be4a671fa029922465fcd7c63d928143f9a6529d25eefd5d908fe2b0ecfe6f51

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 22.3MB
Sample260803-hsj67sdm7x
SHA256 be4a671fa029922465fcd7c63d928143f9a6529d25eefd5d908fe2b0ecfe6f51
MD5 6e37945b138f3c6185d4c54bd55f1c17
SHA1 bc01ac1208afa1c3bc9c7d2093f03db1cc963286
SHA512 ebdc20b125ef2c411625b76b221000a5460b0f0e0179d508b59b1400192e20891dfef0ec7cceb0380796b910ae9d901cec70b8344c44636e79ba5cdf5519fa6a
SSDEEP 393216:LxDHeCz2a7DWxGAvHurXBeFtpZzz0pamnfj4RH:dDHeCz2YDWxvOTB+12Fnb0
TLSH
T1F2378C157A5B99ACD59AC87083474AB34E2170DF0A36B9BF44C482393F7DBF46B29318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Executes dropped EXE 1 IoCs

pid	Process
3164	lsp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
9	raw.githubusercontent.com
25	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 48 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2308	tasklist.exe
904	tasklist.exe
2272	tasklist.exe
3256	tasklist.exe
2608	tasklist.exe
5780	tasklist.exe
2736	tasklist.exe
5880	tasklist.exe
4808	tasklist.exe
6092	tasklist.exe
5964	tasklist.exe
4204	tasklist.exe
4088	tasklist.exe
1628	tasklist.exe
1512	tasklist.exe
2524	tasklist.exe
2596	tasklist.exe
2800	tasklist.exe
5744	tasklist.exe
5300	tasklist.exe
5292	tasklist.exe
4956	tasklist.exe
5968	tasklist.exe
5376	tasklist.exe
4344	tasklist.exe
5952	tasklist.exe
5156	tasklist.exe
4104	tasklist.exe
3436	tasklist.exe
4304	tasklist.exe
564	tasklist.exe
2692	tasklist.exe
5728	tasklist.exe
4208	tasklist.exe
3840	tasklist.exe
1240	tasklist.exe
4160	tasklist.exe
5836	tasklist.exe
4928	tasklist.exe
1352	tasklist.exe
3840	tasklist.exe
6088	tasklist.exe
4952	tasklist.exe
3204	tasklist.exe
5220	tasklist.exe
5008	tasklist.exe
5588	tasklist.exe
2636	tasklist.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1530669054\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1530669054\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1530669054\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1530669054\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902342434\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1530669054\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902342434\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902342434\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1530669054\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1530669054\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-te.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4104	msedgewebview2.exe
4104	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4176	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: 35	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: 35	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	1352	tasklist.exe
Token: SeDebugPrivilege	3840	tasklist.exe
Token: SeDebugPrivilege	2736	tasklist.exe
Token: SeDebugPrivilege	5880	tasklist.exe
Token: SeDebugPrivilege	5008	tasklist.exe
Token: SeDebugPrivilege	5728	tasklist.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	2308	tasklist.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeDebugPrivilege	6088	tasklist.exe
Token: SeDebugPrivilege	1628	tasklist.exe
Token: SeDebugPrivilege	1512	tasklist.exe
Token: SeDebugPrivilege	904	tasklist.exe
Token: SeDebugPrivilege	5292	tasklist.exe
Token: SeDebugPrivilege	4952	tasklist.exe
Token: SeDebugPrivilege	4208	tasklist.exe
Token: SeDebugPrivilege	4956	tasklist.exe
Token: SeDebugPrivilege	5156	tasklist.exe
Token: SeDebugPrivilege	4104	tasklist.exe
Token: SeDebugPrivilege	6092	tasklist.exe
Token: SeDebugPrivilege	3204	tasklist.exe
Token: SeDebugPrivilege	5968	tasklist.exe
Token: SeDebugPrivilege	5964	tasklist.exe
Token: SeDebugPrivilege	3436	tasklist.exe
Token: SeDebugPrivilege	3840	tasklist.exe
Token: SeDebugPrivilege	2524	tasklist.exe
Token: SeDebugPrivilege	4304	tasklist.exe
Token: SeDebugPrivilege	2596	tasklist.exe
Token: SeDebugPrivilege	2272	tasklist.exe
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	4204	tasklist.exe
Token: SeDebugPrivilege	1240	tasklist.exe
Token: SeDebugPrivilege	3256	tasklist.exe
Token: SeDebugPrivilege	4160	tasklist.exe
Token: SeDebugPrivilege	5588	tasklist.exe
Token: SeDebugPrivilege	5220	tasklist.exe
Token: SeDebugPrivilege	564	tasklist.exe
Token: SeDebugPrivilege	5744	tasklist.exe
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeDebugPrivilege	5836	tasklist.exe
Token: SeDebugPrivilege	5300	tasklist.exe
Token: SeDebugPrivilege	2636	tasklist.exe
Token: SeDebugPrivilege	5780	tasklist.exe
Token: SeDebugPrivilege	5376	tasklist.exe
Token: SeDebugPrivilege	4344	tasklist.exe
Token: SeDebugPrivilege	5952	tasklist.exe
Token: SeDebugPrivilege	4928	tasklist.exe
Token: SeDebugPrivilege	2692	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 4176	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 4176 wrote to memory of 5976	4176	msedgewebview2.exe	90
PID 4176 wrote to memory of 3796	4176	msedgewebview2.exe	91
PID 4176 wrote to memory of 3796	4176	msedgewebview2.exe	91
PID 4176 wrote to memory of 3796	4176	msedgewebview2.exe	91
PID 4176 wrote to memory of 3796	4176	msedgewebview2.exe	91
PID 4176 wrote to memory of 1776	4176	msedgewebview2.exe	92
PID 4176 wrote to memory of 2968	4176	msedgewebview2.exe	93
PID 4176 wrote to memory of 2968	4176	msedgewebview2.exe	93
PID 4176 wrote to memory of 2968	4176	msedgewebview2.exe	93
PID 4176 wrote to memory of 2496	4176	msedgewebview2.exe	94
PID 4176 wrote to memory of 2496	4176	msedgewebview2.exe	94
PID 4176 wrote to memory of 2496	4176	msedgewebview2.exe	94
PID 4176 wrote to memory of 2496	4176	msedgewebview2.exe	94
PID 4176 wrote to memory of 2496	4176	msedgewebview2.exe	94
PID 2080 wrote to memory of 5696	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	95
PID 2080 wrote to memory of 3256	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	97
PID 2080 wrote to memory of 1352	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	99
PID 2080 wrote to memory of 3164	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	102
PID 2080 wrote to memory of 3840	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	104
PID 2080 wrote to memory of 2736	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	106
PID 2080 wrote to memory of 5880	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	108
PID 2080 wrote to memory of 5008	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	110
PID 2080 wrote to memory of 5728	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	112
PID 2080 wrote to memory of 4808	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	114
PID 2080 wrote to memory of 2308	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	116
PID 2080 wrote to memory of 4088	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	119
PID 2080 wrote to memory of 6088	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	121
PID 2080 wrote to memory of 1628	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	123
PID 2080 wrote to memory of 1512	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	125
PID 2080 wrote to memory of 904	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	127
PID 2080 wrote to memory of 5292	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	129
PID 2080 wrote to memory of 4952	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	131
PID 2080 wrote to memory of 4208	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	133
PID 2080 wrote to memory of 4956	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	135
PID 2080 wrote to memory of 5156	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	137
PID 2080 wrote to memory of 4104	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	139
PID 2080 wrote to memory of 6092	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	143
PID 2080 wrote to memory of 3204	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	145
PID 2080 wrote to memory of 5968	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	147
PID 2080 wrote to memory of 5964	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	149
PID 2080 wrote to memory of 3436	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	151
PID 2080 wrote to memory of 3840	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	153
PID 2080 wrote to memory of 2524	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	155
PID 4176 wrote to memory of 2736	4176	msedgewebview2.exe	157
PID 4176 wrote to memory of 2736	4176	msedgewebview2.exe	157
PID 4176 wrote to memory of 2736	4176	msedgewebview2.exe	157
PID 2080 wrote to memory of 4304	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	158
PID 2080 wrote to memory of 2596	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	160
PID 2080 wrote to memory of 2272	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	162
PID 2080 wrote to memory of 2800	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	164
PID 2080 wrote to memory of 4204	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	166
PID 2080 wrote to memory of 1240	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	168
PID 2080 wrote to memory of 3256	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	170
PID 2080 wrote to memory of 4160	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	172
PID 4176 wrote to memory of 5608	4176	msedgewebview2.exe	174
PID 4176 wrote to memory of 5608	4176	msedgewebview2.exe	174
PID 4176 wrote to memory of 5608	4176	msedgewebview2.exe	174
PID 2080 wrote to memory of 5588	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	175
PID 2080 wrote to memory of 5220	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	177
PID 2080 wrote to memory of 564	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	179
PID 2080 wrote to memory of 5744	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	181
PID 2080 wrote to memory of 2608	2080	2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	183
PID 4176 wrote to memory of 4104	4176	msedgewebview2.exe	185

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5696	attrib.exe
3256	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2080.4588.13273754966230077876 /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\essential.exe\EBWebView /prefetch:4 /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7fff63aa5fd8,0x7fff63aa5fe4,0x7fff63aa5ff0
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,839321058588244259,9907761675221749477,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2068 --field-trial-handle=1776,i,839321058588244259,9907761675221749477,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1776,i,839321058588244259,9907761675221749477,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3452 --field-trial-handle=1776,i,839321058588244259,9907761675221749477,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca /prefetch:1
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=1776,i,839321058588244259,9907761675221749477,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=1776,i,839321058588244259,9907761675221749477,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4448 --field-trial-handle=1776,i,839321058588244259,9907761675221749477,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=2026-08-03_6e37945b138f3c6185d4c54bd55f1c17_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=1776,i,839321058588244259,9907761675221749477,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:608d0ec1d0010cd50469cbb9d1addeacc30bf4ca
    3⤵
    PID:4616
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp
  2⤵
  - Views/modifies file attributes
  PID:5696
- C:\Windows\system32\attrib.exe
  "attrib" +h C:\Users\Admin\AppData\Roaming\essential.exe\v
  2⤵
  - Views/modifies file attributes
  PID:3256
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1352
- C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\lsp.exe
  "C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\lsp.exe" lsp --definitions=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\globalTypes.d.luau --definitions=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\executor.d.luau --documentation=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\en-us.json --documentation=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\luau-en-us.json
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5880
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5728
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5292
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5156
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6092
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5968
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5964
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3256
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5588
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5220
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:564
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5744
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5836
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5300
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5780
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5376
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5952
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4928
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

beta.log

Path C:\Users\Admin\AppData\Local\Temp\Essential\beta.log
Size 2KB
SHA256 a3c3daed26e40265516c7e31b9a7cd46b414d41dfdc09f1771bc6b27a59855c7
MD5 53bb145ee0e39a7b884dc8795d3157dc
SHA1 c4bc076b5f5e7689cdc62708b8bc5710766d8cec
SHA512 c1cab32ae62a4091c2a923def8829b84324b12cf26ecedcbac9a02d1bd2470bc2665b757bf85c17e7b8b156f4c798a01a221fab90379aa56ec658a60dc901368
TLSH
T1EA514ADA05B4001FC87B254FF72ABEB27641FAC605938E36F50D725DB4E12431929AE3
MD5 SHA1 SHA512 TLSH

Submit Download

beta.log

Path C:\Users\Admin\AppData\Local\Temp\Essential\beta.log
Size 4KB
SHA256 cf3ab1c9328c4a721621c1f542ecddfaf5c04c7cda27bf770bc7dec88d788100
MD5 58e00ebb003e506880b6d3fb5ce3c9c6
SHA1 936e3d9256eb7ce84fe7a06870deedd8493a532b
SHA512 b3df7b09175173f8d2255b9bafcfbda403a90c95743df4e604ec3ae7d54c8a0617d49c367f6a1456f23d65802b64f799e6ac0dff5020106da734d91bd4f036da
SSDEEP 96:M46hUxtEJSYRI3OLKGolhgmmNWuLCmzkglkgXXRkgwSBJdKMU:MnxHkEk4kFX
TLSH
T1A0A108D605B4801F887B664FF72ABEA3B641F9C706938E73F509364DB4903471829AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 579da85d41b8c014fdeaed17a19f5131d56bc26860aa863405694b19d8cc05ca
MD5 2e328289437fe8529b434599dd1919c4
SHA1 76095cb3efd8d52796ad753d5bddaf5a12b187fa
SHA512 8d66e8620e5d65a76fb4cd120e8db52d7468a59c2159471c5913b99c6583a6aeaf224f6d527cbbcfda0aac21afa24e78c24577773af8248631f0d110fa497873
TLSH
T1EED01222730309B4C01021730416A1891D10C10B844540045428A91D3E04070090A483
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 df4e1f7491c5a9206e41a59d4878f41bd0bc5a41aa637d3473de8b8356ff04f4
MD5 5b48b1ff6bc8f7f0aafed926f8dee0a6
SHA1 33d9d8410d9f9190fff400b66f9298afa6184b69
SHA512 dc9056a2d3a82e97290437d8ff715819058707d9245e51850d1a1952bb54940e82a0125280f243649fba8297d8963116bc7423684fb25293468e69a1a6a41e17
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c4a5834100058bf0df34868ef88a3958fe04ddf5f504c8a9a48ccac2e5c61369
MD5 0f016ba2a9d16f894ecbb500e7b9e177
SHA1 23f0f4b435ff19d424e40af219527c80bcbff5c3
SHA512 bc1682a76a9825f106f6291c79546b597961ea15736d6f001c88069adb6fddfc5901519496117e36041bbd16d7a1c4e4c83a18d74df5f6dfcb72ba0f8365bad6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 25339a316a1f874704c00003d1e67f1b9aced2cef958be850d5440571769c562
MD5 d56a7d839e8895da8174319b193a5719
SHA1 c8b7a859afcf937c5d461ccba2511a8137c4cdd1
SHA512 b8a809c2d661379cc7a8a41b7556dbfc9ed25fc8c2936ae274fb77f0dc41b981c692abc787d6228b19aa2ac2bfab6261aab3f9b41d2da61bb778ab4f06aad137
TLSH
T1FED0129C091D0D72CF61DB3F07C94995B77405758117FDDB668D31F55850744E506712
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\Network Persistent State
Size 690B
SHA256 80edc339f378ead3b9a41d156665adb198a1309136c1ee98317e9bf45cf8cfeb
MD5 c8529eac26f893c7944ca34d3dcf9bd5
SHA1 5958a5a79f1f1ea87b88b17a00ae96d94c0190dd
SHA512 33ac205ffe5aec14ce7a2c96665002f68a71cc28652400c4718e358ab9bd4166ce84dc1172409657cd55f7f6e36593a4fcd028e3d7ac45623499d4ef8354ace4
TLSH
T1AE0170A287F0C57D4A4112E016347817C92E041592286D26CDDABBE557D24B2E11054B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a64f5.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\Network Persistent State~RFe5a64f5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 cc433c846b563f41acfaf9aa788930bd609caa1106d86cc15e28513bbf542e41
MD5 7b1cd1abe3fadcf6e70f79fed8dde9e7
SHA1 d5f5087d9982728ed4b794fff815c130cc7a9861
SHA512 a9c9f52851214926da206494c0d38af1900838a787f49c2104d93d82d6fe852140937c4a3ff2142e0a0c9c425ef234262f63f147c3c9702e32dac40eb36f02ef
SSDEEP 96:sth/dJukJb9kxkbo5h16Z0ps7/x+6MhmuecJOV1ejeeK+g828XM1C7K:stVrcxIonpsV+FdOVQj2qG6K
TLSH
T13ED1B7025E64797B4CCFE119BA39BA17E2F960B270D11E58E7F9862C04DA6CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 c9e3f5e47616cfc39a4b3acebaf1923976daaeafc9726ca7bb16379bbabdacb7
MD5 e4903df5c34a879d66dbb49d54976333
SHA1 c8cc76f2521bf495d06f532afc9d17b0ea528efe
SHA512 ff8384c6187e9b16352a9b0de07bab0412a139d0c5aa49fc6b1caeff9920d8caf7bd2a483443d22376bd9f1858511c6e498accf9c358c1ff78feff463e964907
SSDEEP 96:sth/dJuLGJb9kxkbo5h16Z0ps7/x+6MhmuecJOV1ejeeK+gt28XM1C7K:stVrGxIonpsV+FdOVQj2bG6K
TLSH
T1C9D1B6025E64797B4CCFE119BA39BB13E2F560B261D11E58E7F9862C04EA6CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59bd5b.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Preferences~RFe59bd5b.TMP
Size 5KB
SHA256 c8c2cf898f6417811b50ee1890ccdbbbc5a2cbe1c9be4580cc86193c758745cc
MD5 9e8c755ecbf75d37ea1c33ac75bdb4d3
SHA1 a86866a9bcf3fc91465f7f7a37a00b76c6cc69c7
SHA512 625555267976feeba04933884eafc2e705621f8f8469d4514a54ce16d09f0c86c96fd4cbb44b41d09b0ee2f4194851b768b722d4a680e79f7651a7979878512c
SSDEEP 96:rh/dJukJb9kxk/do616Z0ps7/x+6MhmuecJOV1ejeeK+g828XM1C7K:rVrcxEo6psV+FdOVQj2qG6K
TLSH
T1BBC1D7025E64797B4CCEE109BA397A07E2FA60B130D11E58E7F9862C08DB6CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

en-us.json

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\en-us.json
Size 6.7MB
SHA256 bfb1ffb3119b4a081882237ddcd1e29f33ce0557a6e54ba7c1049392fb228bcb
MD5 12236bdb8a86788be295891516db9175
SHA1 ef0137add69bed3a10b1a1f8ca93b80e2fa60179
SHA512 ce47f4102511042707ae9622451f56b98b164ba15a38af936c467d0dd97f09386729d6db63c2579813eb4af8d57e5c24167565ec6730fdafacb1589252e43ddd
SSDEEP 49152:Acv8mlo/8ZrJGYbihxzWwvkeUvJVwG9he/a:p
TLSH
T18966CD72C9A01D932686165DF8B9425AF83840DB285D3D88BA9C732C6F88D7F51763CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp.exe

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-en-us.json

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp\luau-en-us.json
Size 150KB
SHA256 df16b4bce28e169bc54442f030ae7cfbe03ea5588421be290b323a13a9cf4d1b
MD5 d53854e092e78a22e4b269464b18bbb7
SHA1 4dada46917d5fdd7aea42a47fef7c83f6c840ed8
SHA512 5ba2aec5526cc31eb2fb197295a928e4e408a2e77f506a9c58d369e968229b2795307f6061656dd20afb1237b561a27ee98159107431b64aa9667a295da686a8
SSDEEP 3072:6UBaQcZlXmr0yokdWR0MUBNpYybDwPO9he/jq3:6UBaQcZlXmr0yokdWR0MUBNpYybDwG9/
TLSH
T179E38A6CC6B11C231AC6212D997EA21AB43C40A7799F7C1079BC764C1F2C97DA37D29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 2KB
SHA256 17f8c01b34407e86eb81d96b7d23aaf6be8065d75bcb5d3b7c8f32fd6305cbf0
MD5 fca55c9a86c9159fb1b80835c9dc81bd
SHA1 83a4f5e981923f958090c12e319ab19d82a1929c
SHA512 58761206236c6a00db4f52e215c851e83aa10e06da8d017a63d998cf74b28d8f67461b692fd300198ef2595e62e43a8d66ed982f217dcc7658414241a23a6d02
TLSH
T19E5144336C646A3B8AAA5745795B3B23CF3A40E6AA622F6096ED5B1C01D715C6342C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 3KB
SHA256 822100d10c72430b81ce71350ecdfc2748f0d675545116dc2d7a7b323cde2b7e
MD5 21bb8ce566c188010902c5260935405c
SHA1 2ac5df574dbfbaa4f0bd3a839eec18666ceaeba6
SHA512 e62cea84faab16028240edb4561b473e2271b39d017ecea3fc78105dbd8f1b1595e9e25574ccc621f394af9b5777941931c991473f5a31c974a67185f7b518a3
TLSH
T1476186376D74A93B8EFA9A05B8863B129B654067E5913F65D6ED1F0C01D729C1342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 3KB
SHA256 fc61c5bbae5895722ee13496f24c5f7ca86404c341916417c5537ede9586a8ce
MD5 1e25e0a2b3a4d3a868064238b1b23af5
SHA1 45b48f5b034781e7320438fe9825b006a78c16bc
SHA512 3071c1977cb89481d81b26d68b9baf11a7c0f704bd1027aadfbe9ad01c2c385c826e5d81ba7bb56eb3f37ee0ca24b27b51c0e7e265c41d73f82726d4d7d24b55
TLSH
T16471853269B4AD3B8EFAD645B98A3B13A76550A7A5913FA9D6FC0F0C01D729C1342813
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 15KB
SHA256 2849d038e28e89ead862e5aaefd146df7d370b502af00e524a7ea4d1f24586d0
MD5 ea7c62a2b4b0da4a1b36ffab0fe564c3
SHA1 f0bc0824bd74fa138e10978dbfde6761edd6030a
SHA512 6c3d153c5bc545778a23febf63ffc95357c42dc3e218d916f8ce0e0adce441bcf0bfecafab0359a79b6e78f185b9bec275f00f68f5f3a341e6e0b746d87a8d74
SSDEEP 384:F+aQikB+z/xvxjg/qhEwNBS1lhVycSMMeAVdpf69z+:Q/UxvxjgC+dhxBMeUCF+
TLSH
T13672AE2758797E37A5FBFA05795D1B4BCBB884F260C16EB84ABD9F0D02C72D81302812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594934.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State~RFe594934.TMP
Size 1KB
SHA256 a5ec257bb7e10010f1e921a2e3d21dc67408e2303ebc827756007a81e2ab0e25
MD5 6cc232348e1d5dd4e2e76d8a5a86e703
SHA1 8201c999e0763272f35e0339d0a4f413f56781e4
SHA512 7c8ce55728cf7ad4f9c60a08eac23ab275547545a80f04fb35e9abd7017e019b8dc85c959a16e9373472ac2fc3fb9bb1355a6d48d1efe3cff507d74858dc7920
TLSH
T1CF21627298B46F37DDA9728371577A138F2140EB62614F1462EE9B1C12E708CEA66C33
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\essential.exe\v
Size 8B
SHA256 e3121abb19d064148aa27a37c91ba2eee99940accea3eb1adea272c5a555df70
MD5 07c487b441fc294e19d48094b23ca80f
SHA1 e43cc175c7a56c5d600924ff63763bd78bbb2aac
SHA512 fb33f7b3d9dd2a2e79bfd1f5b5aa2bee3fd9d3ae467344dcc0e2079d084b8ed4ffd6aa33367b5f49562ea82230770800fe8acb813fba58e6d904623cb87c07bf
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4176_1902672507\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2496-101-0x00007FFF83360000-0x00007FFF83361000-memory.dmp

Download

memory/2736-497-0x00007FFF83630000-0x00007FFF83631000-memory.dmp

Download

memory/2736-498-0x00007FFF81D80000-0x00007FFF81D81000-memory.dmp

Download

memory/3796-334-0x000001A2AED00000-0x000001A2AED2F000-memory.dmp

Download

memory/3796-19-0x00007FFF83360000-0x00007FFF83361000-memory.dmp

Download

memory/4104-744-0x0000013E04600000-0x0000013E04601000-memory.dmp

Download

memory/4104-746-0x0000013E04600000-0x0000013E04601000-memory.dmp

Download

memory/4104-751-0x0000013E04600000-0x0000013E04601000-memory.dmp

Download

memory/4104-752-0x0000013E04600000-0x0000013E04601000-memory.dmp

Download

memory/4104-750-0x0000013E04600000-0x0000013E04601000-memory.dmp

Download

memory/4104-754-0x0000013E04600000-0x0000013E04601000-memory.dmp

Download

memory/4104-755-0x0000013E04600000-0x0000013E04601000-memory.dmp

Download

memory/4104-753-0x0000013E04600000-0x0000013E04601000-memory.dmp

Download