gh0strat | 1ea33d3bd1cd017237445f111227bb999dd9f3336f2c45c68a927735df227f04

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
Size 7.5MB
Sample260903-vgdaqscl4v
SHA256 1ea33d3bd1cd017237445f111227bb999dd9f3336f2c45c68a927735df227f04
MD5 05ff682b90d34a0902a3d526976fbb37
SHA1 667f419490f8ddcf53ee0955bc0a183ae8374e7e
SHA512 762dd328606a310d73f4e0c86ca2bb79e3e408fc5a50d045c12aa39b5114119611c519670667d80ab3da8bed91b8ffa1b7c94cd7599625b4c3e0a083cb74c284
SSDEEP 98304:pws2ANnKXOaeOgmhd4yqkqhu9bXUFYstQEIGDWgifJ2n+YC:bKXbeO73HLQu9axqfJ8u
TLSH
T181768C03F26180F9C19AC174CB1A9637EB31789E0AF162FB76985EE03E29B417B1D355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 8 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/5740-20-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/5740-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/5740-19-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/4004-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/4004-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2824-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2824-44-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2824-46-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024710-5.dat	family_gh0strat
behavioral1/memory/5740-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/5740-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/5740-19-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/4004-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/4004-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2824-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2824-44-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2824-46-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e6a3-38.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral1/memory/5740-17-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral1/memory/5740-20-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral1/memory/5740-23-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral1/memory/5740-19-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral1/memory/4004-29-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral1/memory/4004-28-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral1/memory/4004-26-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral1/memory/2824-40-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral1/memory/2824-44-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX
behavioral1/memory/2824-46-0x0000000010000000-0x00000000101B6000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240648921.txt"	R.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

pid	Process
4396	R.exe
5740	N.exe
4004	TXPlatfor.exe
2824	TXPlatfor.exe
3524	HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
2140	Remote Data.exe

Loads dropped DLL 3 IoCs

pid	Process
4396	R.exe
5752	svchost.exe
2140	Remote Data.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\240648921.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5740-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/5740-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/5740-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/5740-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4004-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4004-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/4004-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2824-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2824-44-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2824-46-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5996_1959823573\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5996_1959823573\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5996_1959823573\protocols.json	msedgewebview2.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2836	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatfor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	R.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Data.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2836	cmd.exe
6140	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329282543326130"	msedgewebview2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6140	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2240	2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
2240	2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
3160	msedgewebview2.exe
3160	msedgewebview2.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2824	TXPlatfor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5996	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5740	N.exe
Token: SeLoadDriverPrivilege	2824	TXPlatfor.exe
Token: 33	2824	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2824	TXPlatfor.exe
Token: 33	2824	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2824	TXPlatfor.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3524	HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2240	2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
2240	2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4396	2240	2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe	86
PID 2240 wrote to memory of 5740	2240	2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe	89
PID 5740 wrote to memory of 2836	5740	N.exe	92
PID 4004 wrote to memory of 2824	4004	TXPlatfor.exe	93
PID 2240 wrote to memory of 3524	2240	2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe	95
PID 3524 wrote to memory of 5996	3524	HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe	98
PID 5996 wrote to memory of 6052	5996	msedgewebview2.exe	99
PID 2836 wrote to memory of 6140	2836	cmd.exe	100
PID 5996 wrote to memory of 3716	5996	msedgewebview2.exe	101
PID 5996 wrote to memory of 3716	5996	msedgewebview2.exe	101
PID 5996 wrote to memory of 3716	5996	msedgewebview2.exe	101
PID 5996 wrote to memory of 6036	5996	msedgewebview2.exe	102
PID 5996 wrote to memory of 2348	5996	msedgewebview2.exe	103
PID 5996 wrote to memory of 2348	5996	msedgewebview2.exe	103
PID 5752 wrote to memory of 2140	5752	svchost.exe	104
PID 5996 wrote to memory of 3636	5996	msedgewebview2.exe	105
PID 5996 wrote to memory of 3636	5996	msedgewebview2.exe	105
PID 5996 wrote to memory of 3636	5996	msedgewebview2.exe	105
PID 5996 wrote to memory of 1548	5996	msedgewebview2.exe	119
PID 5996 wrote to memory of 1548	5996	msedgewebview2.exe	119
PID 5996 wrote to memory of 3160	5996	msedgewebview2.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\R.exe
  C:\Users\Admin\AppData\Local\Temp\\R.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\N.exe
  C:\Users\Admin\AppData\Local\Temp\\N.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6140
- C:\Users\Admin\AppData\Local\Temp\HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
  C:\Users\Admin\AppData\Local\Temp\HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe --webview-exe-version=0.2.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3524.1044.10706939133036951762
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5996
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb329fb078,0x7ffb329fb084,0x7ffb329fb090
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView" --webview-exe-name=HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe --webview-exe-version=0.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,16649861916127789131,12283762180092571352,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView" --webview-exe-name=HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe --webview-exe-version=0.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,16649861916127789131,12283762180092571352,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView" --webview-exe-name=HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe --webview-exe-version=0.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2388,i,16649861916127789131,12283762180092571352,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView" --webview-exe-name=HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe --webview-exe-version=0.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,16649861916127789131,12283762180092571352,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3636
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView" --webview-exe-name=HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe --webview-exe-version=0.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=752,i,16649861916127789131,12283762180092571352,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView" --webview-exe-name=HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe --webview-exe-version=0.2.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3840,i,16649861916127789131,12283762180092571352,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3160

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:3752

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Windows\SysWOW64\Remote Data.exe
  "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240648921.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2140

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\TXPlatfor.exe
  C:\Windows\SysWOW64\TXPlatfor.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "Remote Data"
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_2026-09-01_05ff682b90d34a0902a3d526976fbb37_akira_cobalt-strike_elex_emotet_glassworm_icedid_remcos_wannacry.exe
Size 5.1MB
SHA256 35564d324282b5aefc6b348299a738db98b4d3d3841772482b8df1bd1707097e
MD5 7d3196114bd2b32ada007e2dc70d9014
SHA1 14352a92b7c76c6b8293b29f4d02dbec300c9f1f
SHA512 83753fb97aec4f6b1e7a63c8ae1eb039767cdfad30281a2b91a65a63deda7dfc854f949a367cb3b3b86a5dd274fefa779550f651405374f285eb4bf13da39efd
SSDEEP 49152:V66vRHUqkxXG6A3DCHHv75IHe7mn9EnUuULILbXSv2IXx9vv4dZAaludXdtQE/i9:ryqkqhu9bXUFYstQEIGDWgifJ2n+YC
TLSH
T123468D03F26181FCC06EC574835AA633FB32B88A093476EB5BD45B212F66F906B1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 2.3MB
SHA256 f9bfea6a57f5c128136e70699e24985b0aaf2d0064f7bbe6da5146966742e80b
MD5 b7e2fdf43399c2338ef9e776bdc51722
SHA1 12afdc40ac5759daec22b88a8dd51e5505d3da75
SHA512 08589d9f1f5a78418bf308a84725f984758781b24c1bfa39d417e0f753ed96e00374f7a3009badad0f9c51581dabe5f368f61956510148434c76babffdde813b
SSDEEP 24576:OCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH2:OCwsbCANnKXferL7Vwe/Gg0P+Whdz
TLSH
T12FB57B43B55104F6C3C87571DF62D9BB9B2076BE27F301F67688ADC87A6C206BA21127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N.exe

Path C:\Users\Admin\AppData\Local\Temp\N.exe
Size 377KB
SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
MD5 4a36a48e58829c22381572b2040b6fe0
SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
TLSH
T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R.exe

Path C:\Users\Admin\AppData\Local\Temp\R.exe
Size 941KB
SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
MD5 8dc3adf1c490211971c1e2325f1424d2
SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
TLSH
T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 07f64528c3426979b0a3d89e31177223be5cca4f2012f17ea048259db2b5e7c1
MD5 c1f640791f8ba6e63289c4e25aec2df3
SHA1 907d525673ceac3b275b0e2540d10da7a260961f
SHA512 6ae101eaad52d1ebb238cc66cdb16b95cce6c529943dc81a9668caee8fc3cf579c70bee6a7f7abe770c955538fc0433008fad9fb4b17a7823e3b6921fcea4644
TLSH
T158D0112232230238C02022B30202BA080800CA2F802A8828A83C8A3E3A080A02A0B882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0735892d47ed2953417c61f22cbc075b32e5d6986eec0c2ec2a0e66976c3b513
MD5 5db6cd4a32c4693cf054145c6d4089d7
SHA1 072ca793464102ef1f72a727c307c5cf59716add
SHA512 3239fabd63c61e91e7468bb3c0f68acdc636f7593e7410169a95ed08fbddb6b6567673d17230daaafefe59bd99d9a5aaa6444d23db62a4db638245658caafcdb
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f2aaad7b2a00f71e4b1dfa4ca0105187ab9f36d3c6864f46599d23a5dbf3d872
MD5 e0fcba5ceefe695ecb4346473f524d2c
SHA1 8ffba90711b398641b8e65630502e5f9e0ab0197
SHA512 e636fa288120941b74e22ca4d8bcb8841cd42045bf306451ff42ec07ef23d6da9b9ceb897d4bd9c0c7b5ad8fdaf3f6e5fc1d2acdccb53e1aee625d36d83e7de3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 a1cd60eb31dec4d79ffe333097f399b0fd93565704b99646e9dc77f198ad10a1
MD5 1fcba3c646c30f732973a8ca78342543
SHA1 fcb53e6b6858bb8de00f2952e62b6d667978f171
SHA512 ebef90e3fe3d2182d520d93c054370638a5bf2a3bf1660462399d7e40adba620860b1854b8ced58bc759c64bbc09e5f1c7035f3fe49243d8f44860b65b42e62d
TLSH
T1E3D01221820CED95FF3082B0C0EE046337F0082B26038DB29CACE078448039C92C0219
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe593d2e.TMP

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\Network\Network Persistent State~RFe593d2e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\Preferences
Size 6KB
SHA256 b3977a4bc79848314d2034f6cd452e1534eb0e2a3ef6105ebabc863cfaf9cbe1
MD5 0994583dd2951464d19ecf3070661248
SHA1 947b9546c6bc834c54caae28a128a5d3ad4ad210
SHA512 67f8d840dc846e2604398d2accd7c7255e60d5f4322913026ee5f609583c43d1533a397ad8b74e5f80dd7b3f7878eae9947db4476fc836b4a258042e9c77ba1a
SSDEEP 96:stn05yHOlib9Sff9Z8i0vhECkt4m/7qx+WVHMSm+uecJ5u1idQjrP+g9OyMOB:stn0G8fFZ8pahx/S+WiT5uwdcPeyMC
TLSH
T190D198026F286D774CC7E619BA35BB53E2F6606261D40E58EBFC861C08D66CD630B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58b36d.TMP

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\Preferences~RFe58b36d.TMP
Size 6KB
SHA256 c1ec67db8e5d27b202719614ea4bb587e6ce9afd6a5850043e1cebc92652a8ea
MD5 ab0f473bddcdfea426b4c3bb299e180e
SHA1 a2472ecc2af2ad9f7e211b9917bd49a5b36af85e
SHA512 54eab8fd22fb4e68ccd9b4a209bd9198c716f9fffd56bf3014cbd257780aeee581463015b75f46ddd2f70309cbe653a2c7f9f29b6368b3dfc4cf680efe77d911
SSDEEP 96:stn05yHOlib9Uff9Z8i0vhECkt4m/7qx+WVHMSm+uecJ5u1idQjrP+g92yMEB:stn0GqfFZ8pahx/S+WiT5uwdcPGyM8
TLSH
T174D197026F28AD774CC7E619BA35BB13D2F6606261D40D98EBFC861C08D56CC630B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Local State
Size 2KB
SHA256 b88419c134718bb0d593e41a9819fff604326f634a58d73f6517e4a5854f5a02
MD5 0ec7b8fbbdd6c23664880b9ef6eb9aa1
SHA1 edf180c9e71b46a46b6f545353bd681621d24e5b
SHA512 e0f07d3742307d8d472e5efd1747570cb9c22f1dbaf668ae8890ac9a8c00f5cb56e1f8b40d5a2d3f8914254e14b7b05231a8ae0bde4c8901e92a46f762b70dda
TLSH
T1FF519432B814BF3B4AE39A48B9463F13AF7651A5D6911F6495DE0B0C00E759C2356C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Local State
Size 16KB
SHA256 10254b7d30ae2eec9fb8a6a70faa4e5ac49f31ea2907de5c97e72a1ac316ac9b
MD5 cbeb2acb2461eda32aac38dd79ccc548
SHA1 43180bdee64921edf149ef11023d41c28cc7eb26
SHA512 acbed6e92d29a264c324ac612285e10a5a9a39fd8ab67f7af09ca64c505fa596a32009ce2e18dc7397bb1de59487cc7fd0f0f0573ae05af54eaff2d90954f6eb
SSDEEP 384:zU+aQikB+z/xvxjg/qhEwNb+iK7ES2UH9z+://UxvxjgC+QKgS2UHF+
TLSH
T185729E3B64697E3359F3F904BA491B4BDBB684A290812FB84AED1F0D06D73C80346C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Local State
Size 3KB
SHA256 4c04c6d089a28e35c14deee046fad444e15d9a48bc70b84120f98c9b6709002e
MD5 6916594eed32092a5a612160cad7bb48
SHA1 571ab3feaf74221b2047375027b598abcb8d0ff3
SHA512 78ea81812a809c309138ea3dff50fe592efa5d0e58732d427c1f1573d043e2d356d0b5939409231d7e99764dc3580d956420e0e55c6f34f0365b21881e31d1a3
TLSH
T1F37175326464FE3B4EE3A948F9852B13BBA65126D5952FA8D5ED0F0C01D72C81392C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe581325.TMP

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\Local State~RFe581325.TMP
Size 1KB
SHA256 fc5413fc028dd5ed0c7279572d28959e58e0a025f0d15f572e5601987d453e45
MD5 d381fc13415a0fe4a49731ade990b4e6
SHA1 23e669c8b2fdb07833bf6e0cf4d76701d34e6ca6
SHA512 71a32d6abeba80b620010f5a8aa3a773e7b33bbfa2ee1770c08c69871893655b6add1ebd2bea7ef01abada2032af5abadbf83c8f329e138d8120b70530068e1b
TLSH
T10E218432E059BF775E82A99DF24277472E61607DD2504B1892DD030C06E78CC96BAD33
MD5 SHA1 SHA512 TLSH

Submit Download

eec51c61-3082-43e0-8adf-0cea6e59c21e.tmp

Path C:\Users\Admin\AppData\Local\com.nuggie.neverlosetauriofficial\EBWebView\eec51c61-3082-43e0-8adf-0cea6e59c21e.tmp
Size 1KB
SHA256 80549c6d4b9113fb4887753407336681b06d112ce6b0e1590a68a8422507e6a1
MD5 0856d02882b9179388a78e0b2d34dded
SHA1 bd5335c62b24f2958af72ee1f339f9956962a0cd
SHA512 d3b9595a6a6f23c1c45a75372ceebfdc2e080d2d357db3d2a0791ae225c4e402d9f6f3e8aa056275fa3cb04405e7a6a9fad020070315dcd4892d42de5cd6eae0
TLSH
T18B318232B054BF375D92A68EF2827B536E626069D2514F0892EE070C05E35CCA6BAD33
MD5 SHA1 SHA512 TLSH

Submit Download

240648921.txt

Path C:\Windows\SysWOW64\240648921.txt
Size 899KB
SHA256 db215bfe62f754581c488843ecd5195582cf562d48a850fdbbef4bdfcaf9de6e
MD5 e79774020a68d358e90bc26f0ab5ec23
SHA1 f363661696d21e63b98aada229de2e9b4bac784f
SHA512 282d52afa73a86db514c16fcef5d1fc45902f2b91623e6a42895c083c5ba8c56a1e806c98991582149f55a4664c7bcaf46647935df96fe3ec20c317eeaea8b3e
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXi:7wqd87Vi
TLSH
T1FC152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remote Data.exe

Path C:\Windows\SysWOW64\Remote Data.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
TLSH
T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-359-0x00000284BC5D0000-0x00000284BC600000-memory.dmp

Download

memory/2348-278-0x000001E3C87C0000-0x000001E3C87F0000-memory.dmp

Download

memory/2348-123-0x00007FFB4F140000-0x00007FFB4F141000-memory.dmp

Download

memory/2348-122-0x00007FFB4E4E0000-0x00007FFB4E4E1000-memory.dmp

Download

memory/2824-46-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2824-44-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2824-40-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3160-375-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3160-384-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3160-380-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3160-381-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3160-382-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3160-383-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3160-385-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3160-379-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3160-374-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3160-373-0x0000025D399A0000-0x0000025D399A1000-memory.dmp

Download

memory/3636-192-0x00007FFB4DAD0000-0x00007FFB4DAD1000-memory.dmp

Download

memory/3716-72-0x00007FFB4DAD0000-0x00007FFB4DAD1000-memory.dmp

Download

memory/4004-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4004-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4004-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5740-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5740-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5740-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5740-19-0x0000000010000000-0x00000000101B6000-memory.dmp

Download