c52dbcdee795b310d80e88dd7bf52eb375aa9b1ca90e070b58199d31512669b6

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 23.9MB
Sample260714-eptppadz4r
SHA256 c52dbcdee795b310d80e88dd7bf52eb375aa9b1ca90e070b58199d31512669b6
MD5 3d362cf23972d3fe92d5e4ddf1a5ac2d
SHA1 7aeb86f7fbb0ba25c804c01d4a5389cdae36b645
SHA512 963f18ff50281db18fa8115e723cf49db360556f1deabd621daa6e5e9fd712061f892f10b91d94ac2cd5522c6c6a2592665e433db56306bdf7d2bdb0b6a35682
SSDEEP 393216:LXhQpt7UFVxZYI10X+crgbI9ArucUYu+D:Dhfzt1p7bAXv+D
TLSH
T19747AE03F6A184E8D06EC1B4931AD733EB72BC9D4924B26B5BD45B213F2AF506B1C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com
10	raw.githubusercontent.com
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2121880858\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2073511668\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2073511668\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2073511668\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2121880858\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2073511668\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2073511668\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2121880858\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2073511668\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2073511668\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2121880858\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2121880858\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2073511668\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2073511668\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2121880858\_metadata\verified_contents.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3216	msedgewebview2.exe
3216	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4844	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5512	2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5512 wrote to memory of 4844	5512	2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	87
PID 4844 wrote to memory of 1096	4844	msedgewebview2.exe	88
PID 4844 wrote to memory of 2952	4844	msedgewebview2.exe	89
PID 4844 wrote to memory of 2952	4844	msedgewebview2.exe	89
PID 4844 wrote to memory of 2952	4844	msedgewebview2.exe	89
PID 4844 wrote to memory of 2952	4844	msedgewebview2.exe	89
PID 4844 wrote to memory of 5036	4844	msedgewebview2.exe	90
PID 4844 wrote to memory of 4532	4844	msedgewebview2.exe	91
PID 4844 wrote to memory of 4532	4844	msedgewebview2.exe	91
PID 4844 wrote to memory of 4532	4844	msedgewebview2.exe	91
PID 4844 wrote to memory of 1448	4844	msedgewebview2.exe	92
PID 4844 wrote to memory of 1448	4844	msedgewebview2.exe	92
PID 4844 wrote to memory of 1448	4844	msedgewebview2.exe	92
PID 4844 wrote to memory of 1448	4844	msedgewebview2.exe	92
PID 4844 wrote to memory of 1448	4844	msedgewebview2.exe	92
PID 4844 wrote to memory of 4312	4844	msedgewebview2.exe	96
PID 4844 wrote to memory of 4312	4844	msedgewebview2.exe	96
PID 4844 wrote to memory of 4312	4844	msedgewebview2.exe	96
PID 4844 wrote to memory of 1604	4844	msedgewebview2.exe	97
PID 4844 wrote to memory of 1604	4844	msedgewebview2.exe	97
PID 4844 wrote to memory of 1604	4844	msedgewebview2.exe	97
PID 4844 wrote to memory of 3216	4844	msedgewebview2.exe	98
PID 4844 wrote to memory of 5556	4844	msedgewebview2.exe	99
PID 4844 wrote to memory of 5556	4844	msedgewebview2.exe	99
PID 4844 wrote to memory of 5556	4844	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.1.6 --user-data-dir="C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5512.3344.179349675824578274 /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView /prefetch:4 /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8c9625fd8,0x7ff8c9625fe4,0x7ff8c9625ff0
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView" --webview-exe-name=2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1448,i,13525023830350046432,15679089301004072969,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView" --webview-exe-name=2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2152 --field-trial-handle=1448,i,13525023830350046432,15679089301004072969,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView" --webview-exe-name=2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1448,i,13525023830350046432,15679089301004072969,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView" --webview-exe-name=2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1448,i,13525023830350046432,15679089301004072969,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView" --webview-exe-name=2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=1448,i,13525023830350046432,15679089301004072969,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView" --webview-exe-name=2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4508 --field-trial-handle=1448,i,13525023830350046432,15679089301004072969,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView" --webview-exe-name=2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4464 --field-trial-handle=1448,i,13525023830350046432,15679089301004072969,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView" --webview-exe-name=2026-07-14_3d362cf23972d3fe92d5e4ddf1a5ac2d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=1448,i,13525023830350046432,15679089301004072969,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:e53d6f7c43d8a67b870a483a1e9584c7a1f58876
    3⤵
    PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ce994818b63719e7b50eb42a45c1f68bcba20ceef541c50da8a4b85e67710a81
MD5 fe3f630e193e830bb0cc85438d06d931
SHA1 05b72914a939c9773ff811a1dc1288a61f96d9a5
SHA512 68cf3b2fc7eaa8a529ac843716a771cf13397af5cf00e6041e96930820f4d7c918b29aa96865a655f15a00f6060c3e507f9772db3cbe700e338728a18abd80d0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 29d2820b18f7d58730e79bf279002ddd0fd9ed5d39456fc7e40d36082b586308
MD5 b42614b87d9abca719352cc03af97be7
SHA1 7ba21747dcb6f0d8df98efc420b03976a51cee4a
SHA512 2063cc6909d4f87fa03fb2d09fcb3a0fa0a4a5b96556724d057e23a1f12bb5a2347c069587fd55e639fa558b7cc821e47c99e0e99ef612a05317ae0af5526def
TLSH
T1A6D0121233024234C0102073148271080741C93F44068140953DC91D1F14170290A442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 168B
SHA256 3d6c35fdd61efd4a8d671be147e9d9189d46bcd5cbdd7a3f4880b50c752fa9e7
MD5 122eb67c90e93a52e849a3996376f577
SHA1 4efb3ee37e3efd053f46f58018c71fa0c7055cec
SHA512 3b3e64a5a11559238f1f2c84a6ed393effc90d777333628b61e779dd91645c8a6cf3223b78375cf96819ce104cfec4eefb40df1f30661401be30993f79a3ce3a
TLSH
T110C09282BB1E0409C30101B43FC539263DF38CF7606F0F8129D89BB0B0C5381D586700
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 993c4be3a9e4d770fec137a063ce11f55b2a794e4a48622550cca1d1ddaecb49
MD5 26415e995aa9814f39613bb35185fa33
SHA1 13b91918b5bc08d69bf41bdb722937b9bc84c3f0
SHA512 74e745e9e2373d8cc1babcff4dcf035d2ec4a0e738c612a8201ca5043bafb01525b261ce9306f49b03bbec52ec1736cf0c232abd9d058dcb109ea7d109096c3b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Network\Network Persistent State
Size 249B
SHA256 15953151625dcc71c8eed52c6bf1311bb0c3bda145127e131567f87e720283a0
MD5 2e035a156dc3d8d8a01e03bb6b60c424
SHA1 765bc7c422d83c104116c6e2910483b51434042c
SHA512 7685cef8c2435f8b7b832afd9ff8c4621a36a59d3ea0d035df0e52409b1991ea077839e1e99a890732c795d41de4b2112e90cffe927facbcde14dc9e3bceff12
TLSH
T182D095B251709DFE074183D016347857C97D0002931CCD7BCA74B77843D2079D020907
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a3c4f.TMP

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Network\Network Persistent State~RFe5a3c4f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Preferences
Size 6KB
SHA256 e74f82b9145aa822c3007aeab829afa770c7ac194c05d6699fa92cd81d0ad2b5
MD5 0c2131c4151b86ae3db519973b7aaf25
SHA1 c92414e070f4dbdca567d883b7b2e7bbbc903f8b
SHA512 b29c9f4779ddc342920d6312218a58f95987d79a47d1d342a83ca808d08e87593b3416de8805cdfb37618ce8b77dd64a5372e5c0a01538d5ee690aeab15e2b05
SSDEEP 96:stx/d9Rrmb99kio5h16Z0Zs7/x+6MhmuecJ7Q1ejeZK+gP+mRt28XM1C7K:stlv4ZonZsV+Fd7QQjn1RtG6K
TLSH
T11ED1A5025E24697B4CC6F109BA29BA43E2F9607275D12E58EBF8861C04EA6CC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Preferences
Size 6KB
SHA256 442b9fa4a4f9eed0b36874f66d15fc55dd8aa88e6a0355393020dbe111734849
MD5 ed3c24cbf317ca9847c08e3ad42e01c4
SHA1 3c2992519e9a604dc08586a0287a2665382e34d7
SHA512 8ea1e02c955a5228b5a76422dbb6f806001ed34e220a45eb018d7578e27d890815e11c4919c76d548c42848763030c85e91b9e47a263bc4696e94173e840aed6
SSDEEP 96:stx/d9R6Gmb99kio5h16Z0Zs7/x+6MhmuecJ7Q1ejeZK+gM81mRt28XM1C7K:stlv+ZonZsV+Fd7QQjnsRtG6K
TLSH
T1CCD1B6025E24697B4CC6F109BA29BB53E2F9607275912E5CE7FC861C04EB6DC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59718c.TMP

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Preferences~RFe59718c.TMP
Size 6KB
SHA256 113eb716e88cb168a7037c4f88aa155ce14afebdb0578e9804e9955bd231a660
MD5 32f408ce83f368cc494e83265f41e61d
SHA1 d723c5662920b782e1a09c77ba1dc5d917174101
SHA512 82afd07b82e2afcc6148176af09c89810f13d6014553b02c5c54e727da763559503e32b0ba1dd29e5ef8e1326f4a670c29005acde3e11abc80fcef5b7ba3b6b3
SSDEEP 96:rx/d9Rrmb99kMdo5h16Z0Zs7/x+6MhmuecJ7Q1ejeZK+gP+mRt28XM1C7K:rlv4/onZsV+Fd7QQjn1RtG6K
TLSH
T10FD1B6025E24797B4CC6F109BA35BA43E2F9503275D52E5CE7F8865C04EA6CC231BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Local State
Size 15KB
SHA256 433343721bb7a562a1e6bb4199b18a12a83873edbc36527f9b3faf9b396d3b88
MD5 ba1dc670d27edc825a59c72700f8a5c1
SHA1 1f5731c06b9828519fdd8347d30b011dc2fe0f6c
SHA512 0028258e59175004955111e5ecb2a3d72e7dd185ae56c2144b07d234a8b720d425eb29124e99138c3ce83b049552c533818ebe13d85d9a0412e3cc152ce85d85
SSDEEP 384:Rsrv+89zHqlDNP9oidvNBSwQ5ppkisd4YeNZ:+rv+4UNbdgrpkis+RNZ
TLSH
T11C72BF33A83CA6339DF28905F44A7B177B7C91E7A1C25FA8DA995B8C419B0D92307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Local State
Size 2KB
SHA256 ecadd94a3e6e6f63564941508dcfbcb7b56577c30a8d3f44ad1f3bab7d62052b
MD5 32f06313fb89da52f2333d1d0c2e3cf5
SHA1 26d1fd5412627f147f2108a3a7bc1fb96066c42c
SHA512 a72fd4555cf06d54562eb665a0a126c6ae450cccb57ddd838958926a3077882d570adf46c4c7b239db10bfe8d449df805e2f1f8cb91e24d5d30e8f3673332af2
TLSH
T1FE5195336C50567789E28709B94A7F63EB7A82A5BA522F19AADD1B0800D751C1347C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Local State
Size 3KB
SHA256 a6fa69b73d4257f80f54ec54fa8b9738d5b80786a7f27de135f8bd59a2577764
MD5 5b23bb5a160d62b5068252aaef7bfb51
SHA1 19bd0f6693cf003319e1b080aeee80186fe24b0f
SHA512 a6e5d0d21b84365c0094010d98b318c44d8f2452ea25d89fdc42f4c878a2d0df851b4b42a3de985e57559d8c3536b9ddcf0c09c4abc8c338e0fcd983c43f1c28
TLSH
T17171833B6CA099774DE29A05B8893F56F7A64177E9917F69DAEC0F0C01D72981343C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Local State
Size 4KB
SHA256 73094674cef9d8f6ee335f5312b9345a36f9569aa50f3a4e14b98de2b077d461
MD5 b139600fbca7b787aa25c0ccfa5f08b5
SHA1 1ae1bbe2272206f6fb2d461bb6af3d1dfd632dbc
SHA512 2b7e9e99800fbc14c244e90d7d7309c42bbe1a673779186ee6b78c0d55317b2a1e31f72eb307920199d98b5a135f114e621060615eeb02815779caf32cf85dba
SSDEEP 96:ONkGSCVf+zCAoL8kh/cI9URoDoto+5lBzBr9e6or2ZDZ3tT1JVa:ONBShGeoDUhTtr9Z3pI
TLSH
T18181843668A4A9778DF29A09B8493F57F7A54177A5817FADDAEC0F0C01D72881343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe592244.TMP

Path C:\Users\Admin\AppData\Local\org.polyfrost.oneclient\EBWebView\Local State~RFe592244.TMP
Size 1KB
SHA256 4a3ed44e3d90956d8f95d9a3c248d4136da697482e8ba21a7dc11dc95cba58c0
MD5 69ca74e97eb4954ea967e8d93044e469
SHA1 f004142591537d05dea82c80658efa5dd8a49caf
SHA512 c3508b5935a2eedb5215d05e053ce1121fbc2267e489feaa28bc73de8186435c542b42f953ae21761915c6d257ce5e7183fbe0eda4d6e3d7ddfda9e66fac06d3
TLSH
T1FE3194B39C900A73ACD25706711ABFE7BF7141BAA6515F0839CE870805EB00C576BA32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_170143795\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1448-137-0x00007FF8E9C00000-0x00007FF8E9C01000-memory.dmp

Download

memory/2952-61-0x00007FF8E9C00000-0x00007FF8E9C01000-memory.dmp

Download

memory/3216-448-0x0000017E29FE0000-0x0000017E29FE1000-memory.dmp

Download

memory/3216-449-0x0000017E29FE0000-0x0000017E29FE1000-memory.dmp

Download

memory/3216-444-0x0000017E29FE0000-0x0000017E29FE1000-memory.dmp

Download

memory/3216-447-0x0000017E29FE0000-0x0000017E29FE1000-memory.dmp

Download

memory/3216-446-0x0000017E29FE0000-0x0000017E29FE1000-memory.dmp

Download

memory/3216-445-0x0000017E29FE0000-0x0000017E29FE1000-memory.dmp

Download

memory/3216-438-0x0000017E29FE0000-0x0000017E29FE1000-memory.dmp

Download

memory/3216-440-0x0000017E29FE0000-0x0000017E29FE1000-memory.dmp

Download

memory/4312-372-0x00007FF8EA140000-0x00007FF8EA141000-memory.dmp

Download

memory/4312-371-0x00007FF8E9F70000-0x00007FF8E9F71000-memory.dmp

Download