0C01D76981341C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe593714.TMP

Path C:\Users\Admin\AppData\Local\live.timetracker.app\EBWebView\Local State~RFe593714.TMP
Size 1KB
SHA256 ab16cf9556ae8b9881cb70549d8fb3743e187f76cf3bb2f1fb4978a1407340a2
MD5 1d12e84f461d1463a979c3c7d91b7b7a
SHA1 6c63af761641b0eb67c15972072c22aa2e5a0d22
SHA512 7c167f1cf99722e0ff231db76371cd6f637b00c6cd439dd0729ad56c21210f4092e3c152942d84ae2c3b039461f0aa5a1be6ed5f3500f2b8a463710a251ac9bd
TLSH
T187218773D62C5773EDB62746A14B6B2BAE31D0A781014F0455DD4A1C01D645C9AADC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1460-423-0x000002BF20D30000-0x000002BF20D31000-memory.dmp

Download

memory/1460-424-0x000002BF20D30000-0x000002BF20D31000-memory.dmp

Download

memory/1460-422-0x000002BF20D30000-0x000002BF20D31000-memory.dmp

Download

memory/1460-425-0x000002BF20D30000-0x000002BF20D31000-memory.dmp

Download

memory/1460-416-0x000002BF20D30000-0x000002BF20D31000-memory.dmp

Download

memory/1460-414-0x000002BF20D30000-0x000002BF20D31000-memory.dmp

Download

memory/1460-421-0x000002BF20D30000-0x000002BF20D31000-memory.dmp

Download

memory/1460-420-0x000002BF20D30000-0x000002BF20D31000-memory.dmp

Download

memory/2320-445-0x000002248DC20000-0x000002248DC21000-memory.dmp

Download

memory/2320-459-0x000002248DBF0000-0x000002248DC1A000-memory.dmp

Download

memory/3680-384-0x0000019162FC0000-0x0000019162FC1000-memory.dmp

Download

memory/3680-395-0x0000019162F90000-0x0000019162FBA000-memory.dmp

Download

memory/4760-362-0x000002155A110000-0x000002155A13A000-memory.dmp

Download

memory/4760-344-0x00007FFD38BD0000-0x00007FFD38BD1000-memory.dmp

Download

memory/4760-345-0x000002155A140000-0x000002155A141000-memory.dmp

Download

memory/4868-26-0x00007FFD389E0000-0x00007FFD389E1000-memory.dmp

Download

memory/5912-88-0x00007FFD389E0000-0x00007FFD389E1000-memory.dmp

Download