c1d19e2f21c2627adce2bbf535b3e705d923cf82b8886bdb0dcefbb9cfa2692d

Analysis

max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 6.3MB
Sample260730-fp73razemb
SHA256 c1d19e2f21c2627adce2bbf535b3e705d923cf82b8886bdb0dcefbb9cfa2692d
MD5 b1a33ed1dd38ca9a958c7f2e00d574be
SHA1 e8ade8fb14e0053ae0c9b1cd3d08f673a8026dfe
SHA512 8534107543882e4b3c98efdf5b2918e7a338d82702892e74ab7917729484349caa6b67e517c7b7bae79c23ba1c58d7d54e90b4d312c8f7d6bd2a3b1962f066e7
SSDEEP 98304:KPTbvjzNVz4HtM2S2Kc1h7Ap/rwDRi9Q1RtMM8Yxdn+AV:yzbqS2QevV
TLSH
T13D667C03F69181E9C09EC078835BA637EB72BCC94935B6DB1BE44B112E26F906F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	raw.githubusercontent.com
11	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_381995259\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_1947493749\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_1947493749\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_402603850\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_402603850\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_402603850\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_402603850\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_381995259\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_381995259\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_381995259\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_1947493749\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_402603850\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_402603850\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1900_381995259\ct_config.pb	msedgewebview2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1344	msedgewebview2.exe
1344	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1900	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6732	2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6732 wrote to memory of 1900	6732	2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 1900 wrote to memory of 5168	1900	msedgewebview2.exe	92
PID 1900 wrote to memory of 2392	1900	msedgewebview2.exe	93
PID 1900 wrote to memory of 2392	1900	msedgewebview2.exe	93
PID 1900 wrote to memory of 2392	1900	msedgewebview2.exe	93
PID 1900 wrote to memory of 2392	1900	msedgewebview2.exe	93
PID 1900 wrote to memory of 4404	1900	msedgewebview2.exe	94
PID 1900 wrote to memory of 2984	1900	msedgewebview2.exe	95
PID 1900 wrote to memory of 2984	1900	msedgewebview2.exe	95
PID 1900 wrote to memory of 2984	1900	msedgewebview2.exe	95
PID 1900 wrote to memory of 6112	1900	msedgewebview2.exe	96
PID 1900 wrote to memory of 6112	1900	msedgewebview2.exe	96
PID 1900 wrote to memory of 6112	1900	msedgewebview2.exe	96
PID 1900 wrote to memory of 6112	1900	msedgewebview2.exe	96
PID 1900 wrote to memory of 6112	1900	msedgewebview2.exe	96
PID 1900 wrote to memory of 1412	1900	msedgewebview2.exe	99
PID 1900 wrote to memory of 1412	1900	msedgewebview2.exe	99
PID 1900 wrote to memory of 1412	1900	msedgewebview2.exe	99
PID 1900 wrote to memory of 3932	1900	msedgewebview2.exe	100
PID 1900 wrote to memory of 3932	1900	msedgewebview2.exe	100
PID 1900 wrote to memory of 3932	1900	msedgewebview2.exe	100
PID 1900 wrote to memory of 1344	1900	msedgewebview2.exe	101
PID 1900 wrote to memory of 5324	1900	msedgewebview2.exe	102
PID 1900 wrote to memory of 5324	1900	msedgewebview2.exe	102
PID 1900 wrote to memory of 5324	1900	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6732
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=3.5.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6732.4744.2579605507141964309 /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView /prefetch:4 /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc62ae5fd8,0x7ffc62ae5fe4,0x7ffc62ae5ff0
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView" --webview-exe-name=2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1692 --field-trial-handle=1700,i,3389107936331682050,16915755509827865261,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView" --webview-exe-name=2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2004 --field-trial-handle=1700,i,3389107936331682050,16915755509827865261,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView" --webview-exe-name=2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1700,i,3389107936331682050,16915755509827865261,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView" --webview-exe-name=2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1700,i,3389107936331682050,16915755509827865261,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2 /prefetch:1
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView" --webview-exe-name=2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4552 --field-trial-handle=1700,i,3389107936331682050,16915755509827865261,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView" --webview-exe-name=2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1700,i,3389107936331682050,16915755509827865261,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView" --webview-exe-name=2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4572 --field-trial-handle=1700,i,3389107936331682050,16915755509827865261,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView" --webview-exe-name=2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1052 --field-trial-handle=1700,i,3389107936331682050,16915755509827865261,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d4cf9704540b84241337d8e3fd822b8270a821f2
    3⤵
    PID:5324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 afb40af59eeb53f0f83ac10bc6d32c34c1dc53b80dcc049743da031b3eec03e3
MD5 6e359bde8bceb051e16b2e595e8748b6
SHA1 74e96c3631d59640de6f81f660af16bbf99349f6
SHA512 41a7c0f2ecafde38922f18a9e0485766c1f8380976b1527649eea5d58aecefcfdc109b978e4da23164e50326b7ff9884490ff2957005bf26da99d8c8920eed8f
TLSH
T133D0241733030334C43030331713F10D1400C10F450540015C3CC77D3FC44500D47451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b8959eeab44bc4f2901998759af8e2d4969c5e9eb37fc561686b14f3a6088f20
MD5 440f57e46f4c9c047931cb66ffd0dec4
SHA1 6d25456bf889b396178210e0f0f23ed0d3b7cd60
SHA512 f198441f27903054c19d288935c2378444aace708dea8bd0210ae618b28d8a3cb690c5f9dd21082ae03af695f55a7f06f231bb9b2ca3a633d9be5cf5fa921982
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8aea1433-5ad8-4e6b-8c83-0d6614820b4e.tmp

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Default\8aea1433-5ad8-4e6b-8c83-0d6614820b4e.tmp
Size 6KB
SHA256 0e74e29b650a5d6858c1ea6510f8965da2e6fa7137b8799edebce10de7ee8c3c
MD5 5e63b203d694ec3fcd7bca409521aef8
SHA1 1d2825dd9a166b4d61f8be7c3e8ef0bb74f9127a
SHA512 073215ed5ea4414a89756da8d8f228d1e56d74f7004e0cb36bfb8dce5617fd72a81512ec339cadf7efc48ccb1f743989c78fa3067b1b3b50f930dd1feb7e31c9
SSDEEP 96:stG/dCx6+yb90kFo5h16Z0Ms7/x+6MhmuecJxO1ejeFK+g1s28XM1C7K:st+SZYonMsV+FdxOQjrwG6K
TLSH
T1BDD1A5035F28697B4CC7E109BA69BB03E2FA507275D51E58E7F8462C09DA6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 cfd8e94da5437642171abadf4001404f3bd7675ae53f3f0813d33f2b139f1f57
MD5 ee5139d81b08d579ef16ff7ff10acec9
SHA1 61a243bbce0c726e7438336ad17c59284036b16a
SHA512 ccb98ef56d3fbfbf99f6db54997d6d0868819c321a2926a7ac675fb4cf43ede66a4080ca123bb458dc061cb55187f765e94b09ebb5427564ef8ded63b546c2a8
TLSH
T1BAA0027292901887C595477054D1029473714CB20B4346C748E554A8AD603F16B25414
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5967e8.TMP

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5967e8.TMP
Size 48B
SHA256 494782b0a93d93e3f620a4a81b93cd5d9b9a573678b1f762c80feeb6395f4b1b
MD5 ca8f8846d06dafe2ca8576cb5cd4be4a
SHA1 e94f27433cb44f84d3b82f4daa715e753fd24c17
SHA512 69b31f033b6d50a3dda46586cbcf7bc030b7e0e7bcafce94ca664db346628636b357b28598ffc11f12a705a13930d5e9e98548ed8f0a8aa55a1c5e175a40d75b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a3be1.TMP

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Default\Network\Network Persistent State~RFe5a3be1.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Default\Preferences
Size 6KB
SHA256 71c0284d0ecd6a119d4a0ca3d50ab0a9914ed5c3d0c12497f224fde3ae71d7db
MD5 3fb49b753a5f6b97a29ba5ea6f69c289
SHA1 a4ead61cce534a674391d6ac99eb44e3e0b731f7
SHA512 520704107727da883887e618a1f78e13a6d1d10cf25ff17ecb50cead483d3c7a9360566085f70b2c4454abb85aa2e0bf94e779076e9cc27e5f2001df519be60a
SSDEEP 96:stG/dCx6lGyb90kFo5h16Z0Ms7/x+6MhmuecJxO1ejeFK+g1O28XM1C7K:st+SjYonMsV+FdxOQjrKG6K
TLSH
T139D1B5035F28697B8CC7E108BA69BB03E2F95072B5911E48E7FC4A2C05DB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Local State
Size 2KB
SHA256 9a0e9ef06c2d0413ef86e668b3b5ae66bbf7b9859c9e56803f3fa66fe6b54d27
MD5 5730f4fc3740ee534c1720bc052f4567
SHA1 dbc9828244a8faf5769e16863b8c2e1949d9b51e
SHA512 911f7662b35af4c2a74047573f338b0d350dfe90d60a203a00097d9b9b0997c838e7ea4d611916a6864ad959bc71ec2a587291981206978d3da23fa3237c4feb
TLSH
T1CB519733AD149B3789E386447ACB3B235E3A50A2EB911F509ADD0B1C01CA55C6342C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Local State
Size 3KB
SHA256 dcb05bede114b6da18e4093d539d75660da8a8d1b8f5212e6898d22a41d90e25
MD5 1cca6cfcef1bcc642fcfcdaa91052961
SHA1 0493252ade9d7d06ba019f26c61beed70d9e5636
SHA512 98b20269b76147d671a9749cd3d88dddfa25cff1f37e2a3d2410898c697eb488ad10a8ecb43b792b555a8f87cc551ed4fa5f10c954fdd77564900f3bc29a3614
TLSH
T139618437AD649A374DF3960579C62B166BB55063EAC13F94DAEC0F1C01D728C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Local State
Size 15KB
SHA256 ec3d3df7fab1ba18a0c7e60812451231358959d68e01d59f70c593890d197729
MD5 20260d8a11bdefe179470e9f2eb8ef79
SHA1 633ba4ea597c275caabec3ef6880d909e9657d1d
SHA512 d533f709ddd16fcc0c5d01d6c02c1b8fb054de19960e27bdec358893736e954620df3be20d184c0117f1be82c8f6bab2d1d376b37de1bda008831adba6f3f9b3
SSDEEP 384:N+aQikB+z/xvxjg/qhEwNBS+5nOXFisd0c9zW:Y/UxvxjgC+mhOFisacFW
TLSH
T14772AF3799383E3395B7E6057A8E075BDBB984B2E1C26DB84AED5F0C06872980342C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59134f.TMP

Path C:\Users\Admin\AppData\Local\com.moonholder.wuwa-mod-fixer\EBWebView\Local State~RFe59134f.TMP
Size 1KB
SHA256 bd8ba265687b0f305e9167ce0f484baccf105851923185d772fa4b0e30e70341
MD5 f26d1562db1df15d5ad1004e3d350fc3
SHA1 828abcf2d5e3da4723f9c2e55a2ea7efd5ba1727
SHA512 9e4aa20c38573d044e269e9b1aa0de7998cc93f65b031aaca85fe061763622dd118316b82f78f2a110bdbe9bfce427dd39cc7b78646d628005d70acf82907271
TLSH
T1CD2135B3E9644B329D92624532C77B1B2F3210B7D7504E0465DF4B2C029A54DEB6A937
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1344-293-0x000001D354F30000-0x000001D354F31000-memory.dmp

Download

memory/1344-301-0x000001D354F30000-0x000001D354F31000-memory.dmp

Download

memory/1344-299-0x000001D354F30000-0x000001D354F31000-memory.dmp

Download

memory/1344-300-0x000001D354F30000-0x000001D354F31000-memory.dmp

Download

memory/1344-302-0x000001D354F30000-0x000001D354F31000-memory.dmp

Download

memory/1344-295-0x000001D354F30000-0x000001D354F31000-memory.dmp

Download

memory/1344-304-0x000001D354F30000-0x000001D354F31000-memory.dmp

Download

memory/1344-303-0x000001D354F30000-0x000001D354F31000-memory.dmp

Download

memory/1412-239-0x00007FFC85370000-0x00007FFC85371000-memory.dmp

Download

memory/1412-238-0x00007FFC84340000-0x00007FFC84341000-memory.dmp

Download

memory/2392-175-0x0000017ACA000000-0x0000017ACA37C000-memory.dmp

Download

memory/2392-19-0x00007FFC83FC0000-0x00007FFC83FC1000-memory.dmp

Download

memory/6112-176-0x000001B514230000-0x000001B5145AC000-memory.dmp

Download

memory/6112-102-0x00007FFC83FC0000-0x00007FFC83FC1000-memory.dmp

Download