57e7d0f4fe7c57e58e6d3b9181ff4a850da1b6f6a0bb56c0f6f046a8c5c7666b

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe
Size 1.1MB
Sample260910-hnc74afh96
SHA256 57e7d0f4fe7c57e58e6d3b9181ff4a850da1b6f6a0bb56c0f6f046a8c5c7666b
MD5 27a6975b0c3b4b9f8bad1329be5e7103
SHA1 5882d5f882bdc35cba762b7ddcaadb1579ea059e
SHA512 1cff53ad06980f695125baa04b03af9106788a9d2f2ce68ee07955193deed55749536a2ffc081858ded526f7467de7cc7832054a681ea4e98480614320dffed0
SSDEEP 12288:7/J4dCXzRKX4EcJupbSRi461R1VDrP3224c+iKmDRkRFNBMUFeA+imQ269pRFZNZ:rJ4dCXzRKX4EcJAD1RvQJsnSdS
TLSH
T12435C61123FD821AF5F27FB9997512609BB6BC967E79C38E0694642D0D72B809DB0333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1224	2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1921581194\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1921581194\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1786454961\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1786454961\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1786454961\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1786454961\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1786454961\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_904696792\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_904696792\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1921581194\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1921581194\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_1786454961\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3824_904696792\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
240	msedgewebview2.exe
240	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3824	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1224	2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1224	2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3824	1224	2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe	89
PID 3824 wrote to memory of 6120	3824	msedgewebview2.exe	90
PID 3824 wrote to memory of 5380	3824	msedgewebview2.exe	91
PID 3824 wrote to memory of 5380	3824	msedgewebview2.exe	91
PID 3824 wrote to memory of 5380	3824	msedgewebview2.exe	91
PID 3824 wrote to memory of 5380	3824	msedgewebview2.exe	91
PID 3824 wrote to memory of 724	3824	msedgewebview2.exe	92
PID 3824 wrote to memory of 912	3824	msedgewebview2.exe	93
PID 3824 wrote to memory of 912	3824	msedgewebview2.exe	93
PID 3824 wrote to memory of 912	3824	msedgewebview2.exe	93
PID 3824 wrote to memory of 2420	3824	msedgewebview2.exe	94
PID 3824 wrote to memory of 2420	3824	msedgewebview2.exe	94
PID 3824 wrote to memory of 2420	3824	msedgewebview2.exe	94
PID 3824 wrote to memory of 2420	3824	msedgewebview2.exe	94
PID 3824 wrote to memory of 2420	3824	msedgewebview2.exe	94
PID 3824 wrote to memory of 2800	3824	msedgewebview2.exe	98
PID 3824 wrote to memory of 2800	3824	msedgewebview2.exe	98
PID 3824 wrote to memory of 2800	3824	msedgewebview2.exe	98
PID 3824 wrote to memory of 1664	3824	msedgewebview2.exe	99
PID 3824 wrote to memory of 1664	3824	msedgewebview2.exe	99
PID 3824 wrote to memory of 1664	3824	msedgewebview2.exe	99
PID 3824 wrote to memory of 240	3824	msedgewebview2.exe	100
PID 3824 wrote to memory of 2848	3824	msedgewebview2.exe	101
PID 3824 wrote to memory of 2848	3824	msedgewebview2.exe	101
PID 3824 wrote to memory of 2848	3824	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe --webview-exe-version=2.8.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1224.3320.18001551907106445922 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView /prefetch:4 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa71905fd8,0x7ffa71905fe4,0x7ffa71905ff0
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,17989503258644533341,5798561268793894351,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2508 --field-trial-handle=1756,i,17989503258644533341,5798561268793894351,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2592 --field-trial-handle=1756,i,17989503258644533341,5798561268793894351,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3260 --field-trial-handle=1756,i,17989503258644533341,5798561268793894351,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19 /prefetch:1
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4424 --field-trial-handle=1756,i,17989503258644533341,5798561268793894351,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1756,i,17989503258644533341,5798561268793894351,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4440 --field-trial-handle=1756,i,17989503258644533341,5798561268793894351,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=2026-09-08_27a6975b0c3b4b9f8bad1329be5e7103_elex_glassworm_icedid.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1756,i,17989503258644533341,5798561268793894351,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
    3⤵
    PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.Web.WebView2.WinForms.dll

Path C:\Users\Admin\AppData\Local\NexusAtlas\Microsoft.Web.WebView2.WinForms.dll
Size 37KB
SHA256 c6221acfe974e74d2bcc629116301c8cfba9c2041ad5d81187b0036a0b45e278
MD5 4186b8c7af685f4d0bc110adf6c021d6
SHA1 fe1bfbd9a1c2e6d836b447a5e65c7d079f387d38
SHA512 e5722258003aaf7c35d9ba9e9c05191f72502a5a82011c589ab07b46590f40d95816ab32f70ea3a80e694492932427ac900e012b263afa4cb9e7560c1236f9f4
SSDEEP 768:rZQNb2vIYymJ22Mss+5dQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxb:rSb2vLbdQ+ZDgcEST3p4JjrjaeFSUyaf
TLSH
T1B4034C4083ECC517E6EB2FB8A874916107BABEC37DA1D7A91C88B1DA0C737D055153AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2Loader.dll
Size 160KB
SHA256 239a9d6614a6cfade62b47cdb0be36e3069eedc438c3e0647a9e7b7c84ef6ea0
MD5 cce1332e0af440bc54fdf04eb543d4a0
SHA1 c7f6c049ff3eee4ed337a98d3163fbb5c4686ff7
SHA512 3484febcb142beac708faa1775699450ff22f5ce13b7e90da4d6d27ac9bbedd1c2477dc33125cbcce00fc7d59d416588300fa7b3c1c607bda0d1e874cb0425a9
SSDEEP 3072:qjAuqhU/3A5evuBdyoioiVO7kKlU9tKTTnhTEtJI8w6lKIc:36642lioiVOAqnpEtJs6W
TLSH
T1ADF35C57B3E500BBE1B7C27885A74A46EB7678111B609AEF0364433A1F237D0AE3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 45a840c12e00f31e21d40fdf228a9d49e83c3a39a0b3461427c43acee3bfc3db
MD5 768b923add635fa23e99701e5e3a9a53
SHA1 6b39b47bfb864a90c65524ab85b828c04f9ceb81
SHA512 aa4de7c313647ac40b7ae5eef80e8f0258141b9fb3b1a5c73e9473d853356d1a9e70b0d9f027b3bbdd15494dd7bc5036480f73e3e6c39d67554cd401d04b2f0f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 48b2b8ac14f46af455176a9856eb114570d7e429cef58af52cd10ddd35f22dce
MD5 1a33323a5ac49bd30f9b5b94f93be152
SHA1 f7ed1521478ba1d304319809a1a5b3f82505aa07
SHA512 a83cac8687ef4595216ca4b5f74f8badf559067c1c91e805853c33045ddc3b1f16342a63f460eeeb0aefbd6fbabc7f9826faf15134ad8b6cb013bd523a93ee52
TLSH
T1A3D0122232810138C0103033100365881A40C10B401A42085438F65D1E080580D12485
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 93563ebd12f5e2c540119fb68ab4eb83ebf87c45d8cea3c417a4d62facf1b25b
MD5 6712ceaa15fb7bfeff8fb2f61da7091f
SHA1 42dada23298c6ff1a9f09995ff7100b94e6a02a5
SHA512 b7a4605723963ae5696300bb730dceb8fc7699b2dbf301be3ae4383112cad863213e6486c8a51f6bda70192648e9efc1c0da7210fe1b20d07a83471bbdd0dc11
TLSH
T1CD217695BE1AC446E79149B820DF8C1BF0338017EBF37C62344DDAB46A12F66422B941
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c049.TMP

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c049.TMP
Size 48B
SHA256 b6113af3476f2f79289537c5ceb7c831a6287ca79439ed66d76034ecdb50488c
MD5 3d654470b23e67f250ebf02a5119a9e5
SHA1 442a9eef1d994fca80351161f04f85685d8f34ac
SHA512 36a2307f82ef4a17a2dba1ed9cd726f361c5813c285273f01b880eb3daf7e79fd748769915b8fdd5742a47f74de2dbe9c7e271d09b0118ea0de9b1ff7955ecd6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 17c6e462792c28d5a8e231638324d1391f2cddebaa4a222d42b27b097b1ee2a8
MD5 e56ad2624b1de983662324e3c0c60f92
SHA1 04c32439afc01fd7f8f49e8b18379356bfe2fa2a
SHA512 6e64cec1cee6a6054dacfc86684eb8661de8658c062d6536e7c1d3684d45fee77a28e8b7bf7da2f8647d23de6a430c79f792218dd9dd9bd0792d975dcce93779
TLSH
T1C4517BB7D3F4472C991382F426363D26DE5E45A483287D6AC4D8DB8FA3F1460E26160E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a6d23.TMP

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a6d23.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 363825fea3fd5bed42e83a33ead5ddf57531664df85f10d78977242be3eaded4
MD5 18214504daf287bba7418ecb3c371777
SHA1 270e1274eec5a7aa9735b9a210723ea351af24da
SHA512 fbd4171b777769326165dd4662af1508667c8b2ed7e687a90db1478bc46b45669257d08b5fbe4a04a3d827cd3e238b98c23123f775a9966b0e4412b3cd83c2ce
SSDEEP 96:stm/d16EMlb9/kMJo5h16Z+7s7/x+6MhmuecEcC1eHUeiK+gK28XM1C7K:stef6NDJor7sV+FwcCQHUGkG6K
TLSH
T1F0D1B6025E28BD7B8CC6F209BE69BA17D2F6517278D11E58EBF8462C04E75DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 47cf17d768da1f53451e208f859e1f11b4e711f8d8591c069c8d289c10e3bc9d
MD5 7849bbee7767b00b1ff0237e5166bd68
SHA1 d9b20635c59ac32bb8c0398ddc1bba862bc826fe
SHA512 cd2ff5da6b6900e31e6b37656c3c47aaaddb60967da8a7bc038aa4a683f6d4b7c5cde859ec37fbd736c6656159d9c1954bb1256ec7745f7fc78be86354d603c1
SSDEEP 96:stm/d16EDGlb9/kMJo5h16Z+7s7/x+6MhmuecEcC1eHUeiK+gHFp28XM1C7K:stef6LDJor7sV+FwcCQHUGZFpG6K
TLSH
T1EDD1A6025A287D7B8CC6F219BE697B13E2F6507279D11E58EBFC462C04E75DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59a4e1.TMP

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Preferences~RFe59a4e1.TMP
Size 6KB
SHA256 b6daeb3053fd30b9ee6903d7b712e5cbf97b71cf57b6361a96aed222161c06ff
MD5 6a98921e09e16c4f8c24414fe4d2f3d5
SHA1 694ff30aed7c9123ac56198e94f806631ef1cb89
SHA512 30fc8b3ea7c7b87294382ba1cb56d6da9fb2e2558e3220d33e6798aec484a2906d37d1fa71c68a7506a229e488d64572bb20419ab8e571b74d4053d77465c93d
SSDEEP 96:rm/d16EMlb9/kMVdo616Z+7s7/x+6MhmuecEcC1eHUeiK+gK28XM1C7K:ref6NDPoI7sV+FwcCQHUGkG6K
TLSH
T12FD1B7025A28BD7F8CC6F209BA797A17D2F6517279D11E58E7F8462C04EB5DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State
Size 3KB
SHA256 bf6b6c07bc2596defe6dd8424c2a51bf55020e5620510000b0bc86eef2264f81
MD5 7ee111e27c23aec244d29db8b0c5c14b
SHA1 607440e425f2e26b7a0f8668d16b4aa9dddb4290
SHA512 85a6ef29d84d98be44cbf3fa5c530e3bc6d3a27686ed722384dd6d7ffdca8159c8924741e4d17e9f94d1517eb9ddc1921f13194301cf4cb42f27112d1f5fb43a
TLSH
T1BD719323A974AA278DF2E6057C873B03ABA54123E9853F99DAED0F0C02D72CD1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State
Size 2KB
SHA256 f7dedb4f19f8357be1fedc5e68e6a52a8e0efe5d806f137e78f7442eb4badecd
MD5 a9ff6fad3043975d3338f52f8eb9663f
SHA1 d714ccc37956bde3e73b5546e0ca9a04e0cd1a23
SHA512 ac8c7d6ba185b69dc57f8289b4da2fd9a108fb9612afe238c81e99d95795cc5d7df5fd808e40035a709195b3aeaaa6307ac296451321df080c9ab1e29472ebc9
TLSH
T18A518773B8249B37C9E2A7057D4B3F139E764166AE521F11A6DE0B1C01D669D2307C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State
Size 3KB
SHA256 0620962c9814a42c2f884e422c22194cb86bcbe46a928583d08a4f61a50d75ee
MD5 1732a714c312515b761e32982a29a3bc
SHA1 15db47956c741b999f8951e91df1ac3182d3e346
SHA512 14c00d2a600ab4ae26fa3889765069d537cc929bfa808770d8baaf640c1062496c81fe03dd364a92055ea5349540d085397fa07f2c7388597474e5563a8e5c61
TLSH
T1AA618333B974EA2B8DE2EA057C872B16A7A54127E9913F55D6ED0F0C01D72CC2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State
Size 15KB
SHA256 3147d185aa56d092e1b1bda78fe02df11e4a56b2c9a3810bc78bef3d1b0f6e3b
MD5 0038bc26edf2cdd83574b2c607e76ff6
SHA1 afd94e867615ce53958cb3a8ddffbd98769f4ad3
SHA512 cc5ae745a886af6f9e35668f0e80f4de4d6f249e4d24001b8e2594fab5615ab1a8c509f5811472eeb1cfac39393c883388c15367009c677bac884aefd304108c
SSDEEP 384:L+aQikB+z/xvxjg/qhEwNBSC4ZBWf+9zp:q/UxvxjgC+XDy+Fp
TLSH
T1D9729D2BA579BE23D5F3F6007D491B4BCBB894B295826EB84ABD5F0906C73D81306C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594944.TMP

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State~RFe594944.TMP
Size 1KB
SHA256 d1d05df9fa52bc35b8db0c1cdee175a2e9df95f93806f5fb833e1d63ee23de0a
MD5 c972c1a9764af0f17cb0f23dff1f6db0
SHA1 4d2c0ad2cce66db22b5f6bd08e4c3f0e7ebd1ccd
SHA512 99aabec0b947327c2703be79894b84056c73c25d9b56ea563fa238bb8d87b8ee6d0804a1dff20755b46484daff657d455a6ba535ea7c66fbba1e0fe42fdc92a8
TLSH
T1822140B3F4648B23E8D1B3063657BB1B6E22406B96204E0562DE4B1D12E518DB62FC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-515-0x0000013A3ECA0000-0x0000013A3ECA1000-memory.dmp

Download

memory/240-521-0x0000013A3ECA0000-0x0000013A3ECA1000-memory.dmp

Download

memory/240-523-0x0000013A3ECA0000-0x0000013A3ECA1000-memory.dmp

Download

memory/240-524-0x0000013A3ECA0000-0x0000013A3ECA1000-memory.dmp

Download

memory/240-525-0x0000013A3ECA0000-0x0000013A3ECA1000-memory.dmp

Download

memory/240-517-0x0000013A3ECA0000-0x0000013A3ECA1000-memory.dmp

Download

memory/240-522-0x0000013A3ECA0000-0x0000013A3ECA1000-memory.dmp

Download

memory/240-526-0x0000013A3ECA0000-0x0000013A3ECA1000-memory.dmp

Download

memory/1224-196-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-18-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-28-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-389-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-394-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-17-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-16-0x000000001ADC0000-0x000000001AE6E000-memory.dmp

Download

memory/1224-19-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-14-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-8-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-7-0x00000000021D0000-0x00000000021DE000-memory.dmp

Download

memory/1224-5-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-0-0x00007FFA7686F000-0x00007FFA76870000-memory.dmp

Download

memory/1224-1-0x0000000000010000-0x0000000000124000-memory.dmp

Download

memory/1224-20-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-21-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-22-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/1224-29-0x00007FFA766E0000-0x00007FFA77084000-memory.dmp

Download

memory/2420-388-0x00000201290E0000-0x0000020129154000-memory.dmp

Download

memory/2420-118-0x00007FFA98E90000-0x00007FFA98E91000-memory.dmp

Download

memory/2800-467-0x00007FFA98620000-0x00007FFA98621000-memory.dmp

Download

memory/2800-466-0x00007FFA98450000-0x00007FFA98451000-memory.dmp

Download

memory/5380-109-0x00007FFA98E90000-0x00007FFA98E91000-memory.dmp

Download