15ea45013ce081ffebd91f45c73f5d2e87c4a3de178e7aec61c1d91dec10e26d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 10.1MB
Sample260908-b39fhsxzhy
SHA256 15ea45013ce081ffebd91f45c73f5d2e87c4a3de178e7aec61c1d91dec10e26d
MD5 f151030a91ccd98613dc0b5700bec73d
SHA1 ae24c5858c9c60b78ddc3ef89cff52d737d07ba6
SHA512 ee711282b46b64cb21c3d287d301563a8ccb11e59833582029bf60231376db7d84d5dc9963afbc84f05be42181da32a81b0a3504d22a902149a79f1dd494eceb
SSDEEP 98304:YldFqEFawzC8KobGBbI/TYOrqcBtGLA0wD3nbRon+U:kFqCaPE69ILYOecbGLlw0N
TLSH
T1BBB66D03F26181E8C06EC1B5835AA637FB72B88A0934B2EF57D45B212F66F506F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3524	msedgewebview2.exe
3524	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4348	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3472	2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4348	3472	2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	88
PID 4348 wrote to memory of 3780	4348	msedgewebview2.exe	89
PID 4348 wrote to memory of 1484	4348	msedgewebview2.exe	90
PID 4348 wrote to memory of 1484	4348	msedgewebview2.exe	90
PID 4348 wrote to memory of 1484	4348	msedgewebview2.exe	90
PID 4348 wrote to memory of 1484	4348	msedgewebview2.exe	90
PID 4348 wrote to memory of 892	4348	msedgewebview2.exe	91
PID 4348 wrote to memory of 3512	4348	msedgewebview2.exe	92
PID 4348 wrote to memory of 3512	4348	msedgewebview2.exe	92
PID 4348 wrote to memory of 3512	4348	msedgewebview2.exe	92
PID 4348 wrote to memory of 3620	4348	msedgewebview2.exe	93
PID 4348 wrote to memory of 3620	4348	msedgewebview2.exe	93
PID 4348 wrote to memory of 3620	4348	msedgewebview2.exe	93
PID 4348 wrote to memory of 3620	4348	msedgewebview2.exe	93
PID 4348 wrote to memory of 3620	4348	msedgewebview2.exe	93
PID 4348 wrote to memory of 3524	4348	msedgewebview2.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3472.3324.6399078700337430285 /pfhostedapp:8f4b33116b17e630d61dff9ff3ad7e69976c9484
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView /prefetch:4 /pfhostedapp:8f4b33116b17e630d61dff9ff3ad7e69976c9484 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff916db5fd8,0x7ff916db5fe4,0x7ff916db5ff0
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView" --webview-exe-name=2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1772,i,9929557663936310381,15699882172833222490,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:8f4b33116b17e630d61dff9ff3ad7e69976c9484
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView" --webview-exe-name=2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2004 --field-trial-handle=1772,i,9929557663936310381,15699882172833222490,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:8f4b33116b17e630d61dff9ff3ad7e69976c9484
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView" --webview-exe-name=2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1772,i,9929557663936310381,15699882172833222490,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8f4b33116b17e630d61dff9ff3ad7e69976c9484
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView" --webview-exe-name=2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3368 --field-trial-handle=1772,i,9929557663936310381,15699882172833222490,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8f4b33116b17e630d61dff9ff3ad7e69976c9484 /prefetch:1
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView" --webview-exe-name=2026-09-07_f151030a91ccd98613dc0b5700bec73d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4304 --field-trial-handle=1772,i,9929557663936310381,15699882172833222490,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8f4b33116b17e630d61dff9ff3ad7e69976c9484
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9d2e379afad27dbf058b22fde75c84fed498df597fa82a6d7be330f7c9c42869
MD5 bcee6e2d2ab2a7f10cdd22e45c5b410e
SHA1 27eaecea25c1ef0060668bf7154417f6fd9e538c
SHA512 a8309791198a735f2c7756117699063cccd358d9d12a7ea3119fde8bb3f2c15129513f503293b56740d7de317e498a4cfcf4202a1d694277781e6897ba01eb39
TLSH
T1CBD0121672031178C9102073011261080400E11BC1074310682C865E1F1C0540D1B443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9c69af0ed481616e8d8cee37ae57f5fbcfdc4cc3925bb71f4d62e2feab731022
MD5 4cacae481e6a29d354e5498f1079f3d5
SHA1 c8e936046cb85244a430782b3c50bd3f0218b9aa
SHA512 504182d394931bd3b635194b10d82a6609d3d71f600bf1068d3285337c7014e4bc03ac61ef2f95a894f51d572b42f4647db2928fe3e9f170dd7e0f4be01af5fe
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

3f3155ef-b3fc-4537-8f67-6e299ab92360.tmp

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Default\3f3155ef-b3fc-4537-8f67-6e299ab92360.tmp
Size 6KB
SHA256 9ef803d7121c0aa81ade76fb76959aa03760b5c3f9c57ff687f5921511e9cbe5
MD5 85d404618ede0d814d30a34dfc3e6404
SHA1 70e0d3b9fbdd04af906f0a3bc96c0d8880b83303
SHA512 cc2528d59ff0cb4f5232b88f197fab837ae1e1de504a98d671393bb863cad8325b618848fd5aad35c167e87cb18cd55ea8389119eeadc9cb83f9435cb2f5640d
SSDEEP 96:st0/d3K5Ab9/kAo5h16Z0Bs7/x+6MhmuecJKhS1ejeWK+gi28XM1C7K:st4NPPonBsV+FdKwQj2cG6K
TLSH
T13AD1C8015E68797B8CC7E209BA357B53E2F5A07264D11D58E7F8852C08DB6DC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 620b4497c7435dd274a2de6d8f3ba40a10d404a55905d41e6d1b44bf8329f6a6
MD5 7f5ab4803ca71239ae9c019751e762ac
SHA1 23e6fe8f85cc9b2382233ac9e5e9e69864367c14
SHA512 14168b617c9ec003aeb9fdb50761a51771a0d1045e4f5736e86735e613f3f5f50841be46aed3e4b09c9d8e0cd4e17abf3118e04701cec38576c4b2ecb0d88b4a
TLSH
T15DA0023411848087D2750B72B2E2514532746F260283770240B1A9B49D9C780C251451
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3896.TMP

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a3896.TMP
Size 48B
SHA256 db2b385f04d5746ace0d6f0cbfad9ca31aca1c7af9853e5a7224d8fa4f5f423a
MD5 ab681db4670489dd69277fbe2006a7c3
SHA1 16d641d0f330c7bf6e121d288a7cba50ffb748dc
SHA512 8852c3de947297edba981c16465ea2c3fc4850b101864c9a3263775d7bfe5b986a2f78568948f6d332bedff7a45ca066bb37176b293c528fd7688097f60f6f4d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b0e93.TMP

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Default\Network\Network Persistent State~RFe5b0e93.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Default\Preferences
Size 6KB
SHA256 0d28062d9240f2535b3d307aaf32150de7e3d985e411f2019edf76512396122b
MD5 9038bf3a120780425efc26bb7c48027f
SHA1 24e745fe42243477c2af080f91b34506d75c3111
SHA512 61bc2775a51add158aaef9617a0633d390a7f3f14890d797be7a7d788e39423344d9f56ff29b45a2df64f6bf6b7b8e4178de3acc14c2ab4d67c974ab1e1daae2
SSDEEP 96:st0/d3KQGAb9/kAo5h16Z0Bs7/x+6MhmuecJKhS1ejeWK+gt528XM1C7K:st4N9PonBsV+FdKwQj2v5G6K
TLSH
T109D1B7015E68797B8CC7E209BA357B53E2F5A07260D11E48E7F8552C08DB6DC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Local State
Size 3KB
SHA256 4b1a18f9b9041aa7ab3f2a5c37d95755d5fc2f4d9a16e1b465b51e8bba41efde
MD5 0849e2ff3b22a553734ccf9ef81d956d
SHA1 14ff67f7d97601e882c764b41235ca35dd81ca30
SHA512 a9e0b53afb534ad029f6d1519f8b719ad0f49e6c54bfb42779d0ab42cccc10691de2289413c5798fae5a61da108c4eb706a124757b3a76bd98f8de1cde2dd6d2
TLSH
T1EF6194376974AA779DF39A05B8863B12A7A59023E9817FA4C6EC0F2D01D73E81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Local State
Size 15KB
SHA256 e831866b817d628c7c5fee74d99392d42d68ac0d0ce0b0fd3dab72aec2753a67
MD5 750a15420836adc7d42c4641a8b5af40
SHA1 3b34029a776844357d212b8db3e1ec5f311c1382
SHA512 5285b490ba281897eddb2b209a5e078f8468c1c58eb0ead1c2e909d7c3b47188a12c86498b30d7b7eda3bda36c285e7471467f079b9296bb981b01acb82cdcdd
SSDEEP 384:H+aQikB+z/xvxjg/qhEwNBSeLfOSPy8+zL9z3:W/UxvxjgC+WLWSK/zLF3
TLSH
T14072AF3BA5B97E23A1F3E60479491B8BCAB8D47250816EB84AEC2F0D06973D41346D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Local State
Size 2KB
SHA256 897c272fd8ed73fab2a622cc235a40254454ee382d3d339053f709a274d55636
MD5 c25852242549e25fa26bef1b43680b40
SHA1 0ad7d7d4dafd07bdcdb79849c439901f64909330
SHA512 72582dfa26e28342508b9934e5429a8f82e97193f6011120f3a79e5fb76828be96fd743cbdcc2db757549bef107f219f0e67fe5621a9f96d5fb72cf054e8807e
TLSH
T16C51A5736814AF73D9F34708B9463B23DA79E1A2AA525F6096DC0B2D01D72AC2346C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59e788.TMP

Path C:\Users\Admin\AppData\Local\com.nexusclicker.setup\EBWebView\Local State~RFe59e788.TMP
Size 1KB
SHA256 5360d683e2cee04681a4b87b4aab19bfd9ef50863c3456fa561f828c1482311b
MD5 2fcf061550bb1a37625ce7ca62bc2146
SHA1 1c3a6917ddacfc4afa81d8e8d48a692b7b6a9f16
SHA512 94ed103aec63060d9fb282af2086428ec5c162ef2acd5fe6a94ab94fe0b48cf4c2098759feb523478d7ff520b880b04950d38e5faa89168af0c988a48c087262
TLSH
T18E2142B3E4655F73BCD2230A715277536E60D06B92118F1092DC073E02A72DC566AC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1484-26-0x00007FF939300000-0x00007FF939301000-memory.dmp

Download

memory/3524-262-0x000001B9D8FF0000-0x000001B9D8FF1000-memory.dmp

Download

memory/3524-264-0x000001B9D8FF0000-0x000001B9D8FF1000-memory.dmp

Download

memory/3524-273-0x000001B9D8FF0000-0x000001B9D8FF1000-memory.dmp

Download

memory/3524-272-0x000001B9D8FF0000-0x000001B9D8FF1000-memory.dmp

Download

memory/3524-271-0x000001B9D8FF0000-0x000001B9D8FF1000-memory.dmp

Download

memory/3524-270-0x000001B9D8FF0000-0x000001B9D8FF1000-memory.dmp

Download

memory/3524-269-0x000001B9D8FF0000-0x000001B9D8FF1000-memory.dmp

Download

memory/3524-268-0x000001B9D8FF0000-0x000001B9D8FF1000-memory.dmp

Download

memory/3620-92-0x00007FF939300000-0x00007FF939301000-memory.dmp

Download