01661df0ad012f6425c36f0cd22d4e94602190a846f48c854fde5fbee4401188

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
Size 7.9MB
Sample260910-2l4f2sxaph
SHA256 01661df0ad012f6425c36f0cd22d4e94602190a846f48c854fde5fbee4401188
MD5 dd3958e718403fe9fd55a2ecc0341d52
SHA1 585002c195cdf158f3d3939bea832f218387922f
SHA512 a9aee16258f723ab93288bdbf288a9254357c6d9c80437707cc017fb1e3b18499c1abbfeb932b11b89b535ca272da4433d2b355cdfd79c59cedeca6f79401c9f
SSDEEP 98304:X/5ICdsD0RjFe6nBdnf7gWKaKdeo6PDl3hJX0r+QY7GvfnN16t:X/5IqFewQaKdvPGt
TLSH
T13E863A217B5A99ADC15EC474828646B25A3170CB0B35BAFF45C446393FBABF11F3C298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_283713976\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_283713976\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_283713976\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_283713976\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_283713976\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_685268288\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_685268288\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5136_685268288\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3016	msedgewebview2.exe
3016	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5136	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 5136	2224	2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe	88
PID 5136 wrote to memory of 3368	5136	msedgewebview2.exe	89
PID 5136 wrote to memory of 2452	5136	msedgewebview2.exe	90
PID 5136 wrote to memory of 2452	5136	msedgewebview2.exe	90
PID 5136 wrote to memory of 2452	5136	msedgewebview2.exe	90
PID 5136 wrote to memory of 2452	5136	msedgewebview2.exe	90
PID 5136 wrote to memory of 3292	5136	msedgewebview2.exe	91
PID 5136 wrote to memory of 3160	5136	msedgewebview2.exe	92
PID 5136 wrote to memory of 3160	5136	msedgewebview2.exe	92
PID 5136 wrote to memory of 3160	5136	msedgewebview2.exe	92
PID 5136 wrote to memory of 2568	5136	msedgewebview2.exe	93
PID 5136 wrote to memory of 2568	5136	msedgewebview2.exe	93
PID 5136 wrote to memory of 2568	5136	msedgewebview2.exe	93
PID 5136 wrote to memory of 2568	5136	msedgewebview2.exe	93
PID 5136 wrote to memory of 2568	5136	msedgewebview2.exe	93
PID 5136 wrote to memory of 5884	5136	msedgewebview2.exe	97
PID 5136 wrote to memory of 5884	5136	msedgewebview2.exe	97
PID 5136 wrote to memory of 5884	5136	msedgewebview2.exe	97
PID 5136 wrote to memory of 3016	5136	msedgewebview2.exe	98
PID 5136 wrote to memory of 6124	5136	msedgewebview2.exe	99
PID 5136 wrote to memory of 6124	5136	msedgewebview2.exe	99
PID 5136 wrote to memory of 6124	5136	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2224.4268.18214516673540708420 /pfhostedapp:0e3837d369522548018310cf6089bc3082c0519e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView /prefetch:4 /pfhostedapp:0e3837d369522548018310cf6089bc3082c0519e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffde8e35fd8,0x7ffde8e35fe4,0x7ffde8e35ff0
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView" --webview-exe-name=2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1668 --field-trial-handle=1672,i,18181926761131253641,15844108405139152624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0e3837d369522548018310cf6089bc3082c0519e
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView" --webview-exe-name=2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1984 --field-trial-handle=1672,i,18181926761131253641,15844108405139152624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0e3837d369522548018310cf6089bc3082c0519e
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView" --webview-exe-name=2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1672,i,18181926761131253641,15844108405139152624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e3837d369522548018310cf6089bc3082c0519e
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView" --webview-exe-name=2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3428 --field-trial-handle=1672,i,18181926761131253641,15844108405139152624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:0e3837d369522548018310cf6089bc3082c0519e /prefetch:1
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView" --webview-exe-name=2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1672,i,18181926761131253641,15844108405139152624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e3837d369522548018310cf6089bc3082c0519e
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView" --webview-exe-name=2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=816 --field-trial-handle=1672,i,18181926761131253641,15844108405139152624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e3837d369522548018310cf6089bc3082c0519e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView" --webview-exe-name=2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=1672,i,18181926761131253641,15844108405139152624,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e3837d369522548018310cf6089bc3082c0519e
    3⤵
    PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 035e0515ac5bb2ed38df08c67e4164c49809f6e7dc08f4e5a2b7917dbd19d719
MD5 ec9a63aa0bc4240586d80c063affc6f6
SHA1 4cec8a5e3b7b982c5b56dd36c8651a1d7243cc46
SHA512 ddc93469bc1b8b1a2af1dad2f01f570d644fcff889a7ff0e76891e46d462b6c3d7b04e5c6ca7d2f9daa1a8bfd97ba34dde676564128f111a034709b96211ebec
TLSH
T1DED0112A3A038E38C020303B2223A2080C00E20B800A8200A828EB2EAF0C8A02A02882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0440c42380798d74b0bd34af3c9a9b38804c314050674ee2f7d9b31622645c9c
MD5 bfc5bffe418a95952526c7daf5c40bd0
SHA1 0e3b869a1d2bd669a2a79cc822acd450f73770b4
SHA512 3fabcbe97e41fca94659e87ae2111bacccca526dba1334103749e4499e8422c30da3114ad9d5ae9429c8361e400862f898341c64cf946b15e320201eca679080
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5ca2a307b346294b97d80c071c4dad996d8d8fa36985f9f0031ca4040d06e750
MD5 227e3b9864fe7149e5e2aae17ba9cf83
SHA1 3d3f39aaccda1f5f52e7ade84e7c3a6cf88af349
SHA512 749d31fdc855d784576316f02fdcb90ab739b010b7e5988061080cd60d5007cc80931169939b87589a1cfa2847f742c22f91af0ea7962818a7218869a0d19bdc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ae36c81cbb9f5dc3c45fc591a8874e1785bdd6470444eb0ff8eb3d974642ac5d
MD5 faf6356a4b58410bde3f1199093b8915
SHA1 ff1a5d932d0ac7833117636fe9e532d418662780
SHA512 ea399341da890aedf43fc488f8ba9b58e3c946e8ca5d1487aaad5a8a3d6b7308159e7e5c99b24c8d08895ee3180b642e3b00c5cb0d3f468008676c5f326cebe4
TLSH
T1F6A00211026059B3F151877195DD414133F04C58869307D28CEAE469BCB4B858502811
MD5 SHA1 SHA512 TLSH

Submit Download

822773d8-8881-4687-8487-5412cfe83ea3.tmp

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Default\Network\822773d8-8881-4687-8487-5412cfe83ea3.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5abf0b.TMP

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Default\Network\Network Persistent State~RFe5abf0b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Default\Preferences
Size 6KB
SHA256 e07fe3068b0a559b1d47451ed2966257269885b077bedd9b0abe657af96b33c2
MD5 e0e973de7388560f3902456aad53c4cc
SHA1 b3fb2a173c6270de5a762050fbf8b3579938b9a6
SHA512 23938c0c424021fdaf2ca74b503476507cc21b1ea0c97c30fd191b74033f3ecde8815faeb92b4f587d6337bb238b544cf768b1903abf15ecbffabf7b40513e22
SSDEEP 192:stkMBzhE2oXo+klsV+FNk5A6QjwQQmCDG6K:stkMBzhE2o+lsGqq6QE3mCHK
TLSH
T125D1A7025E34797B4CC7E209BA29BB07D2F9613274D51E58EBF8952C04EA6DD6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Default\Preferences
Size 6KB
SHA256 70972d15f1efba16624777f2c7bb841e10deb26a5ec29f01615138d0bcc0661f
MD5 0cb2aa103a120e29ada0fca4ed2e771d
SHA1 3eed289b589299f6af50e6deceec2a6dd236ed66
SHA512 be1f8bd81085c399144c37b8c45812c87f027582ba66d0a48ce65126bc687d9b9b186f06335c98ec5b98f1639ae1678c28fa0473ec5a09d97f729bce032da904
SSDEEP 192:stkMBzhEgoXo+klsV+FNk5A6QjwQQ9bDG6K:stkMBzhEgo+lsGqq6QE39bHK
TLSH
T11AD1B7025E34797B4CC7E219BA29BB17E2F9613261D51E58EBF8961C04EA6DD2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Local State
Size 3KB
SHA256 8a908e74874aa36a24ef24b07421747ebee9fafb54b955e100195edbf6b80229
MD5 07938518f6fcfe390a18ea94046190f0
SHA1 f3f5cb88fc237e23f75bbd019d494ef4ac600d06
SHA512 4758bdb999cee5acd4978d36fe8b09b23d67dc5c6758129dd60d7c180f831d59fe901c6c0d33fe38bef191e04bd5b51b55899ea97ed879b6a32dfd97690a37a8
TLSH
T1096192736870AA279EF38A047C873B06A7A54122D5963FA4CAEC1F0D01E73991342C57
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Local State
Size 15KB
SHA256 58c4ec8d02a536107a9ab3221b68227b5c5ce10097e8861f633de454fd5f0d5a
MD5 f7af956cd847ce2b8cb2f6fd213c4499
SHA1 7dc0cd4f633940282df8fadc39de6dc27851363e
SHA512 edc24c562d84d544ddda37cee7a1cd26022c2c06b64624aced360fc160832f949e82c441fc976dfbb8ecd715f8e62b4e3a150e752587eb282cab7f006826db92
SSDEEP 384:Wo+aQikB+z/xvxjg/qhEwNBSzoF4jW28QFlx7x/C9zUm:e/UxvxjgC+9557YFD
TLSH
T1F6729F27A5797E23E5F3EA043D491B4FCBB8947251C22EB44AAD6F0906D73D91306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Local State
Size 2KB
SHA256 e4303f93276c004525cdd342d232223607d53345705a6f213ba4ea736719f5e0
MD5 f827d1ad8a3c4463bf465abf2b270458
SHA1 d829a4d115e8238851f84874146b5d1c1278d22f
SHA512 4f84de39435e247dfe6fd2630da564829f2998691325adc9307d3bb278993234b3859d0f337cf5453d289c3ff2ccc9b79504980ad4e41134441d72739c6c5815
TLSH
T1C451647378247A77D9F38A447D0B3E12CA3991619A661F209ADC5B1841E636E2342C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5997d1.TMP

Path C:\Users\Admin\AppData\Local\com.tauri.microsoftoffice\EBWebView\Local State~RFe5997d1.TMP
Size 1KB
SHA256 88c22a364c045004ab49f7ee3c4cdb107af053f8dddbc53398e45b6c56d908a5
MD5 9b06c468ad9cb2d0ad995e8cb4215638
SHA1 6858e9d1ab3e63155cc176045492faf8bf250ef6
SHA512 9e0810f7ac3e99aa9216b6153ea2a280c30a713b6b443e35ceac431d9daa9a4ecc843677254c3a3398dcccc4e3699799c5800b4630bf1af073876e130419ae0e
TLSH
T1CD2165F3B4B03B73FDD39B4529073A0B9E31516681554F0496DD8B1D42E239E652AC72
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2452-24-0x00007FFE09930000-0x00007FFE09931000-memory.dmp

Download

memory/2568-102-0x00007FFE09930000-0x00007FFE09931000-memory.dmp

Download

memory/3016-288-0x0000024760A40000-0x0000024760A41000-memory.dmp

Download

memory/3016-280-0x0000024760A40000-0x0000024760A41000-memory.dmp

Download

memory/3016-282-0x0000024760A40000-0x0000024760A41000-memory.dmp

Download

memory/3016-289-0x0000024760A40000-0x0000024760A41000-memory.dmp

Download

memory/3016-291-0x0000024760A40000-0x0000024760A41000-memory.dmp

Download

memory/3016-290-0x0000024760A40000-0x0000024760A41000-memory.dmp

Download

memory/3016-287-0x0000024760A40000-0x0000024760A41000-memory.dmp

Download

memory/3016-286-0x0000024760A40000-0x0000024760A41000-memory.dmp

Download

memory/5884-271-0x00000204E7D60000-0x00000204E7D8F000-memory.dmp

Download

memory/5884-253-0x00007FFE0B7E0000-0x00007FFE0B7E1000-memory.dmp

Download

memory/5884-254-0x00007FFE0AB60000-0x00007FFE0AB61000-memory.dmp

Download

memory/6124-313-0x0000014A1DCC0000-0x0000014A1DCEF000-memory.dmp

Download