55a7122a1b1723c71bd4d964c6442fd54ad4c881d7f44c5b20c1e57726c699b5

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe
Size 12.5MB
Sample260504-pncd5abv31
SHA256 55a7122a1b1723c71bd4d964c6442fd54ad4c881d7f44c5b20c1e57726c699b5
MD5 548fedde849b38206bdff3639968339b
SHA1 3d2a3aac996b5c910f6edc3125fbc75d9cd66d66
SHA512 810d5fc813ac06d49aeb67319848bd02a5c7a89893d65e0ff8fd55eb66cb95439ddbbc749ec12356bb8778fc5afaf7f8b77bb18ee07b1e519343645a34ceb754
SSDEEP 98304:3UNudpRhxVUpHn7GHP5ISjMRzq78ZBDmoZi6mmernPK/cMm89LnyDE52s6vGHJiX:kqUpw8zGma8NMFsJxBhB6VFZ5wGCi
TLSH
T1BCD65A43F76281E8C169C474C31A6232FA32BC8947357AEB5BE04B213E95FD06A3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 61 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1208063759\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1208063759\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1371056225\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1371056225\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1371056225\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1208063759\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1451107274\hyph-la.hyb	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223721339846488"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4000	msedgewebview2.exe
4000	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4944	msedgewebview2.exe
4944	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4748	2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe
4748	2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4944	4748	2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe	84
PID 4944 wrote to memory of 4608	4944	msedgewebview2.exe	85
PID 4944 wrote to memory of 2408	4944	msedgewebview2.exe	86
PID 4944 wrote to memory of 2408	4944	msedgewebview2.exe	86
PID 4944 wrote to memory of 2408	4944	msedgewebview2.exe	86
PID 4944 wrote to memory of 3716	4944	msedgewebview2.exe	87
PID 4944 wrote to memory of 3364	4944	msedgewebview2.exe	88
PID 4944 wrote to memory of 3364	4944	msedgewebview2.exe	88
PID 4944 wrote to memory of 5740	4944	msedgewebview2.exe	89
PID 4944 wrote to memory of 5740	4944	msedgewebview2.exe	89
PID 4944 wrote to memory of 5740	4944	msedgewebview2.exe	89
PID 4944 wrote to memory of 3164	4944	msedgewebview2.exe	90
PID 4944 wrote to memory of 3164	4944	msedgewebview2.exe	90
PID 4944 wrote to memory of 3164	4944	msedgewebview2.exe	90
PID 4944 wrote to memory of 4080	4944	msedgewebview2.exe	103
PID 4944 wrote to memory of 4080	4944	msedgewebview2.exe	103
PID 4944 wrote to memory of 2280	4944	msedgewebview2.exe	104
PID 4944 wrote to memory of 2280	4944	msedgewebview2.exe	104
PID 4944 wrote to memory of 4000	4944	msedgewebview2.exe	105
PID 4944 wrote to memory of 2720	4944	msedgewebview2.exe	106
PID 4944 wrote to memory of 2720	4944	msedgewebview2.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4748.4776.17268025064466352496
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffd2748b078,0x7ffd2748b084,0x7ffd2748b090
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1728,i,16430407850970205638,5869062111957656383,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,16430407850970205638,5869062111957656383,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2360,i,16430407850970205638,5869062111957656383,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,16430407850970205638,5869062111957656383,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3796,i,16430407850970205638,5869062111957656383,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1220,i,16430407850970205638,5869062111957656383,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4624,i,16430407850970205638,5869062111957656383,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:8
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4828,i,16430407850970205638,5869062111957656383,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView" --webview-exe-name=2026-05-04_548fedde849b38206bdff3639968339b_akira_cobalt-strike_glassworm_megazord_rusty-stealer_satacom.exe --webview-exe-version=1.0.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4452,i,16430407850970205638,5869062111957656383,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
    3⤵
    PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1208063759\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1371056225\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4944_1371056225\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

7a5d4860-10b3-4084-8ddf-58ab29d150e3.tmp

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\7a5d4860-10b3-4084-8ddf-58ab29d150e3.tmp
Size 1KB
SHA256 17f1763a7017a98f93be3ea99a499d4167ec2b4ac39cbea38c8054df54994475
MD5 ecace995240a9f4690dbf50b6687be7a
SHA1 2164a6d4f0c7cd295743fb52e0293171d082f222
SHA512 27b32e1fa38039b75c96c7e9e092567e763ad62591490ed6a3e0dd44e5ef10068ff25eca64d2c95648b7108a242b12a106a0defa343cd6981cf8a9429ca95733
TLSH
T151316573B4E49B725C815695B382AB432E66007683750F4992DD4B5C01DFE9CA637D33
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9bcb16e4eb2d92faab9745c088b5948621a51cf7793389e5811b6e4e9ef42ebd
MD5 81a0f7425d1ea6eb6d7f68b1a130a94d
SHA1 08d3307dc7fc87389da117405e66ad5053d759ff
SHA512 a98b3ab39a2146ccc0d583d2e378517fd6879eaab91aa4d1d93063177db2884a5d76e94a2e68481dae059eaefdb5f2856372add2187405332444b073564c2bf0
TLSH
T1A9D0122F36010134C4103033000276091841C21B80094040542A861F5A441A41E4B481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4c8b579968cfc5b1eec9b8cb363a3b1616a9ad76c3994abbd48d5d38084f0d75
MD5 8f8a2c0fb140cf6244f9cd42c221cd46
SHA1 d0c58569369065448a09a2c9ea6438af2d9f5722
SHA512 0b4a055ff33ba5b84fe001dca0e8b28c028d0ef81067ceb67592040b17068d718fc41b90d84549831d8b82b671c3c4e83779c86bb0c4cd9b073dd9586ac1bf04
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 75b7bc13c41ba1a9156e3687d4bc4820f04fa3b3eaff2254638f004bac2413f9
MD5 37deacdd03cea8fc0162e889f5046433
SHA1 974d8d803d0e0327cd45af6c32260afed0ad63c0
SHA512 3b815a2a49aec6955ad70353518439b2c3938c6d386da8c0b2ce5cb54ff7a5807596fe84e667d2653f0410e831ef3a6497d1f9810fdd6dccb4d6c1898f1e9c4d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 3be11ac04a5e81c8206c89119858b8dae1ea0a2a22ebf7a2a13e965d032b80e7
MD5 45ae0457510613662115326ebcf65224
SHA1 11ddd48af394835508154ed4e6139c37aebfe6c8
SHA512 1ed4484a0ebe2884a79d627be3beea4a06d0d1749b65a977990b8750cd56bbe9e21842ba509d5cc856aeb83e02c88b826d8fa80ba9453b891019ff9857df581e
TLSH
T167B001B88C841927E26253B969C700B87E325AA902132A0241A40FB9A62DB888282645
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 a2d30a38ab505dba80c2802d8c06f287d2e5fa20d912f175269b36985cbdb636
MD5 3ff681cdf917a7e4419782bd319b664d
SHA1 01f06e528e2738353aa49786af31c939aca2da11
SHA512 4d2a51f205f00bec6f18ed6b3142301d617845a7c9fbbfefa2c13418a2375fb5fcf7aafeb07985d521c33a0b50f9777d143f2e81fe96dc01cb7d860b2829b4cf
TLSH
T1A1018EA2C3D4C67D8A5116E027347C13CD2E052993283D27DDE9EBDA5BE1471D210A0F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe593c63.TMP

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\Network\Network Persistent State~RFe593c63.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 0fddeebe80623efedd3a2b52577b2c5c91fef1fa75afb5934b6244cbd4a9ce29
MD5 6d659026c038635c89a5bad7178b9543
SHA1 8b0760f6d98f261cbec2e9174469c124c5be160a
SHA512 faef87082ae7d181b8b30fd9b21b4e55a3d786c4baa7f4da320c7d47e05687d018019166c4c5c80629323ade617bea82cde84850e8eedb1dac3b7b0e9afe5c6e
SSDEEP 96:stp05+UTpFb9MffMNZ8i0vhE+ktim/7qx+WVHMSm+uecJBRgMk8YxQjf+gKHIMOB:stp0A9f0NZ8pal//S+WiTB2QYxGiIMC
TLSH
T16EE18703AE68697B4CC7F6197A35FF52E6FB106221D50E58EBFC860C05E66CC221790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58c213.TMP

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\Preferences~RFe58c213.TMP
Size 6KB
SHA256 e0dfd428c2b95f1f8b95f0eee04379d91738006197231d8acbbe1e2ff453e287
MD5 91714a3e7490cb5ebfc5dccf50c342a0
SHA1 68b49623eee29e4880b21d6e29d97aa90c7d1204
SHA512 f7ade0a203035f96f47ac4bdfd1b064191fafb2f7b91c065c1548dc312114e86585e5aae4e17a5c6979a13c6bd22d73d0aa84fa98eb13d718ff1c5bab06c16ed
SSDEEP 96:stp05+UTpFb9rffMNZ8i0vhE+ktim/7qx+WVHMSm+uecJBRgMk8YxQjf+gHXIMEB:stp0ASf0NZ8pal//S+WiTB2QYxG9IM8
TLSH
T10CD1A803AF68A97B4CC7E6197A35FB52D6FB106222D50E58EBFC861C05D66CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Local State
Size 2KB
SHA256 9f585fb8b71cfec7b8fa515bbec3c92c76ee3e7a8ef6728051015ac5e1788e01
MD5 b5ce8f8854476f9713863655836fe1f7
SHA1 fa23bd1c42f9b9bc69b45ca3d0f1fa61113f646c
SHA512 20a20b2255b14842d02eace777817cd3a7667430c4a21cbff46b2d873cc6e92354f5febf6902269cbdc0982f9a615616fd1c048b0e2a0519ab7134ba829b5277
TLSH
T142519373B8589A3389D28B54BA8AAF135E7B506187B62F559ADD0B0C01DFA5C2312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Local State
Size 16KB
SHA256 f06836467ef2a8cac2cc0c9bb8ed3cc9a3637ca42491829d567d37fb40d972a6
MD5 faa50ed1eee1be76afb7a33fd64d6b6b
SHA1 bb67c3f3f8c4a220f034bfb3a3075be21f1c3e37
SHA512 928481dec66e57c886fda4c9686cda5dfddf26bdf96ef8a565fa455ad8f721d3f3bd2321c30f048a87fde8fae3d303296a1bba49ea772b264f9dd32a1decc0ae
SSDEEP 384:znfTPLdSWCUkEaV8DNYi0qnSXaqZvANbzY3A4Lu7:7TRMUVai1SKqvOg9M
TLSH
T12272AF63AC78D6671CAE9A29F61736079DBE9091C2E52F0DDDED1F0E06C66881322D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Local State
Size 3KB
SHA256 d35e532a49e23a22a52f606827a5ac95bc927118898423f8d21c0a591d121fb8
MD5 ae9eb3777560dfc61fa984bdff6775f6
SHA1 cfc9b8c8949dc2538a42da68df6a5b4439cd720b
SHA512 2a8c4a0ce006fd38e0c5d7df1bd84e75b22838c01aaf9c060c50bf1651648677abed50c7d3beae9323e1bec85f63c2071630677fc9b7009f75d6fd331893eec8
TLSH
T16071A937B464D9374DE29A44B9866B027EA64033D6A53F99D5EC0F0C01DB7982352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5822e5.TMP

Path C:\Users\Admin\AppData\Local\com.sistematizador.desktop\EBWebView\Local State~RFe5822e5.TMP
Size 1KB
SHA256 48f58b3608ba1a66f23daeecd560309a12f097c71cfad14bb1ca87bbd3d137a0
MD5 812c729494a83c793f25efd9c36a5b1a
SHA1 e7257f7b2615a50d4e97d256322d7726ab16d559
SHA512 b9b88560d6b9202a6b2514486b82e926f859d1502fbeae3a73b9931132af1920c6012d8c86e5dcc23ecf8e352f719ff64324f2fd6f31727d158b34a44e02c0a3
TLSH
T142218477E4E8AA72A8415AA5B382EB472EA1407683741F0D91CD075C02DFEAC9737C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2408-25-0x00007FFD413A0000-0x00007FFD413A1000-memory.dmp

Download

memory/3364-46-0x00007FFD43250000-0x00007FFD43251000-memory.dmp

Download

memory/3364-48-0x00007FFD421E0000-0x00007FFD421E1000-memory.dmp

Download

memory/4000-433-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4000-440-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4000-442-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4000-434-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4000-438-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4000-432-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4000-439-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4000-444-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4000-443-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4000-441-0x000001E7CE270000-0x000001E7CE271000-memory.dmp

Download

memory/4944-227-0x00000287A4FF0000-0x00000287A502B000-memory.dmp

Download

memory/4944-224-0x00000287A44F0000-0x00000287A451C000-memory.dmp

Download

memory/4944-226-0x00000287A4FC0000-0x00000287A4FE7000-memory.dmp

Download

memory/4944-225-0x00000287A23F0000-0x00000287A23FC000-memory.dmp

Download

memory/5740-117-0x00007FFD413A0000-0x00007FFD413A1000-memory.dmp

Download