39f975ecfec9ee9cbd2071427ece33e98acbe4d715a738b3a61fc05c8c80aa5c

Analysis

max time kernel
6s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe
Size 12.7MB
Sample260819-glrr2ael91
SHA256 39f975ecfec9ee9cbd2071427ece33e98acbe4d715a738b3a61fc05c8c80aa5c
MD5 4356c5987ff98dd1cc7a1fbcf3be93bc
SHA1 fd4a5ac6fe81ef6bb698ae6b72c308c55ada54ee
SHA512 92a035a94b76524c1e9b0b5bdb78027b0c0dc3d6b8ecf94efb163633b1f6364f8a95bc84ac0e51a4d863218d8cecadc4b5989d08df97d7509ffde61ebaaa1dc2
SSDEEP 98304:qajzJmyFWqbbyEImPdTW0/UKd52LijkhbScJzG10Ok29CERtxE0S25CbJDTo+uZl:j0aPgh5quo+cwmgsYCH2
TLSH
T14CD65B43E26291ECC129C07493166233FA72BC4943357AEB7BDC7A213F75F906A29B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4584	2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3968	4584	2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe --webview-exe-version=0.10.3 --user-data-dir="C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4584.2784.15040029935983303773 /pfhostedapp:0f0cf97e141b8e7b73dfbf6ff4f294e43e455fbf
  2⤵
  PID:3968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView /prefetch:4 /pfhostedapp:0f0cf97e141b8e7b73dfbf6ff4f294e43e455fbf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcf5445fd8,0x7ffcf5445fe4,0x7ffcf5445ff0
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView" --webview-exe-name=2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe --webview-exe-version=0.10.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1752,i,5620654778729698168,6476810992196146363,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0f0cf97e141b8e7b73dfbf6ff4f294e43e455fbf
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView" --webview-exe-name=2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe --webview-exe-version=0.10.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2180 --field-trial-handle=1752,i,5620654778729698168,6476810992196146363,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0f0cf97e141b8e7b73dfbf6ff4f294e43e455fbf
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView" --webview-exe-name=2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe --webview-exe-version=0.10.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2460 --field-trial-handle=1752,i,5620654778729698168,6476810992196146363,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0f0cf97e141b8e7b73dfbf6ff4f294e43e455fbf
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView" --webview-exe-name=2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe --webview-exe-version=0.10.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3380 --field-trial-handle=1752,i,5620654778729698168,6476810992196146363,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:0f0cf97e141b8e7b73dfbf6ff4f294e43e455fbf /prefetch:1
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView" --webview-exe-name=2026-08-19_4356c5987ff98dd1cc7a1fbcf3be93bc_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom.exe --webview-exe-version=0.10.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2168 --field-trial-handle=1752,i,5620654778729698168,6476810992196146363,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0f0cf97e141b8e7b73dfbf6ff4f294e43e455fbf
    3⤵
    PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 185baf94a898b1bb12a43c452a701e2e8ac85d2cf4492e21742b89e3f1b38dd1
MD5 24e53daad13973a1d32abe8785385687
SHA1 a6b4abadb916220cf2aaccc256a827d913cd88f1
SHA512 47f574316fca78297fa1ce585c2f422fd2e4baab07f63dca7b0e71e2affba83760e85e5a654875b8f7f0388fa0a703f05a840c5aa93d19f00a19f3152f6e7f77
TLSH
T18AD0121773120538C01034332542E5080800C11B800640045529861D5A180548B03841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 317f6ec5ed9a77d76bd7f1764b641a1b1cf87469655d6046e6334a4da51ef210
MD5 9d1f966ce659e954703a56a1f5e593bd
SHA1 cd0daf2c4df7a38d3f8f08b5e71e840aa3ebceab
SHA512 c73b5d4674ce4dfa3dd186b9932b81befa157f3c0ccfcd0fe64c3c7734715340561d6f4ebee14eec54a10b6c41deacd1aebe18bdb95bcf062a4856a8d6c6a404
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Default\Network\Network Persistent State
Size 932B
SHA256 7190bc00370cb121e7b822eee4ded3970eaec7a57e4c9f2219fcc816f3bca1e2
MD5 82dfa6d4708e9ca845fb7d6fa228fa18
SHA1 d56b4eda190552899b9fe2bdd68a2f5e56260baa
SHA512 ee6cb38ef47afbd82cbe7a0a2a1036ff870dca1550172acab9761e5f086f6a7792f55ef714c6518460cfea4b28c99c3aa597236c26f66190f3c574d200f7644b
TLSH
T17E117AB7C7F4866E4E9112F86628291AC92D082912687E3ED8D4ABCF53E1474D50054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b18f3.TMP

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Default\Network\Network Persistent State~RFe5b18f3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 7c6ccd3b9ab4f0e8eb58d354c2897571a46016632c6f1b70c2d2a5de430f5590
MD5 4f6f3347925eae898de79a2a93ede691
SHA1 f18e62a912ff0acf68498c9643ec2ac831135c2d
SHA512 5cbc26b429e1ddac040d5c862147587c84aa8d114933f11b37e418f037a6748575fe3ec42de682a85c1b7d7f9b4d4e365dfae755e21da1bcaa86b3f31b2105e3
TLSH
T181E0C0D7C47EA07750780D3648C67C411A39E43450D129F8C99202BCA0918F74603031
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a0d4f.TMP

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Default\Network\TransportSecurity~RFe5a0d4f.TMP
Size 356B
SHA256 aaba31e4471e47d6aab6befa041a89bd9ee278462251bfdfeeb0a0c0429bd0cc
MD5 e6c734144ec407eccb417a8ca38da3e7
SHA1 544bea0a692bfb6a134f14744ab6aea85fd9b453
SHA512 186466c000c15a94c798ff7336450a5a9c5906a442fdf5f3d30be7ed745da0b887aa61d45833109e797aa1f7286dec5abf671bd4f9511b0aa650ceade4b3441d
TLSH
T1C8E0C0E3C03EA07310780D360CC5BC421A39A434A0D099F8C94301BC60919B71717431
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Default\Preferences
Size 6KB
SHA256 88fb6fb0d7c83d8455695f73907f30469f9e297c31ca4ffb275e18852d5ba20c
MD5 ce65ae65f71943b34a5ad401dd08a7c6
SHA1 cd823708e9fd276b9087ad372df4acdb24167d14
SHA512 2b68d30dd269339601312f8e78f59c1d0d7a2a1869f1e7697e8df0553b0b44fa3c1a6df0c2a1d8d8c5b1af6f2429a0c1144804bcf8be5d35b124cbd54c45b9e9
SSDEEP 96:stkvT/daTB/0hG/b9Bk8o5h16ZgkSs7/x+6Mhmuec1kYAYYL1ejeDK+gnYSJos2z:stELwJBorBsV+F5sLQj9pG6K
TLSH
T1A4D1A6115E24797B4CC6F209BA25BB13D3F5A0B265D51F58EBFC852C08EBADD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

e7fa0809-665b-4ed2-b7dc-8f742800c12e.tmp

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Default\e7fa0809-665b-4ed2-b7dc-8f742800c12e.tmp
Size 6KB
SHA256 d7a99b9380afa757c5d7b8b43674b1c4a955ee8f560377133ae393a953df8ceb
MD5 6be14c04d39ca91d3574c7f2b88aa095
SHA1 f0eac3ab7e3d54540a0b709d92b05c92978a899b
SHA512 e6a20b8e6ed43c69993640c38d4bcc2c93ca5c83e4d1ed58146ee1c079aa6716002f1bc24d1c5d4007354563b88cec468f389c258a27de6318af96a15be4684d
SSDEEP 96:stkvT/daTB/06/b9Bk8o5h16ZgkSs7/x+6Mhmuec1kYAYYL1ejeDK+gnYS2C28XE:stELwDBorBsV+F5sLQj9/G6K
TLSH
T1BCD1A6115E24797B4CC6F609BA35BA03D3F5A07265D51E58EBFC852C08DB6DD231780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Local State
Size 15KB
SHA256 3fe05fae8c1ae59ed304883e3989f412554327d66b17571996ebfe5f104bf901
MD5 0b1241036df3f20fef49c968d40f4c39
SHA1 cda5ac13b690ae2234d52f1798311b20b04132c2
SHA512 77840fc438cb6aafcc4e8e444ba4fb70a44dbc66ab0c18f2e6a67cfac8460aa41bf13b78a78e00bde7a3ecee84403f5f985214e28b691ad107405c8c32b06fa0
SSDEEP 384:6+aQikB+z/xvxjg/qhENNBS6Q11qh8x9zd:F/UxvxjgC+63BFd
TLSH
T16F728E3A94287E37A6F3E61579591B4BCFB8D4A290C26FB88DFD5F0D06873980342D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Local State
Size 2KB
SHA256 e216625e174c40d36e99eb2dd9153131f6b749229c20f6edd9139dc06fe98888
MD5 0ca0135a8b17bc7530e3b5598b483205
SHA1 a3fe98d31cae81b793fb468bf7da705ce235bd8f
SHA512 0a4788e63d96a39da77d6311e5081509860d54ccc8b80bf5b296b85aaba5309bea98f8755c3414335679a762a8a022173ae54bffec0471a2a11a116be4a9ae18
TLSH
T1D951A533A914AB779DE3574C788B7E13CF35C0A2AAA21F609ADD0B0C00D655C1386D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Local State
Size 3KB
SHA256 94b0e1e02e002707e087e82cfef8c330a3038bdb49c69da7a8ab3a65efaf872f
MD5 bd6fa16b5f82abbe317652a198c52f6e
SHA1 140a9996079bff04e6cfa026e44b36cb30dc56b9
SHA512 9652563326f6598eb7247f81ec6adba88d92f7a435369489fddca60099e9cf76316807f521bab1d80fe80c81894ef7d0bf81d315d75eb6863af4d5e5c5825110
TLSH
T13A6196379924A9375DE39B09B8863B07EB758027E9D13FA4CAEC0F0D01D72981382D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe592205.TMP

Path C:\Users\Admin\AppData\Local\MuhRO\Patcher\WebView2\live\EBWebView\Local State~RFe592205.TMP
Size 1KB
SHA256 c805af585b76edca6db04cd6993d1faba39a0546c4d8415013007f187e0a3329
MD5 e0b6d0b46c03c95f7dcf0658bdd5a8a5
SHA1 8d0555be9dc7f533ca6c9d079a813c99f07638d4
SHA512 34da83e736244a897d1506cf967de51c34078d241e31101e5d5caecc93924d6757b87bb854e953e3c247dbd183252b525f841d6fddfdd6cb92eaf1375c90dbd4
TLSH
T177211272D8245F737CC226497087AE479F30806A96918F90A5DD871D01E658C96ABE37
MD5 SHA1 SHA512 TLSH

Submit Download

1027.thor

Path C:\Users\Admin\AppData\Local\Temp\rpatchur-download-KsSCuf\1027.thor
Size 48B
SHA256 0489f315808ca9405e4568daff16532e925ebd5dabb1939cf1c0f9aa60fda8b8
MD5 8544e376833edc25af13a66543c2f63d
SHA1 cbb6297afbd72296e627fd7e53ca35ef5fea704e
SHA512 a60d5ad04c99ab1a756ac342f6c804c2d0983052244e092c41c04a9bf02fa538162c3697c35e46de260d8c9e06bfa1dc3b93cd5b375dfab6f251ce88ec148cef
MD5 SHA1 SHA512

Submit Download

blinkingeyes.thor

Path C:\Users\Admin\AppData\Local\Temp\rpatchur-download-KsSCuf\blinkingeyes.thor
Size 25KB
SHA256 f95ef38bcd1379087ef6a3eaf855dbddc7649faca678d7c1565afe71488ee772
MD5 3d6e2c29dedaa858c355709b01f5ee91
SHA1 fdba5c487b4e64c9164946753731384632246d80
SHA512 d46310eb1abd5937762014f74940fd22bc3bed36dcb031e6fb54b3ecc23ec8dd6564290d20f46ecb0a98b36fd59364d2e663e49408ff2c17d64aef11463d5746
SSDEEP 768:wguGWCZYzWYUynxMZm941vHqz9SgkrcHx:skfYUsiZmKvKlMcHx
TLSH
T165C2E1956137A777C9EE22BE1079C8238BF547676C93B4E2E4088289D414CF92F17CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_dat.thor

Path C:\Users\Admin\AppData\Local\Temp\rpatchur-download-KsSCuf\del_dat.thor
Size 1KB
SHA256 ff9f509ed35fc7dfd8227192f17a86920efe401d505fcd7ee913b22f06aef434
MD5 031a4e79511a446380f6f8812b6772a0
SHA1 86158fd431fc12dd76763e34cc2e6fbf8dc64ee0
SHA512 70819d25d846bc9f1912393f5b80efcc1844e7600cbdeb08ffe0717bf25640d3f47316f5404dbf3ce356904a68f7b4714262b8866f8e0bce5ba14356a699c720
TLSH
T17421B800D5F65F67988CA720A42BF3199620D5DC6CEB93255442C315EA9E68431F71B2
MD5 SHA1 SHA512 TLSH

Submit Download

proxy_eu.thor

Path C:\Users\Admin\AppData\Local\Temp\rpatchur-download-KsSCuf\proxy_eu.thor
Size 800B
SHA256 51328eead4e09b6c939ffeba47ee10b4412e9e86a102d86e216008ccd99dcbb2
MD5 9e186345f4893c84723e674255468219
SHA1 c56d2774833dfa397e6b36a6776ff69a862d36c5
SHA512 d2fffd11bb60af3500a3dcaf01c4d13e7acbefaa3eaf84674e3bd4bbde710c61887f2a9151fae5d2ab1937bcc7aa2147a03cd1ae77132c06992c569d61c1d68a
TLSH
T1520175C8E5F1681A586B9016D9054130ABC872462BED332EEC26490945EEDA2529AE55
MD5 SHA1 SHA512 TLSH

Submit Download

proxy_eu2.thor

Path C:\Users\Admin\AppData\Local\Temp\rpatchur-download-KsSCuf\proxy_eu2.thor
Size 816B
SHA256 cd5ebae0f8c06545d4337826d460cfed3373f96f8c7d4b4d6f7f7f5cfd8f10dc
MD5 aedf4526447a04bd8c433928817d86b3
SHA1 2a6a58fef10ec5de98f2f8826494d86b41a4797c
SHA512 698a3cfc67f91468735c822ff9822a3f5602a1450246c444c345f8311435c04e3519031c96995ca5dab48f06bebe520c6386a4c96d17fb9981e5fc599c1ba889
TLSH
T17E0186C53E9C3E356CADE811893A167CD931A9B2DC9F4F131648732BACE28F52B50224
MD5 SHA1 SHA512 TLSH

Submit Download

.tmpj9DWvz

Path C:\Users\Admin\AppData\Local\Temp\savedata\.tmpj9DWvz
Size 130B
SHA256 c8daf97607979b764baff7a3c80f6cd4b0f81353681a83843124446635562dde
MD5 169ec6bdc620e537e1d79bf301e275b4
SHA1 25aa7cc5acc4710674ab1de11849e1a2b1107e6c
SHA512 ab663e71c489ba6a5c98e3dc1a113c54c5256cc1d3bf85db8ac4a75a743ea74cb9707f30e7a1dd3da916623e632b5117fd7191f129059983aed36cd73c12a2a5
TLSH
T1D1C092BA10EA82DF8B178540238F7B2AE40E059740826594B9595A40E8EDEAF4C2E4E6
MD5 SHA1 SHA512 TLSH

Submit Download

muh_patcher.json

Path C:\Users\Admin\AppData\Local\Temp\savedata\muh_patcher.json
Size 92B
SHA256 76d00b5ae633edee539e37c1bd3a6621cebc43f556a6cb6e4f02e4e754a7f5b9
MD5 e8b3f5580a51b1e114a791648b42c447
SHA1 5ffb458d2f61e2eeda3e13cdbef94639751028cf
SHA512 0e59073291cf280698cb46dcc5ac2f4b9ada46f3b6d0ba96519b1bf64d5a3990bf6b49fb911775687304b2ab7247a711693d80b14e54823519400c5e1f6aa439
TLSH
T194B0127210D501DB0B138400130F3F15D00F0006008055C0684C194098E0F9F44190D4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2348-24-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download

memory/5764-2018-0x00000197E43B0000-0x00000197E43B1000-memory.dmp

Download

memory/5764-1992-0x00000197E43B0000-0x00000197E43B1000-memory.dmp

Download

memory/5764-2020-0x00000197E43B0000-0x00000197E43B1000-memory.dmp

Download

memory/5764-2019-0x00000197E43B0000-0x00000197E43B1000-memory.dmp

Download

memory/5764-1994-0x00000197E43B0000-0x00000197E43B1000-memory.dmp

Download

memory/5764-2017-0x00000197E43B0000-0x00000197E43B1000-memory.dmp

Download

memory/5764-2016-0x00000197E43B0000-0x00000197E43B1000-memory.dmp

Download

memory/5764-2015-0x00000197E43B0000-0x00000197E43B1000-memory.dmp

Download

memory/6104-82-0x00007FFD17540000-0x00007FFD17541000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads