fb2489abcd9c829e361f2bedadf40e767e0c87144efc2f7f91125394787475bf

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 18.0MB
Sample260721-23rhtaaq21
SHA256 fb2489abcd9c829e361f2bedadf40e767e0c87144efc2f7f91125394787475bf
MD5 6a2723f3f1ce5e59632b62a45ce48167
SHA1 1ecb837dcb8aab83cc855c97ecdc5b7b31d848f9
SHA512 3a74a436ae1f7bf537e4a4170501961c5c13367d3e43b62178f997a14c175f2d737f1e6626c174ae14f4e54c23ed55e5784791a10402d6361ec3f8d1d2058e6b
SSDEEP 393216:VweQTzqMschntZbM81wWbytsWKRPBWM0Q:VwLTzqMschntZbM81rbytsWW
TLSH
T19C17E7257B9B996CD09BC47483478A720A7130CB0B35B9FF449596382F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
9	5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
9	5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Loads dropped DLL 1 IoCs

pid	Process
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_247013595\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_247013595\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1972324939\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_22228224\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_22228224\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1746118455\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_22228224\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1449263808\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1962639316\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_247013595\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_22228224\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_247013595\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1972324939\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_22228224\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_22228224\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_247013595\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1972324939\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5372_1962639316\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_247013595\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_247013595\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_247013595\LICENSE	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x00090000000167e7-181.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4672	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291488357449942"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{512FB311-802B-433B-A127-A0686E0E9539}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2136	msedgewebview2.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe
5372	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 2136	5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 2136 wrote to memory of 3472	2136	msedgewebview2.exe	90
PID 2136 wrote to memory of 5392	2136	msedgewebview2.exe	91
PID 2136 wrote to memory of 5392	2136	msedgewebview2.exe	91
PID 2136 wrote to memory of 5392	2136	msedgewebview2.exe	91
PID 2136 wrote to memory of 5392	2136	msedgewebview2.exe	91
PID 2136 wrote to memory of 1044	2136	msedgewebview2.exe	92
PID 2136 wrote to memory of 4484	2136	msedgewebview2.exe	93
PID 2136 wrote to memory of 4484	2136	msedgewebview2.exe	93
PID 2136 wrote to memory of 4484	2136	msedgewebview2.exe	93
PID 2136 wrote to memory of 2196	2136	msedgewebview2.exe	94
PID 2136 wrote to memory of 2196	2136	msedgewebview2.exe	94
PID 2136 wrote to memory of 2196	2136	msedgewebview2.exe	94
PID 2136 wrote to memory of 2196	2136	msedgewebview2.exe	94
PID 2136 wrote to memory of 2196	2136	msedgewebview2.exe	94
PID 5148 wrote to memory of 5372	5148	2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	95
PID 5372 wrote to memory of 4496	5372	msedge.exe	96
PID 5372 wrote to memory of 3464	5372	msedge.exe	97
PID 5372 wrote to memory of 4672	5372	msedge.exe	99
PID 5372 wrote to memory of 3464	5372	msedge.exe	97
PID 5372 wrote to memory of 3464	5372	msedge.exe	97
PID 5372 wrote to memory of 4936	5372	msedge.exe	100
PID 5372 wrote to memory of 4936	5372	msedge.exe	100
PID 5372 wrote to memory of 5152	5372	msedge.exe	101
PID 5372 wrote to memory of 2580	5372	msedge.exe	102
PID 5372 wrote to memory of 5152	5372	msedge.exe	101
PID 5372 wrote to memory of 5152	5372	msedge.exe	101
PID 5372 wrote to memory of 2580	5372	msedge.exe	102
PID 5372 wrote to memory of 2580	5372	msedge.exe	102
PID 5372 wrote to memory of 2636	5372	msedge.exe	103
PID 5372 wrote to memory of 2636	5372	msedge.exe	103
PID 5372 wrote to memory of 2636	5372	msedge.exe	103
PID 5372 wrote to memory of 2320	5372	msedge.exe	104
PID 5372 wrote to memory of 2320	5372	msedge.exe	104
PID 5372 wrote to memory of 2320	5372	msedge.exe	104
PID 5372 wrote to memory of 4412	5372	msedge.exe	106
PID 5372 wrote to memory of 4412	5372	msedge.exe	106
PID 5372 wrote to memory of 1228	5372	msedge.exe	107
PID 5372 wrote to memory of 1228	5372	msedge.exe	107
PID 5372 wrote to memory of 1228	5372	msedge.exe	107
PID 5372 wrote to memory of 1564	5372	msedge.exe	108
PID 5372 wrote to memory of 1564	5372	msedge.exe	108
PID 5372 wrote to memory of 1564	5372	msedge.exe	108
PID 5372 wrote to memory of 5204	5372	msedge.exe	110
PID 5372 wrote to memory of 3924	5372	msedge.exe	109
PID 5372 wrote to memory of 5204	5372	msedge.exe	110
PID 5372 wrote to memory of 3924	5372	msedge.exe	109
PID 5372 wrote to memory of 4812	5372	msedge.exe	112
PID 5372 wrote to memory of 4712	5372	msedge.exe	113
PID 5372 wrote to memory of 4712	5372	msedge.exe	113
PID 5372 wrote to memory of 5384	5372	msedge.exe	114
PID 5372 wrote to memory of 5384	5372	msedge.exe	114
PID 5372 wrote to memory of 2268	5372	msedge.exe	119
PID 5372 wrote to memory of 720	5372	msedge.exe	120
PID 5372 wrote to memory of 5956	5372	msedge.exe	121
PID 5372 wrote to memory of 2332	5372	msedge.exe	124
PID 5372 wrote to memory of 2332	5372	msedge.exe	124
PID 2136 wrote to memory of 4844	2136	msedgewebview2.exe	126
PID 2136 wrote to memory of 4844	2136	msedgewebview2.exe	126
PID 2136 wrote to memory of 4844	2136	msedgewebview2.exe	126
PID 5372 wrote to memory of 4572	5372	msedge.exe	127
PID 5372 wrote to memory of 4572	5372	msedge.exe	127
PID 5372 wrote to memory of 6064	5372	msedge.exe	128
PID 5372 wrote to memory of 6064	5372	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5148.3688.8396658482889446457 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd08ed5fd8,0x7ffd08ed5fe4,0x7ffd08ed5ff0
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1776,i,12999619427221797579,8183708474128940666,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2116 --field-trial-handle=1776,i,12999619427221797579,8183708474128940666,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1776,i,12999619427221797579,8183708474128940666,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3456 --field-trial-handle=1776,i,12999619427221797579,8183708474128940666,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 /prefetch:1
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=1776,i,12999619427221797579,8183708474128940666,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=1776,i,12999619427221797579,8183708474128940666,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4596 --field-trial-handle=1776,i,12999619427221797579,8183708474128940666,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4084 --field-trial-handle=1776,i,12999619427221797579,8183708474128940666,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getsolara.dev/revolt
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd05d0c188,0x7ffd05d0c194,0x7ffd05d0c1a0
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,10976630938894143985,9354936519885892871,262144 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,9467071569093743701,17074335892454084195,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,16021819691680909557,17024249917077692939,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,304649304581417082,17647892981696883378,2097152 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,1958455297775105687,10484676154627997309,2097152 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,720307286037587337,4738585278549721238,2097152 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,3124269107319932366,1127749216765139587,2097152 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,2541887240277849251,3097394787690657962,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4976,i,14562805879824880365,12179214842367295955,2097152 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5632,i,6168117205944891840,3310203542752710271,2097152 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,1843750099220309869,17795791704386242760,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,17925801084701679723,5250936682256889353,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,5260208945856752681,8384702335485259425,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,5260208945856752681,8384702335485259425,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,793815069860125536,3374784282185970451,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,1920598665532534039,4318249813716113866,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,17503470941421673090,13017691431259529246,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,3395766125489605112,14137971278924769906,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,17880061998811918031,1534381999784498588,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,17018976126151433541,17339421981168271077,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,8504517290433585141,9767209663410777712,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,14788405016299338904,6993702411131180795,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,9740378276857800276,1086726654311249136,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6120,i,17262458640077663909,4005405363608187983,262144 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:10
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,7329320402008000662,7701109475085152868,524288 --field-trial-handle=2632,i,6135461010643962971,3008125117598929486,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 42dd79c993e6529113e08e504f1df295c7d5461ceb78fa32bc77ac73648a280e
MD5 ecf602dd42595b37dde77cfa282ef5c2
SHA1 1d313b4471f383396073de02225fb91d97bc1ada
SHA512 4ec96081068542d0938c6b2b899fcef54264b0fc233911bae3b12a1cb3a14b4101368dd667a8fa180d4b37db8348840750911afd693695a2f360d51ec91bf78c
TLSH
T1DD3160708F3026FFDBAF45B657E2468C3376886B33076E6517A46EB04E85377102001E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 53981ca2dd5d83c01affc8c5d8ed5a83eb9338f4f1677ff10ce94f08cd893900
MD5 ef825f91ac4eba8269567145ec29c468
SHA1 1e52af0854fa6f1e01f1550d46fda2ada83a9be6
SHA512 9461aa3eda2a26eb5e375e0dd5b3c9e89eb6a2ac0367aa9bf70a4f7ed6edebd01f0525346d6cb74ff1b070dc0bbcf544e397a3b5ba1f0691eae5dd2d3b58bc01
TLSH
T1F671AEF3C2E8866DD91156F0AB187E2BDE5D0915432C3D6AC8E4FF1B93E2472E20165E
MD5 SHA1 SHA512 TLSH

Submit Download

d57763df-703f-4e00-91be-de38e1ea0039.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d57763df-703f-4e00-91be-de38e1ea0039.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 94974526ef9636ee242fe48c5c2c25e6dfa5e6995e5a332ef6d82d377ac191ac
MD5 f98f1eb5ed6ce8f7bf6a0f51e8e27ffd
SHA1 1b1d94f8e238f7cdaa3425c9d5785d864568356c
SHA512 66532b8e329daccedbc5a3383fee72da2ff60d9ae13d68a84ff33e68821bbeacb11126a2b536a68535a8c52f92f1e131dccaa0bee919cacc85c943d2f5c7c441
SSDEEP 192:sxRtRSNCB/f5sGOjDZhzoA8pbpQ+ogMy/g6+WN7R/9l/YoNCYK+GfIgDVJ:sxRthB/f5sGOjtcb2+sy/5lX/o7dD
TLSH
T18D42C71A69289A7B9CC7D619FA55BB53E2F91072A1D11F48BBFC8B0C10E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 52c798e1518c73b59b9231719f92730762cb08023047c0487627964e05a36646
MD5 ca73caad58970ba482defba223a0c257
SHA1 1e3c7659f377d78cf2596432e879f27d4a3e5f7d
SHA512 fd6c5ea6b13937e785d26ce06f950beb3d8faf68a33f139925332b1bf7a93024e2ba625cd9e039df55fb05926e33e6f44db3c6cd822e6eab3e0796c546731d83
SSDEEP 192:sxRaRSNCB/f5sZVDZhzoA8pbpQ+ogMy/g6+WN7R/9l/YoKCYK+GfIgtJ:sxRahB/f5sZVtcb2+sy/5lX/J7d3
TLSH
T13942C71A6D28993B9CC7D619FA55BB53D2F91072A1D12E48FBFC8B0C14EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 903eb1e86a47cc9f4fd685c3bbfba4824fd2c6d6972b34e17cebefdebcf26580
MD5 e23fa27d0a7119adf8adee4d2b925c28
SHA1 78a25722bc84cd04f884136eea7a931cb4027f06
SHA512 64d6e8f1952c3c5dd112a50671accce244aca2d5fe0ad13e96b43bbf9956b14b37fb1df2db4c27bc7a1ce1cffeb9d195672b99f26f3157c2f53e7848da06aafa
SSDEEP 192:sxRtRSNCB/f5sGVDZhzoA8pbpQ+ogMy/g6+WN7R/9l/YoKCYK+GfIgDvJ:sxRthB/f5sGVtcb2+sy/5lX/J7dF
TLSH
T13B42C71A6D289A3B9CC7D619FA55BB53D2F91072A1D11E48BBFC8B0C14E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d68a2ef1acefe2c96ab79f74255e7960c2364944b41ec8cd1308b3ab645ede63
MD5 9f678979945b84613da73e937f6ced91
SHA1 dc236e812d06331f68bac1a64cc10dc2e5bfc573
SHA512 22320506d38a96ccdfaa094024bb61b94cf545abf56bb63b03a41d084e06234c6a80e1e20415b8e341c48bc31532ac712c3dbe583dbc599a764e8fbf65be93b5
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVAiBVuwPro9sQeW:j26HRUE7MRWgs2f02u1jaDiB4wcyJk
TLSH
T1F2D2DB7B640DCBBE4F804ADDEC197E9F6D6802CB9698CD8047FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 beaad46539c1daaf80606f9a4de4fad5209525814813ead51774f29956f8314e
MD5 5c526a1af3f7f80288f317a9080c88a9
SHA1 813bc1f460e06ed69573f98eb188997e4320d460
SHA512 a7cd29928df257d0bc75a46796da78858c5ada63d85adb79a45a8c30e6b5f4f580475fade90de4f6cbce74878da89ad1974c053fb6cb5860339e274197ffb6bf
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHm7KmgIIOW4tVgGOK47g0OcOGlkWPHlyLG:C2r6WwYYZo9m22Lgkte2VUGfHm7KmgI8
TLSH
T1B191E425333B13803C7EA55D9179A42BD2C171A23218752B3BA813665F27E178DFF9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b0ced.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b0ced.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 7058b3fcc1e1160862ecb3555b0f4dd3c9874042f00982e44824204242a1ff2b
MD5 55f228265e8a4183a647d847bc07edc9
SHA1 11db71e7d637741ebceb29158879bfd412e5e36a
SHA512 a331a608e0510babff1ab239eaead35da42ddf6c381a7b624f48841f342f10f8a448648cb8c5096000e749e04d3fe6638181b522487bfd1d2ef271c2ed810c3a
SSDEEP 768:+F1j+9T32wgNv8B/psOW773njt8ONXyer1IRCzni9CMVcLCO7w/2j:79T382VSIqntHCt/2j
TLSH
T1E71328F594D38A37D8AD5787B33E2E46AABCD063B5845990BBD51E0CCC8617FC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 50c2d0c3c58bde51f6ab291c5747f21483988286c4ec5f9a5049ddb0d69ba367
MD5 d913f49d6d55482b2d4a6e67fff638aa
SHA1 055bb562be3ae9a996ac64bed6e9167992edad2c
SHA512 5e962f318c50734d5e07d9976028e366d18dbf3742526db11cebcce2bf3db72845073a75a3911be8b133f1f97d3606394a78236f43d8cb7202be4a49d9709ee1
SSDEEP 768:Dj+9h3BvYBM/TBOW773njtyONXyer1IRCzni9CMVcLCO7w/2j:G9h35NGSIqntHCt/2j
TLSH
T16EF2AE35E0969E238CE1A3D6B20337877FF964B3C5C55B54EAEA6F0E0187A1D070B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0d74e9c3ebfd952a598af2654dd87e0759654fe8934c0c1d23f4afa080adb434
MD5 3ecac3c7d58b255c259619e3d591aee8
SHA1 9afdd81b3408711ee86736f3abf50b8687448521
SHA512 f3e3bc28e2299716aa9b3e88682c27015e56c280c3b084495dfdaec51eacebe237a77097a368ab750e6c86361ea3b913333308c103916d58f021bcca3f37a0ba
SSDEEP 768:hj+9h3ovYBM/TBOW773njtyONXyer1IRCzni9CMVcLCO7w/2j:89h3CNGSIqntHCt/2j
TLSH
T154F2AE35E0969E238CE1A3D6B20337877FF964B7C5C55A54EAEA6F0E0187A1D070B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 88058e25c668cd726931ddaf5f76fc01bda961170389c54af37231170c22301c
MD5 fd2d5d154e23c55297f14c9dd285fec7
SHA1 d4537f681c1d518dd19f69a7f1f9aae945ce8ba7
SHA512 7aff31ad9df94d547fcbc9134a7a3bb966460e308a9b2dbe6359224ae3fde50f1e07f49a384908826b75465d80f91be234fb51891f15631e1bdbd572986753fc
SSDEEP 768:hrv+4UNbdz34s+/TBOW7734ONXyer1IRCzniB6eVH1SK7:hbsbV3YmSIqnhEH1l
TLSH
T19603BF36A4A89E338DE2A3C6B14777437FB85057C6840790EDEE2F4E069B49D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

909f07ee-1415-4a3f-9fbb-6b2eebe59fdd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\909f07ee-1415-4a3f-9fbb-6b2eebe59fdd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\SolaraV3\SolaraV3.dll
Size 14.2MB
SHA256 a6eec7a7d0dbfb349e24af27e83feedf4b8da515169e273172f0438229f03bac
MD5 f91ac8ca4bdfd9430a8ba05557c99cba
SHA1 8144f29d4281efe5372530e380d8016f5990169e
SHA512 d228cd41afd905a908470d6e9b57c0e4ee2433556dcd52d63361bd8d98c4ec78b37a443729e945a10fef9f080d4234055d875e71138c23624d875e1329ddfc20
SSDEEP 393216:vewwlDSy/6mfoOOQc1XP9zsmLPL5cTFCk:vedSyc3G
TLSH
T147E68DE620ED119CC46AC5BDC393A63BCA7F74290335D6E71664A6651F23EC03A7AF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 345B
SHA256 137d46b66f599c7b6d215ac786e493b382e8151e64fb53ae384578619440eea3
MD5 3fb56b53400a5b8996879db7fd33913b
SHA1 99ebe497643991405cf43ddc162cb3bd3da2ba43
SHA512 f981d29cda8afd54d2455a43cc016fd68bc1311ed89aa2a6e39ee34272b6714b26c6658d962629446ef9f6cd3624d3ce567b38142af45282c50c5ceba639e3e4
TLSH
T1E7E09A1423B8EDA2572ABD82AC780F9286C1B46615D0CC9CAB6552067614C17ADAF782
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 753B
SHA256 d0c25c520a55182396c6164bb994257e09c8fbdd0676548fc995f648b48d4da6
MD5 49f5110ec808b2e0b12ae2323f5ecf14
SHA1 5dd4e739ec94ad63ff1b9dd7aa96bfdde9d6dba0
SHA512 9d2341df27e90129a1eea3afdea1497efc34c40848622cc27ac708e02d1b1f555316ded3deccbfdcf257f0a50bc1c4a0975bff037f1753c7e2c7695b2f01cb36
TLSH
T13101921823F8BEE316197CC2AC384FD286D0F47954D0CC586B1453017A14C57DEAF796
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 1022B
SHA256 20944dde4d6aacbb0f1144bf86d28a5c01420e3e6f54d1398b815dfa36e61197
MD5 1e2aeaa8ea690b4a8d721805bc67ad34
SHA1 9f5351443cfe761bb763d338591050ffde573d36
SHA512 7502b26e5bf94343527024c313b4e276c053368ee3fdef7b9f0fa222396f2cad6c254464db960369eaa3bf5a7143e125ac66b2af93b7a4b08bd2ff257f1b5e9d
TLSH
T1EB11A71823F8BDE317297CC29C384FD286C1B43A54D0CC58AB1463017A24C57DEAFB92
MD5 SHA1 SHA512 TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 1KB
SHA256 2328438b2ff1eeb960b27d20233d82dca9028cb96ca2dd7476d5552ad33dab93
MD5 ebdb8dfac9fed923b41acef5760a7f7d
SHA1 2d4171fef1796b95c0c9be95d7b34dd14dbd88ab
SHA512 9238d099425b5e7b91606022f402783b1e3d9970faff895d66bd06c0f338c68e9fc72aed81c7ada32a1333b5474c6bb73c4c27674d99a1df5ce7331911d43742
TLSH
T1EF21C41923FC7DE31729BCC29C784ED696C1B42A59D0CC686A10A3017A28C56DEBF791
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5372_1879674201\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 03877f560607c59ae55b6e0545427f72664f0423dfa3cf45463c53771ede0d8a
MD5 722354041021cf26042de98b931245b6
SHA1 dce13464520afc3608cf81246cd0a08da85b18e7
SHA512 8735fe4d628ad2eb35419a41250353e41ab03dc8c78d8f1092e80075c4b4aa038a64d8ec45c57aa9c86cc12b1d7df21367bd78e8ebc02cada0deb4dfd6141cf1
TLSH
T134D0121232915134C0102173100361080405C21B4346500168388A1E6B040D80D12451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eeff8f3fef8f9ff7c1f1f68657b03815c30edb7885e35cf971165527384f0782
MD5 5610b7043633ad0fda43de5845c8e300
SHA1 1d1b247b9185f61b56d2e434f82ba6b5af3b071a
SHA512 b043b020d72712169e8d9e708a687eeb40b68c43960bf3a5692241cc6dc1a167044d5c8d49b22d6ffbe5992a827299f9e569f2438bc27ed5c29cc9cbad5f732d
TLSH
T1EBD0045071D07000C004517710114110410DC551075331111530050555400CD4411014
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 7f44fc3f491e38c6cfdd368ed00f0093c7d3944d19acb1b9b5aed47289b766d0
MD5 93e8a8f9010161b56df0595f33d1d730
SHA1 f49655cee99e403f216829f824398bad09c9c916
SHA512 39c7f8b4eafe06789558514263e83c4172ad1c35d2c2bbf43a66eb10d5618dc7a0d6d30fb30fc77ed05fbba81636a7def0f2b57d85d134da53c0f47ebd16be2a
TLSH
T1A8D0221282804002DB003BF10AF0EE6672B0053062033F1E484713B35315BC0B0B2014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6a06.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a6a06.TMP
Size 48B
SHA256 4b4deaa66931c549497c8e653ca2d9f4844f3ebcc150201cd833b2c20e86ee60
MD5 9e38a168b96a0899111653d1733777c6
SHA1 1492f57688bb2340d073db9347819b086a401206
SHA512 e993d80f64c36e85eb639a0dee3174f3419d610d32c45fa4e148310363d5532f6c005aacaed79eb90368b7c010d6d572f82a861f296ca0bb98724629f20616ae
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 7e598d7b4d2d4dba62df7d6aede2caeec1b2f8d3d396f7516a6b522b4848e8cd
MD5 632ed5e9e54e915528d89a1f3fee2d95
SHA1 cd86790f4633a384f8a4f9c06eb2c18ea53cecee
SHA512 3705e36bd30f3996fb2e1c77afb7cb5655e92b02548c1e29d23f99bd9e38240dfe360d67a776422e90c7fccd233b8e860cc7139ae09e97dc606fc73948d02d50
TLSH
T13531C2A683F4C67D864166E02B307817CD2D041992287D2BCDDBFBDA67D20B2E12160F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b1e33.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State~RFe5b1e33.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 1a78bd602afce2ab578af53ad2ac8bd13cf5f53ed74acb7f58e7082f763e8a28
MD5 0dd844818779658f3a11248d4ffca625
SHA1 5401b9e52830a9f17188da7b4156999568c7ecf3
SHA512 7e846601d5ccae99d36c7fe1f9d193b98030c69b36ae7053e424a2d803e51e4a56a4c8106790d81ebfee2cc1ee217cb8cc273ff4bbcf7beb15f255cc643389be
SSDEEP 96:stY/dzkeGzPb9Rk+Uo5h16Z0Uis7/x+6MhmuecJSZ1eje4K+gQVV28XM1C7K:st8pA4onUisV+FdSZQjwoVG6K
TLSH
T103D1C7065E24A97B8CC7F519BA39BB13E2F96072A5941F4CE7F8461C08DB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

aec02418-11fa-42eb-9f24-176cdaa3c27d.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\aec02418-11fa-42eb-9f24-176cdaa3c27d.tmp
Size 6KB
SHA256 893203d1184b60e427a711c552ebbb7d881ed0cd5a4589f88b54480a3e94ec30
MD5 9837ca78e2d6fcd05a1f56f602795ae9
SHA1 8449110590c18d90cdf02ce30d7252e8e7f70b8d
SHA512 c0d580bbce7af5ac6a6811e5222f81ce9a3eca565fb2f5ae93a361dc0c5621ffa48f9a46811c34974622c80ab7cc84a745f59cc9b4de0a4277b48e80ad7ddcc3
SSDEEP 96:stY/dzkfzPb9Rk+Uo5h16Z0Uis7/x+6MhmuecJSZ1eje4K+gzV428XM1C7K:st8pq4onUisV+FdSZQjwz4G6K
TLSH
T142D1B7065E24AA7B4CC6F519BA39BB13E2F96072B5D51E48E7F8461C08DB6DC2307907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 15KB
SHA256 d3c3c30b3a3b3e57c0b0dfb166427b111c9c11fcff29db6d0d210b411567fcd2
MD5 ed5836b24cb1c1a1b439b756fefbbc37
SHA1 891281ec634f5a175679d7e23c8587c3ee068ae5
SHA512 4610ee361abf1aac2a8180227455833cf6507a22026ce8e3da67e13c29a874074e69c511225364c962b4e89a6ee3ebb56a367da38e907908bf27202b54a2e16d
SSDEEP 384:Ysrv+89zHqlDNP9oidmNBSJMuS7qHH5cX:Drv+4UNbdxkG8
TLSH
T158728E37E578E777AEB38805B4867A073F78509696C21BE8D5A81F8D428F0D92317D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 15KB
SHA256 030e25928efec3146e902c4087170cac03ed7e3f83d68a0cb372b1593e1f6ed8
MD5 cec1c15ab7132656e87d98fd7ca96840
SHA1 254f2e46054d8bb4bb86d4351a624a33e4afbb2b
SHA512 9402dc8cb036ec397649da151642ff41e5d8aecad4b1cb40683f05786883c9f07177d0d46bcb0aa09cf6110a9df96fef7415f6f0cad1b19f203e1649ae32c643
SSDEEP 384:Esrv+89zHqlDNP9oid6NBSJMuS7qHH5cX:Prv+4UNbd9kG8
TLSH
T145729E33E578E777AEB39805B4863A073F7850A696C21BE8D5A81F8D429F0D92317D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 2KB
SHA256 3bd7469446335929b81c5e3be6e99fe03fd15dcd4f18fa2d87ca7123623696c9
MD5 e9c33d25552e68a051dd39f91d50895d
SHA1 954b2c157017ea33719abece97cd67bad6d150ff
SHA512 748b77daa3a6129565b46bae08147e100caac0e35fc6ff569f74c03fdc8605ef9bf3aaa740acd5ac3698f2920e216f9ec9f7292705986fcd767e45acfa8d0643
TLSH
T11251C83369109B77A6F38A067A463F138F2580A5EF522FA4A5DC0B0C01CB19C6347C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 3KB
SHA256 8a77a7e669e4324d6da167713a8c9d15d9b41af0c404617ce926259b15fd473f
MD5 34e89e5b5071271f0e49ccefa3b9e87c
SHA1 0fa2c97a2d42e747cd7c69802f9188759d82c05e
SHA512 386c54cf0c4173d29212639c5b97ee2a3692a8027f5c1a76c3066d57f02c30bda236e3cff8741d7217d5ca29f641d99312568fd91291125f1339aa5b41beb1c6
TLSH
T11971963BA960E9779AF39905B9853B06A7514077EA853FA8D5EC0F0C01CB2881353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59f3eb.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe59f3eb.TMP
Size 1KB
SHA256 5f1d5a26c680320e8457541d2f2142e197236a0f65b60a6153c554c95fff28c9
MD5 c94fc7a26a162320ccf2cfac3f4dc46c
SHA1 9ecc1afa70fc78756722f44c77e331758e5434e0
SHA512 c5099b29cce51a1e835edb70c6c2399770d7cedc9f442801c0063e4429368d51e9226afdf7c2cb83c49e7a1cd9094be9a665ed9b2008c81bcfb4efe87295a38c
TLSH
T17B3160B3D5609B73B9A296063640BB875F2040BA9B814F88A0CC0A0C02CB08CE66F836
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_620580993\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2196-88-0x00007FFD2AA10000-0x00007FFD2AA11000-memory.dmp

Download

memory/4536-929-0x0000026904600000-0x0000026904601000-memory.dmp

Download

memory/4536-927-0x0000026904600000-0x0000026904601000-memory.dmp

Download

memory/4536-939-0x0000026904600000-0x0000026904601000-memory.dmp

Download

memory/4536-937-0x0000026904600000-0x0000026904601000-memory.dmp

Download

memory/4536-935-0x0000026904600000-0x0000026904601000-memory.dmp

Download

memory/4536-934-0x0000026904600000-0x0000026904601000-memory.dmp

Download

memory/4536-938-0x0000026904600000-0x0000026904601000-memory.dmp

Download

memory/4536-936-0x0000026904600000-0x0000026904601000-memory.dmp

Download

memory/4844-646-0x00007FFD2AA50000-0x00007FFD2AA51000-memory.dmp

Download

memory/4844-645-0x00007FFD2B460000-0x00007FFD2B461000-memory.dmp

Download

memory/5148-827-0x00007FFD05D40000-0x00007FFD06B7E000-memory.dmp

Download

memory/5148-201-0x00007FFD05D40000-0x00007FFD06B7E000-memory.dmp

Download

memory/5392-26-0x00007FFD2AA10000-0x00007FFD2AA11000-memory.dmp

Download