6cdb32a707f05f12f6d5febf8b6a268ef20aa8861528de5936a6e40d154fe27a

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
Size 24.3MB
Sample260810-e6khcavzdv
SHA256 6cdb32a707f05f12f6d5febf8b6a268ef20aa8861528de5936a6e40d154fe27a
MD5 83cde762e13d8b0358db8ff12d1f6d00
SHA1 5751e0fe56c486b66148977a91360bce022806ce
SHA512 3c98ac27a9b62228acedcc0550abfc3c31cfdeb63594e4f5f0073f6fea54644fc5124fa9392f79d54804e647ba1a58df3befdb8c87845562d20169cd811ef520
SSDEEP 393216:pzpgo7pB7KzoHOob4Y65zMilH+MPdKdcUIJUUWZzGp:Rpgo7pB7KzoHOob4Y65zMileMACheqp
TLSH
T17C470721BA5B996CD19BC4B083478A770A3134DB0B35B9FF45D492382F7EBF41B28259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_325131207\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_325131207\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_183096175\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_325131207\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_183096175\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_183096175\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_183096175\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_183096175\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_183096175\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_282207774\Part-ZH	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1268	msedgewebview2.exe
1268	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1600	msedgewebview2.exe
3428	msedgewebview2.exe
1600	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1332	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1332	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3540	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
3540	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
3540	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
3540	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
3540	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3540	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1600	3540	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	89
PID 1600 wrote to memory of 3244	1600	msedgewebview2.exe	90
PID 1600 wrote to memory of 3484	1600	msedgewebview2.exe	91
PID 1600 wrote to memory of 3484	1600	msedgewebview2.exe	91
PID 1600 wrote to memory of 3484	1600	msedgewebview2.exe	91
PID 1600 wrote to memory of 3484	1600	msedgewebview2.exe	91
PID 1600 wrote to memory of 4684	1600	msedgewebview2.exe	92
PID 1600 wrote to memory of 4972	1600	msedgewebview2.exe	93
PID 1600 wrote to memory of 4972	1600	msedgewebview2.exe	93
PID 1600 wrote to memory of 4972	1600	msedgewebview2.exe	93
PID 1600 wrote to memory of 4432	1600	msedgewebview2.exe	94
PID 1600 wrote to memory of 4432	1600	msedgewebview2.exe	94
PID 1600 wrote to memory of 4432	1600	msedgewebview2.exe	94
PID 1600 wrote to memory of 4432	1600	msedgewebview2.exe	94
PID 1600 wrote to memory of 4432	1600	msedgewebview2.exe	94
PID 3540 wrote to memory of 3428	3540	2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe	97
PID 3428 wrote to memory of 4632	3428	msedgewebview2.exe	98
PID 3428 wrote to memory of 352	3428	msedgewebview2.exe	99
PID 3428 wrote to memory of 352	3428	msedgewebview2.exe	99
PID 3428 wrote to memory of 352	3428	msedgewebview2.exe	99
PID 3428 wrote to memory of 352	3428	msedgewebview2.exe	99
PID 3428 wrote to memory of 4740	3428	msedgewebview2.exe	100
PID 3428 wrote to memory of 2232	3428	msedgewebview2.exe	101
PID 3428 wrote to memory of 2232	3428	msedgewebview2.exe	101
PID 3428 wrote to memory of 2232	3428	msedgewebview2.exe	101
PID 3428 wrote to memory of 5752	3428	msedgewebview2.exe	102
PID 3428 wrote to memory of 5752	3428	msedgewebview2.exe	102
PID 3428 wrote to memory of 5752	3428	msedgewebview2.exe	102
PID 3428 wrote to memory of 5752	3428	msedgewebview2.exe	102
PID 3428 wrote to memory of 5752	3428	msedgewebview2.exe	102
PID 1600 wrote to memory of 6100	1600	msedgewebview2.exe	103
PID 1600 wrote to memory of 6100	1600	msedgewebview2.exe	103
PID 1600 wrote to memory of 6100	1600	msedgewebview2.exe	103
PID 1600 wrote to memory of 6100	1600	msedgewebview2.exe	103
PID 1600 wrote to memory of 6100	1600	msedgewebview2.exe	103
PID 1600 wrote to memory of 5392	1600	msedgewebview2.exe	107
PID 1600 wrote to memory of 5392	1600	msedgewebview2.exe	107
PID 1600 wrote to memory of 5392	1600	msedgewebview2.exe	107
PID 1600 wrote to memory of 3276	1600	msedgewebview2.exe	108
PID 1600 wrote to memory of 3276	1600	msedgewebview2.exe	108
PID 1600 wrote to memory of 3276	1600	msedgewebview2.exe	108
PID 1600 wrote to memory of 1268	1600	msedgewebview2.exe	109
PID 1600 wrote to memory of 1264	1600	msedgewebview2.exe	110
PID 1600 wrote to memory of 1264	1600	msedgewebview2.exe	110
PID 1600 wrote to memory of 1264	1600	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3540.5788.15939158150432700793 /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView /prefetch:4 /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x54,0x168,0x18c,0xa4,0x194,0x7ff9208a5fd8,0x7ff9208a5fe4,0x7ff9208a5ff0
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,17407193490794580972,13921631109523162059,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2160 --field-trial-handle=1748,i,17407193490794580972,13921631109523162059,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2372 --field-trial-handle=1748,i,17407193490794580972,13921631109523162059,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1748,i,17407193490794580972,13921631109523162059,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4208 --field-trial-handle=1748,i,17407193490794580972,13921631109523162059,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b /prefetch:1
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4956 --field-trial-handle=1748,i,17407193490794580972,13921631109523162059,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1748,i,17407193490794580972,13921631109523162059,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5024 --field-trial-handle=1748,i,17407193490794580972,13921631109523162059,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1268
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4696 --field-trial-handle=1748,i,17407193490794580972,13921631109523162059,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:6c2ab421c83910b4d64ab21eb4a3ebc377cea47b
    3⤵
    PID:1264
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3540.5788.11786486622319364879 /pfhostedapp:3b7ffb87fe4af2eb6f3cb0a1cb64cc632fa31e23
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView /prefetch:4 /pfhostedapp:3b7ffb87fe4af2eb6f3cb0a1cb64cc632fa31e23 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ff9208a5fd8,0x7ff9208a5fe4,0x7ff9208a5ff0
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2008 --field-trial-handle=2016,i,2525125056694028614,3133594959010956552,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3b7ffb87fe4af2eb6f3cb0a1cb64cc632fa31e23
    3⤵
    PID:352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2100 --field-trial-handle=2016,i,2525125056694028614,3133594959010956552,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3b7ffb87fe4af2eb6f3cb0a1cb64cc632fa31e23
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2488 --field-trial-handle=2016,i,2525125056694028614,3133594959010956552,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3b7ffb87fe4af2eb6f3cb0a1cb64cc632fa31e23
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView" --webview-exe-name=2026-08-10_83cde762e13d8b0358db8ff12d1f6d00_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom.exe --webview-exe-version=1.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=2016,i,2525125056694028614,3133594959010956552,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3b7ffb87fe4af2eb6f3cb0a1cb64cc632fa31e23 /prefetch:1
    3⤵
    PID:5752

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 923ba16938a6d470535a5d0400e4a56699c71653404fa0550a51ae8423630199
MD5 a2488f55b377b6b4bf8c8a5375e9ecae
SHA1 d204f92fb697367ac013a2a25fe40a6cddce879e
SHA512 eff7b6b297888df3b8c2a376c7071d77f1476c03ed125628f94cf91a6ef30ec80757f97779b7a4552607c1e51977f954dd87c8f6ae6382ebb90bc7c8dd32df09
TLSH
T192D0122377920538C02224330912610A0402C61B400541459829CA1E2F080600D22441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 efea5342cded818f320a46e092df9e540bd5333d559cbf8b0ae2bc7b81f64dc1
MD5 3c4858ace7c703c6543925697f4c3fc1
SHA1 70618a0f1140580e02275866a5cdbb5af5a5766d
SHA512 3206c9fc9e57ccc066fdd60b67db7d4e1f659bbe71855b3d7169b9050e445c2f18ee04e61ff6aa853d6a584753e956846858aab5df28462cc9a117afa36e014e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 439dbadb688704d6e73bc33a9bbfd05fd445169aed96f1e6bd3669cbf7d85efe
MD5 e23a79e753840b9b58b7c55cdeb45112
SHA1 c0aa8e58b4f27f98c435d0f6dd63bbacacde8011
SHA512 3edec9455180519364e2d54caaf32af26772b62afd11c69541e397c5fb62aafd6b4ffbfc4b6e0d56f567ae61ac9ac0935809dc4b2120ab90e0affb2c3a8186f8
TLSH
T1DCB0122052144483C71017B901F208017EF5191041138B0A538CFFFCAE3D3957F12144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599486.TMP

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599486.TMP
Size 48B
SHA256 a6d37f2c148dfe843ffcba62b471206a20b161fad0d52c9a001fac07e675e338
MD5 375856a658364164afd9897d1727f289
SHA1 fe2eade890aefd902c2d43abd44dd04cd0e48b30
SHA512 791b1b57c85dac41e35438e58eb1a5d8ae47d826b64c05cb9fe432eaf7cec15a2c5db366da902328a0545e072de15912fa0f0cb746157bc0da08c22b8bbdca3f
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\Network\Network Persistent State
Size 586B
SHA256 56922c2f0edd89c2c30ffa716afc6f37e06a9c67742241dc9b2f1ce955065725
MD5 5e278be997de8f4df3b97b9e4ab0c02e
SHA1 893b14544fb5c4e914670cdd8dd396c0a0316a9b
SHA512 3ce9ad54b0dc9cd7a26029c82c477886ad35de641fac1c2e63679ac6ed86ab6de8aeca4ee8e1f3153e7dfc6ca6b2a961827ef3630a2f26a0c35feeb0bd880a4e
TLSH
T103F081B3D2E496BD8A4263F467242D17CE6D0506532C3E5ED5F46B2F53E1478D21048E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\Network\TransportSecurity
Size 184B
SHA256 46d3dd355c25ac8024dc57b4e084bacc4bfbf362aa145cf1c08aebd7ff091e38
MD5 51bbcd39bdb439804889bbd0b21cbeba
SHA1 0b5c9f532a6bf963fee7bf9b870137e4d625a732
SHA512 6693260c1754405f3c1cb42af29f11cbafb6bd9fcf290eb7a5c3165b40d8d56eed278c52a5e6e1e8e68ea53568cf2bba30304d84712a18cfe4ae03e26021e089
TLSH
T1D7C080F2407FE5BB10B84A251984FD4D5F76F534518354E8D7A25B7D91901767303057
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59d112.TMP

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\Network\TransportSecurity~RFe59d112.TMP
Size 184B
SHA256 a3bea231cd3b1de2738b27d5d7a17adb70c8fdf622b29759793d333fe09752e4
MD5 1a832385a0d4d2e127b4b4808ac6f3e5
SHA1 cbfb10b21d2627397eed1ed45d13dec69389c41e
SHA512 0d8bd6b4764922f3d1f86db624ac10cf4dcbb31a52f95ae30ded79b22534c2c025309628ac47dabb9500d68d1247cc679b70bd416196985245b88506a27d0fa2
TLSH
T1ACC08072407FE47A10B8472639C4FD455F3FF53401C155F8D79245BD909417E5103017
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 52bbe7dc57d3b74ddf5464d085709debca6105d228b7d2301d01ff74d7b58c02
MD5 29103eb8eceda604befc9fef6df4e1f8
SHA1 1c12f9f1cac65aaee14109df18ee56c07ce8a1a0
SHA512 b6ce5b6cc408e3c91c723af36377b7712a2dc5cfddf00a33a321ca33b76ae69cf871ca050f86972d27ce38037d7e52ee5258ee4b7285270711152f0b110d48b8
SSDEEP 192:stTtqAjHRs4oyT3sV+FeTkXl1woTFHj32u/G6K:stTtqAjHRsG3sG6EXwAxT2ubK
TLSH
T1F2D1A6025E28797B4CCBE119BE25BB16E3FAA07261E11E58E7FD451C08DAADC6313D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

d7b7c8f8-2ca6-472b-977d-f0803033ad25.tmp

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Default\d7b7c8f8-2ca6-472b-977d-f0803033ad25.tmp
Size 6KB
SHA256 17e78e7800baa0fc0576e668604868f1ab9669f302ad3c9d8bd6861eacc8a5a4
MD5 e2de6cb8d5440425ddf13528624b453e
SHA1 c90d1fea2ca6222864f42f67360431b362102fd2
SHA512 15337ba83ee63d9ab4ca28ca19c2ed2a742056fec2d9e8bc22fbc3861f2af1ff3793fff97bef4733d431f9a98668fcb4458b1327ae4779c15099c48f4a02f9fd
SSDEEP 192:stTtqAjHzs4oyT3sV+FeTkXl1woTFHj3yT/G6K:stTtqAjHzsG3sG6EXwAxTyTbK
TLSH
T1E0D196015E28797B4CCBF119BA25BA16E3FAA07260E11E58E7F9451C08DAADC6313D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Local State
Size 15KB
SHA256 23ebb86d79d4290fdaecf41538b168a8677f311a14deb57140e984b25b0aed7a
MD5 c1045ef42adec6f48c4680e7a098ca19
SHA1 2b5b57f8149a6797ce8a9365c2b4af0fa96acaa9
SHA512 7e0df6afba8feaa7ce5b6fdf70f6a65c4765e42a675bc6d5d3110b4eec3b49cfd41b1cd5758e02e49c81caba2342f9af28618d7370c6265c200bc076f23f8673
SSDEEP 384:Us+aQikB+z/xvxjg/qhEZmNBS5LtuH+xB7uMusAVdp6qwYFN9zDI:UL/UxvxjgC+Z3L0H+xFuMusU6qwYFNFU
TLSH
T1CE72AF2B997D3E3695FBEA053D5D174BCBB8D4F290812EB44AAD6F0D06C72E81342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Local State
Size 2KB
SHA256 5121aeab1b8d34ffa68b2a4ff40caa21f53b09c65ea88d9691f3e36bfba3e303
MD5 fd97547ef8b7848d59ee862250e492a7
SHA1 363254a0a393242c99eac60e48a7f6d51e286bee
SHA512 13a76e84562d008f822f161187491b48be88767c9ef643061ca7d59ccc15d58a69de4eca0237a2842e5c761d2ceb6a574aa8cdee8e0165687868824b191e69de
TLSH
T106517773EC18BB36C9EA46457E4A3F238A7591D6EA121F6086CD1B0C01D79DC1341C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Local State
Size 3KB
SHA256 79c4a4ccf2470083b7eeeb6e07f5ddc3832b3a4b395b0c701cc54c08e4b8e923
MD5 c8787feb72a9736c248d237e27d0044f
SHA1 5d9efca2de25f0e72a758faeda836f8dd343f160
SHA512 0fb578567b4c4b94191db1df768e50afea93b1ec0977d8f18d0d558057a96b8235a077e2483c365143dadb80ba80761203c9a4a53fd79365f9f13b8d1cd8b2ee
TLSH
T1D561C637AD38BA3B8DE79A05BD863B16A7A59063E5913FA1C6DC1F0C01D76C81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59333b.TMP

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\EBWebView\Local State~RFe59333b.TMP
Size 1KB
SHA256 986f3384e94c823efb9aa4f2d06b4f90f4f85b1599ec7f5aeb94e36167b58ac3
MD5 5c564438d213bd21e7ea7eaaab18a7e2
SHA1 3501c6da5e3fbc91d620dc46b44e0852d39c62fd
SHA512 c0f54f681d14feeca13068b7e525dca4cf0552cf4774b05781d7c4febc91a9790a74ab8d9583543a1a827c19b5cb5e969f240f98cdff2fe5673ec1cc0e8798c2
TLSH
T1BC2195B2D8282F31ECC9664736473B570E60A1EBD2110E0091CE6B0C02E79CC92A6C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d65fc8e1bdb6e5d500596116692e00d651af55b75725f8ce8ef97acf23dd5f2e
MD5 5d5bec9e4f70bdbc3769edbd7c72a271
SHA1 79d5d89fd3a3bbb9f7366a33d3e0b07a77e34f2a
SHA512 cfbf13547eaacc7d3676387425784c26783311eab239632401bd2d1aff183a9dac582bb059c2730d158e50c1b057e7128abe5985cdfac08ccc6a64add40ea459
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4d51cdfbad00efffe6f8ebc334a1c8737ba9a146a627d1fb87231306b92b22b6
MD5 375e2ac44a2fbb55eac5e836ea54e32a
SHA1 c7c6abe51919adcec4bf7ef7a5a0b1aae40a5ef8
SHA512 6572f312e915551061d651eeef683fafcac1469b800be72c2bbab063c90a768fe99f00e5250a053925de7e05d68503cd3eea864fe72a1886b02dce01c7dbd39d
TLSH
T1FCD0123277010134C0203433000261C92500D52F4105810164288A1D2E140900A42453
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 3cf68b1fc93512511fe85607dc9ee46ea2f2b345101f44e5c871d33f9fa65fd4
MD5 ee56be4fa7fb449b3cd77e49200d5d4b
SHA1 582803c37f4b66a9e3afa565aedc44197f584460
SHA512 c1942253b136c0c5532ab5b982701355db03e9ed11321c93dad4ded08b9f90975d319c2ca4ab6c2d6dcc7403dfd3a852d3d45b9121132a1af923076e69e6099b
TLSH
T137314BB7C3D9812DC95107F82B256F1ECE1E0A1843283D6AC8D8AF5BD3E1471D22464F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 eca6a5e2065556947cdd1d3f4ca22c704fb5d326e2f9064da7feb03c73bacd6c
MD5 3e7983ea296e1b8e1001b0db657ddb62
SHA1 63f00e1ad53385e78022864ab2517cb24c37c676
SHA512 12b20497249e360d53c7684b3c49790647b9a9bfde8d36d641cc0a3b2f1df95d6305b820d833a002ee92816b1e3374191fda52a4ee41636379bad778d5df5ab1
TLSH
T171E026A3C079A937227C0A6B2A85BE197F76B934224294F4CBA2876C90D05B72703457
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe599d8e.TMP

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Default\Network\TransportSecurity~RFe599d8e.TMP
Size 355B
SHA256 67db72c3f1084b6926c54295a99efffcea8be80137cac0d58ec40cb48095e78a
MD5 fca821e8b51d17817fadf210e2bf9c1e
SHA1 0afb0ddf210d179a395d4de94f4e932e5c21c2cf
SHA512 3c56b91f3d4d2b54f140640c2fc6568a404520047049dea785ea2af1cc68840f4da1dfb5ab02a7e7d04be5b8249f16291559c217fd21c3f9b6ac2d95ca8d92a5
TLSH
T1FAE02663C0B9A877207C4B7B2A94BE197B77B434224054F4CBA3C66C90D06BB2603417
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Default\Preferences
Size 6KB
SHA256 fb8e8ad7350957831dfec82ec24cf9d316364d3d23e65fa25433f2645274f8d2
MD5 e322c3590ad51379b1efcab66f0a2eb9
SHA1 e5343d2b69b04134273ed08fde5e04810f6aa207
SHA512 94ce5b98dce78869ba36dd8cc4f89b4f5a7940cb95f49f536972ef7256cd70656f5b65e1b3d5b622bd9d491d8798b5a375ed54518a9e10cad07994442e9f0823
SSDEEP 192:rTAaA1UEt3qeoZTadTksV+FbT6X9QjHhJcAFsg6K:rTAaA1UI3qDSksGnG9QzHcAFwK
TLSH
T1D3D1B6036A28697B4CCAE109BA25BA17D2F9907175E52D68E7FD492C08DBACC2307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe599cf2.TMP

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Default\Preferences~RFe599cf2.TMP
Size 6KB
SHA256 7d27724511225124a4bca850d79f6a0d08081e3b83656134062b30c1cf9fa82e
MD5 02f6acdc99464ac276ea86b1546ac541
SHA1 aff3989d81923465cdb14f54f2863138141c4538
SHA512 6f00c924594310ba505f78f5429f1c26b232095194150b05152fb5195ccb151761caa556c61cfa2a302b093afc7bc21d1c27508216b124084c864c4e4dd424cf
SSDEEP 192:rTAaA1UEt3seoZTadTksV+FbT6X9QjHhJcAoG6K:rTAaA1UI3sDSksGnG9QzHcAmK
TLSH
T1F7D1A7036A28697B4CCAE109BA25BA17D2F9907175E52D68E7FD492C08DBACD6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Local State
Size 3KB
SHA256 dd45461de676dd8a2dd5123ada5f55cafc506616b5c10db500ad52e223a856ef
MD5 b89b9a8956dd3d85e04dc3d112853d75
SHA1 77c1ae6b7ba6f0d77dec24ca7d8987181273d032
SHA512 7af3505aa98412d03526161bb9de216f1f713d18a0d053e4d5dd3b4df0b4bd35b47dd58f4655bfcf0a92039f0c3df410a9de7bbf61773b64cb344eada6d9c14a
TLSH
T111819532B934B9774DFBD606B9813B17A6A99063A5913FA4C6EC0F0C02D779C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Local State
Size 2KB
SHA256 611152a601dbcbf911dc17b530a9032d68d222ba2624fc0b7e1fc8c7f67c8774
MD5 bbc20cd55b8418e4aa00ea6c594040e7
SHA1 1ed07370482d549f0c70664464eb8c5e2e3d6c72
SHA512 db627f55b614ce675759d4e3bea02eb72ade576edce871ad63917fff87286fe5dba3a4e4b3f992640c4f971449665320299e1e78c98409aa1460d517579dd4c0
TLSH
T1A251973278187BB785FA56067D863B238A7980A59A521F60D7DD5B1C01D7F5C2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Local State
Size 3KB
SHA256 a82876238e0cd93c9565c0d36cf60499969f02992bce78aaa3cc3e61e4f00d75
MD5 f216411d9648efacf2d5cfbbbf089492
SHA1 a516e50b88818a8ef9582864ab9a71499ac79805
SHA512 f48def49097c159d9f77a99f828f9560ddadff9780252c34b6a73cb26647e16ad97f641748d746c647b77cca5244fe87bb574d6278c6e36b339f16a089422267
TLSH
T1086197367924A9778DFA9A06BDC63B16A7A98067E5913FA4C6EC1F0C01D7B8C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Local State
Size 3KB
SHA256 23639cabcb7d6a01ecaa503f86db8c3bdb43c6b558f9be849f5f2e485487942d
MD5 dc60c90bc0d4b7cbcc47fea8bd171c73
SHA1 0d0cf7157f783baa8f302b5906bf2da2317a145c
SHA512 bb6563d9b6eaa9cdbf49001e647ad140364604c3b57834488aced596fa8c19f15a49859b786311178088c4c3f2e143d3db4ae09639f7dda677889affdaca797a
TLSH
T137818436B93479774EFAD606BD823B16A6A88063E5913FA5C6EC0F0D02D7B8C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe593e28.TMP

Path C:\Users\Admin\AppData\Local\com.zuno.desktop\youtube-login-webview\EBWebView\Local State~RFe593e28.TMP
Size 1KB
SHA256 77d92716c853c2d7eb8abdca7d948ff6d505338cab9576d89732f8cd7e8152f2
MD5 9d8304c00aecacfe6d3968759c9ed2d9
SHA1 a1711f5cca3e2a1f15066435ad260805815db2aa
SHA512 3cdbf3078962206385253c99596820e12f8e0f57894f2f38908d8b8665016c5c7ee7629d119194478a7fc7e514def3946cd3469022d21b25c2145ae8dee752af
TLSH
T1FF2168B2F4293FB29DEE524765C277574D2480BA82510E50E2DD8B1D07F6D4C9556C32
MD5 SHA1 SHA512 TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 a50ad5b0aba88f00fa8324aba7f935efbecc8a6c66bc480d2ef95b1df8f376b8
MD5 64eb86335fc4cb7dbfd7b8e7d0749a2c
SHA1 a2690fc6e2d63ed0e995a7d15468281e56385668
SHA512 71b079c923f119fb3a2bbbf251f3830e43fcb30ea874ba9f9dfc566c822f972fe742415a1e48da3a73880fdf1765d2b2b63f9cd713d3fd69de132378aca6fd04
SSDEEP 96:jn9uAzgJ6BzHu8z+QIe9u8zgJmDzHu8z+6:j9u1UB6fSuRIf66
TLSH
T1C4A1FF054AE50B13F2F7DB7255733A81AA7BF945A6084B4E00C693150C61F44B8F8F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 88a43110b567caa64b0478d82d7f1572ebea8b6a02bc656220a7e09f55ea2a9d
MD5 c15297962d04460bae4a2340d85d08b8
SHA1 a59f307b890f7500fe9ebddf6a7cfbde0088785d
SHA512 72c025873ec45c77c1d20c013f1995d4552f97225305411884b5f079f5e2e0a2baf782e89ae12eaa2dc5a45b8d4483d8bb724ffad50d8aef3a821403f1a23d64
SSDEEP 96:/e9u8zgJ6BzHu8z+QIe9u8zgJmDzHu8z+6:/SuRUB6fSuRIf66
TLSH
T12AA10E059AE50B13F2F3DB7295733A81AA7BF945AA440B8D00C693180861E40B8F9F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 50B
SHA256 3d429433c7b6627f1f453e37753b471610ecafa1993f60ab3697dc081b305d41
MD5 3aac4fe25a01e73b72ddff55fd864193
SHA1 a1cbefa651a7c4ade78fa6e1af54d18a69d7f7b7
SHA512 809db6bb1a7db49b01f2f3a97daab044d40bc4fde85d2f78566523917ff4c7dcc7a79e09c0f1195c535ac181558224928185a685599370739901891ba3ed7730
TLSH
T12D9002A040942CB589A4E7095AB2575315584D6511856524505101B5664602741014BA
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 72B
SHA256 59b8aac75dddd06dbddfc43b197ce670b26c7461724cf885c0c345c97d394546
MD5 d88991aad2c7fce819be8738410ec451
SHA1 24338c05f473ba131a6ac63e918a51290d3fe3b6
SHA512 4ee0a77debd616d4311a4091676179b4781244f148d351edaed7a87ce7756e5285f8b88ed5170e082de5bb3b7dbe722b74c25dafa74b9c520b1eb7a188343d1d
TLSH
T1DDA022B082E83CF888A0F308FBBA038302280CB022C0F820800202F8F28F02300200FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 87B
SHA256 b7d9157f591cecbf0a8e543dc8686a3e3c772bf5cce1374b65eeed5ad4658861
MD5 2ea8e73eb76410c6174ff06e193d7d91
SHA1 c8a41db2ed705d4f31db40050f289ce0eb27187a
SHA512 a6cb1ca31fe1bc7b3ae33f8eec37813e5f97f4cc3fbdf8566eec67dd90d2ef30f656a2ec017f2924c5da68a9cfedd9552beee4ae99b4c577f366c224d22a4011
TLSH
T167B0126849E41CF88454A308D5690567071C08B112C4A470C04005A4A14705340204A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 125B
SHA256 ec08157e888a1b6d7222b866934cc7c4bf790d0c52b7c4350c14fa6f8803c0c9
MD5 af05e94c61623cbbb1158ccdf4733ced
SHA1 4b6394356ebcc992d9e8f5a069d228cb9e155497
SHA512 2138db4acdc0f763772733b9207aa04c70f5dbb4737d1545a0a4bf71e03e76a3f403c9ffb228ecdcd4737094c1183d51afca1241f27877af7e13b5b480f89ef0
TLSH
T187B02B1400A00CF80470930CF7DFB323060C046022C0E115C011146070CB06380320F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 152B
SHA256 6c7a0f2a7e45fff33a6b2da2c3754888747916384a8f89f844da2a18fe6b0e59
MD5 bb330e03f312c779a2ab0398d46afbe1
SHA1 3b8670b7c7b2bbbf7d090e235f09f58c77333426
SHA512 f251b6c3ffcb42717e3e0d499983d94279adb76cf40720a4cb38bb58fd0c492ac0a51b22de45c1d3db87b0f805359ccf69fb0832878125b8016ed905d76eb8ec
TLSH
T172C08C1455A019BD40B9930CA3AEB7660A2C48A122C0E415C0222571B68B06780229E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 179B
SHA256 91d6b73bd0055652d24dbed84cd9f162dd836c3f76435c7e4560d66cfa391358
MD5 87917fa86dd62e578441f218a2773515
SHA1 1f13bfd0560b08e58189f9f571c002b7605e2303
SHA512 0db810b403465d70693e3c9703be6e35d2cf68d82f6deda94ab5f1f0ff7f8c525973e1961d4c533819cfbb3c1e2fde927ec87b9d7b3d8eccba35e0755957007a
TLSH
T116C0805419D025FDC0B5D34DF7AEFB530B3C487121C4F554D0171575B59B0A740219E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 213B
SHA256 b51bc550a5bbb8ebd1913186df348ffa733c84a20abde455f7443bfb5d15ba0a
MD5 f80c816f644e8ac2d378d0bf1bf719ef
SHA1 251a62c1d18fc677836d50034d0bb9e4e287fb34
SHA512 4621f0a6cb2290c6d59447f5ad4d76f1100e943ffe05b544982fa836f493c04e80464fd63c2599668855c4e64d9e9991a19afa673df4286945d03bbb30a382c2
TLSH
T182D0A70114502AB88065D30DF75EBB22163C487161C0A510E4262078A56B06380138A3
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 257B
SHA256 4fb9271354cd528f57e1597bee1dff8d139072a98e3f2449a28377a1c73129e4
MD5 116c703b764023863938f6681e6a49dc
SHA1 a666219f29032a431e480669bf9f0aaad4c56eaa
SHA512 d90b3c0de9adc15eaf2c1ffe6324673922f413d2a9a2df99d5457ca0a19869fd154caaa2d304a631f5763f9fe744360d624b84a033f97da802549d9fd5f9cd36
TLSH
T16CD0A50455A02678C2B5D34EEB5DFB13173C487151C46156F41734BDB5BF5634113C67
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 284B
SHA256 58c1ed4081eba5fedb0d6445b291329ad8c49c5cd9c88607dc0f8ebc3b25e154
MD5 5e381155bf16ca1b9ae5e4a33c437b4d
SHA1 559ecfbecda108f116d93f111324969d2fcb60bf
SHA512 f91b09f855dd841d651526f18cf9444e3f6b93770411eb377ec90e8507375233e4cbccc61b995eafc7c60c5f8233e1e423265aaf8f291bfb64f73bfa6b23d4c4
TLSH
T158D0C20404A1267882A5D34EEB59FB22273C483162C4B245F4173479A5BF2A34123867
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 313B
SHA256 389e29c961044c0fb297f2f8f2df418363afd82b45748e40aa30f05e3cde22fd
MD5 770d8c68e626a8aa2316f52a91af9d84
SHA1 04da7ceace531dc696e626568939a16c5f72be4a
SHA512 98e966abbeeda4aa46597420cf208a4a2cdab00f9570299e23f4f8695e256cb4083d0cf62b1f8fe3d6ef31a694452310f981f73d27d6f6c904a0c2f9353f7b4f
TLSH
T149E0CD041591367D81A5A34EFB59FB12173C483162C4B155F417347D75BF1D74123C67
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 338B
SHA256 49200e05377e4401c14f4992088b1f7d4690a5e98863092221251ef4f2d1c974
MD5 63e498f794f542e3148f72727c93aee2
SHA1 635d1b9ba596e54fd95ffe239834d97bf4fb6b81
SHA512 673acac4606d4480e16685bd34409d4be59a5dd72f8da754b81fb9710ae5862b421988ab9ae4beb8032c7950dc5963cfc9029b3428383145e00aa1716e0860c7
TLSH
T125E0260411A0267C82A5A38FEB5DFB221B3C48722280B249F4172479B5BF1E34223867
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 378B
SHA256 f72dd184d9273604ae05d9f16f1e4242a8ac53c488d19932c57a4de13682e9a4
MD5 afd78774f2dced7e1d81c7860cebc855
SHA1 4cbbbc59130f5f836583972c33d23008274e6cfe
SHA512 01373cc95c5e7922b96eb785342491a1265fb3ac76a7509b0cab3626fbca3b59a6e064cc355f222c616acd5c1b4a5068fc1f00601f92342944e36c7bca3e4506
TLSH
T123E0680481A02ABCD2A5A3CEEB59FB121B3C487221C07259F41B6839B5FF1E74132857
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 405B
SHA256 019f69e2be5f4599f74a2b7859864b68d91ca48516d47c40c69a9d5adb6f8839
MD5 460554bb205030461cb7ebfc64f427e7
SHA1 ecbef8f80d0560517179debb715c0ecab1262a0b
SHA512 91158795f0fcf8fd1230d35279ee5b7505fcf288869d7810c9390fc3e40813ac715d1e3f3173f6a5237271c4360ac65173e8948ee36e6d40201e6e4ecb874f78
TLSH
T15BE0614840D015BCC195638EE759FB12173C487231C0B165F41A683AB9FF2DB4132857
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 438B
SHA256 eadb8870e453d829ffb4f5daad0b34a31a05f5ec7c2c02d97c857eb59c69c73e
MD5 240bcfe152625661329577a3637b3cfd
SHA1 b3247cfc9c4edb5d56039dac9d58ee1ee1532831
SHA512 d9099240113e1cab57160a242a00b290d4ffb4ae87260383986034e11246b81213d1e4db57a1328f54840ed5a81d341fae0e0d4d85e7e05d155d033e0bf9cb77
TLSH
T1AAF02B44909029FCC195A38AEB59BF131B3C5C7261C0B166F41A687AB9FF3EB4132857
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 470B
SHA256 cf6a75a8aacbe7fd8f630be50d39e45faa8e34595eca9ce3fc0c8c1f76b62a81
MD5 fac1ab2364f6b27162439709f693278e
SHA1 c820c9b4c55bdc668d6f34ccfc15fbeb65157c91
SHA512 0139e82de07b2b984077f7b7464189dcded0d6ab37b4a015368e4d7c34e2588d3839408f4c33a9dcbee5dda32aebaf61743cb060caf483c93b7588835673a203
TLSH
T162F02704819029BCC19593DAD658BF13173C58722185B166E41B68BAB9FF2DB0232823
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 3dabc1f3174cfac10113f5beb102fb600d4679bc2204abc213a3d534dcb271d2
MD5 75ec0312b8333a52f13e9ef1be388d7b
SHA1 14139549c4cdb5985db1588d0f6b160064fe5e45
SHA512 f75b757bb934d1c5305ee9b0836eeea7a529f2f02f1ca29f0aab77eb92214e70db1a62c8a1174d324debc2df6e7b489e66f5c5c64249e79cf43bd23979b37c24
TLSH
T1C321AC6F30FD5D74C6E34B0DE28DBB121B3C273A12906512DC6DA539A9FA64F85018AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 d84cd124433cf7f8bb1fdaa26788ad5a602edd65e6ec08e4c4067712f37c4b37
MD5 603eeb9df715ac541566a7b33f88cc1c
SHA1 bed0b480b87b71e6b565405f99805d23733c956d
SHA512 e815ff641c6105b4e7c51f13ea8bc8908bcf386cdcd6a249a390c347fd78c109afb8834576b4e8011f06cc74feb5a27813f5e346a66c423444a74baa3616bfbd
TLSH
T12D31DB6F30FD5D74C6E30A0DE28DBB121B3C273912906512DC6DA539A9FA24F85018AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 f06be99aa5c9447ce442c0fa3b2c34f74475939419be110c8f5962a23eb2a936
MD5 bd7a5bf23f6bbb7d45e0b6751bae992e
SHA1 67c91b97d80a2b69a4607a9b252cee236ab2f25f
SHA512 87dd1a9cc88022e267a01d5882a17395c1cc97d66be0013d823be44304a367ace589605894217636995c6fc1c7a84c31df87c3df33e117286f45ebe651ffb090
TLSH
T19431E96F70FD5D74C6E30A0DE28DBB121B3C273A02906512DC6DA539A9FA24F85018AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 bed9fb8a523c093b31e829db24ac4b809f8687d8dc6849d87dd4fc8b610696dd
MD5 7b08705570171f9a9cc70f793a3340e5
SHA1 dcc415c797c98dc03e977a4dac90c1b8e37c175b
SHA512 644d8c164dd39557178172eab92a99c37661685c04010e76da28c4b1730833e09fa98e51f40c277528c27f3cf6fff56dfa01898e9aa6e9d0128ae7100e966ed3
TLSH
T1F031E86F70FD5D74C6E30A0DE28DBB121B3C273A02906502DC6DA579A9BA24F850186B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 431633c9cf5dc640d154085ad03cf8195e3d2a11b94a6385a041f5fbee6cb05f
MD5 998f5606b590138cc5107cd844a3901e
SHA1 6d96e400e34f95f7723bf63cd5423e685babc741
SHA512 22e10fe4dc6b5742b442fa6657db87cde47bb927d671691c6d45275928c0de033e94dff836715b80e2cdbfe7db46ee5b4632a7b4753e2a55557faedc64087ab3
TLSH
T1CA31D86F70FD5D74C6E70A0DD28DBB121B3C273602916502DC6DA57DA9BA28F450186B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 b9b1d9931fddb8aa46ec624dedf1129fdcadfd23dbb9b3c0f7a1a0aa1a7bc1a1
MD5 2c3485f2623d45dc255cb63fc77bc148
SHA1 73ead686e40c0ae2561f9553ec308731892a1b05
SHA512 b1b9cc5ab03d94f4d415e3667cf8382a1bbd739d5f9a409c05c0d9e21b18fbc9b8063418c56da8f9e0cff4d2f52b7cd0e6e2d8c931ed4c51d2f074792d770ea6
TLSH
T13B31E76F70FD1D74C7E30A0CE28DBB121B3C273602916502EC6EA57DA5FA28F450186B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 c133a0bd510d1a520a23f64587aae4b706488c76c6ceb54248d3c2dfb738db7a
MD5 43d2e25147a4273c4203f76b598323c2
SHA1 a4713fe43210a0880c72730993175b7f06a806bc
SHA512 d57c7cb17d660acfe891da2567719cb7c78c83231086ac4c8d530e10a5bbf38f85f4e1e1406ea8bc70b110e7ad60a801452ba35b22bc6fa11693daa82fa4cb82
TLSH
T1BC31E66F70FD5D74C7E70A0CD28DBB121B3C273602916502EC6EA57DA9FA28F850186B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 0f744036fe5a97c6f639fb15049a644e4c3d08e5838908cd8ddc470b1a145445
MD5 efcf2f4dd54587cca73d5f113fb96d19
SHA1 f60832389f5128ed4b82d9f7ba300d44c38d8b88
SHA512 6507cae9c1ac92f83d7d64bf9a85b541fffc97a0fc848db198545e6cb9afb29c912926a5091f1997a65d3703215c846e379cd598e9a0578e954344aff906d6a0
TLSH
T13C31F66F70FD5D74C7E70A0CD28DBF121B3C273602916502EC6DA179A5FA28F450185B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 c04c3de071158fa44170cbaf677145346f3391b67d56f342702a9581a8b5bccc
MD5 f6a7b99ce9c4336d8cb5b51523c60bae
SHA1 d3d6b89a158eecabbad3e243c31d46ce7fb2c5c9
SHA512 03cce437bd96ede081705d00f777ecd14970c8bd15f59e74c65e6ed5d399540db32c1c59cc1051e1aeddcbeff7d6bbb05432d78f37d920cd467946dd0f87b23a
TLSH
T14231176EB0FD1974C7E74A0DD28D7F121B3C233606A16502EC6EA17DA5FA28F850186B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 316dc09efbaa9820e15579d0fb0df7181bf0deefe46408466a3bec312ecc39da
MD5 2a734c11f7abc2e7d76a837769cfc211
SHA1 6d542e8644e69a0fe089bc55988447e7c20e9597
SHA512 6a700e00535f2d188dc90adeff819cf5bca9e075b35c37bce66198b1df7c47368631ca1f2d6d1ce98829212fa567a2c6f76ba0ddabe4c8ac71ed85524dce1baf
TLSH
T18031166E70FD1D74C7E74A0DD28D7F121B3C273606A16502EC6EA179A5FA28F850186B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 dd84749e401c06366e56b4b283a482db2d34faf7c3af7ca5023aa2f0a281c769
MD5 165b41d2f6bc38d432a66a8109758600
SHA1 93e3958979a2851ac73ce708b80029dc5f39c1bb
SHA512 312ee8d68f54ce69738426f3494d0d3b38a5acecf7685155a2660d22ecce5d1166a41000f2d3f07b2ecafa8f699ade4d5a0f80696b4b1a105a0f922ea1d22cd0
TLSH
T10D31266E70FD1D74C7E74A0CD28D7F121B3C233606A16502EC6EA17DA5FA28F850186B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 1e0b2b420bdcce21654e5e0678ffb9d0727f3c0956c6b58219842e1e9ec99183
MD5 5a9d5cd4dd1863e92258d6c529adbbda
SHA1 5b20629ba036c29c3e84b9ea525615d58a5c0928
SHA512 6b9ab6e395000cc8ead55b32d16d4b178c0efb24ce4590a153678f8fa1d4b238bc535095d35bd0e28948003dcbb8dfca1cf76849071aa616cea268a100de085b
TLSH
T17631256E70FD1DB4C7E74A0CD28D7B121B3C273602916502EC7EA579A5FA28F860186B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 3f9db08071deb0f5453b86f77b98be2366da5f9226eec8aa9784bda15a634c1f
MD5 ef22674a1bb5ec73c329fa7f66fdd675
SHA1 f3d9bc2a2b8a33b5d32a5c68ce12775a43885795
SHA512 c3c368cd309652bb438918eea87e6945423e21881e6fa8d8971b99e640f94c261162a990c7d4cb0b947f8d63a04fddd49bc160d7b0da24dac0b997276e919d71
TLSH
T13831296E70FD5D74C7E74A0CD28D7B121B3C233602916512EC7EA579A5FA28F460186B
MD5 SHA1 SHA512 TLSH

Submit Download

settings-v1.json

Path C:\Users\Admin\AppData\Roaming\com.zuno.desktop\settings-v1.json
Size 1KB
SHA256 0c0c2c20ea23a24eba6a6bf72b5551f3f15bbb302950cf5795da7f770d64acfc
MD5 5374edf9f318abb228d12523e00d8b1d
SHA1 a088fb7e27df6231f1f295fb6c31c333c22d7be6
SHA512 d347014910c6cca29a595434aaa6090bfc8d96813b97901842d8c28cc922f9ee9e7e6b8f965d9384cd58e2b650448097946a96533e92570ff5e5a7a0cc2cec11
TLSH
T1D641296E70FD1974C7E74A0DD28E7B121B3C223606916512EC7EA17DA5FB28F460186B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1268-833-0x000001FAB4D90000-0x000001FAB4D91000-memory.dmp

Download

memory/1268-835-0x000001FAB4D90000-0x000001FAB4D91000-memory.dmp

Download

memory/1268-844-0x000001FAB4D90000-0x000001FAB4D91000-memory.dmp

Download

memory/1268-843-0x000001FAB4D90000-0x000001FAB4D91000-memory.dmp

Download

memory/1268-842-0x000001FAB4D90000-0x000001FAB4D91000-memory.dmp

Download

memory/1268-841-0x000001FAB4D90000-0x000001FAB4D91000-memory.dmp

Download

memory/1268-840-0x000001FAB4D90000-0x000001FAB4D91000-memory.dmp

Download

memory/1268-839-0x000001FAB4D90000-0x000001FAB4D91000-memory.dmp

Download

memory/3484-19-0x00007FF941770000-0x00007FF941771000-memory.dmp

Download

memory/4432-69-0x00007FF941770000-0x00007FF941771000-memory.dmp

Download

memory/5392-791-0x00007FF942DE0000-0x00007FF942DE1000-memory.dmp

Download

memory/5392-790-0x00007FF942390000-0x00007FF942391000-memory.dmp

Download