neshta | 1fdb1c7ae6e06bb3f339416fc9ba9ddffb534f4dcd806cdbd3bd29fba977568d

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
Size 7.3MB
Sample260924-dcvksayblc
SHA256 1fdb1c7ae6e06bb3f339416fc9ba9ddffb534f4dcd806cdbd3bd29fba977568d
MD5 d9d664bdbdcf8838977101ec5d553fc1
SHA1 2cce701f7199f46f9b230ca89b6e32a6a0ed6c58
SHA512 1aac8878b1085e558512e48d44016429fedfd85c8b220665b0606ec05df40156fb97970648d5f42993182d05a3564ab6f3403ed7d7e51e14ffca581274ab2b64
SSDEEP 98304:rszh2wMRWTA0LqA/4V1AcNSMuQ3MTMnwn+/:QF2wS0dBQ3MBo
TLSH
T14F768E03F6A281FCC06EC174835A9633E732B88D493472AB5BE45B212F66F906F5D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery neshta persistence spyware stealer trojan

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0007000000018918-38.dat	family_neshta
behavioral2/memory/5200-294-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5200-315-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5200-326-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5200-330-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c463-4.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 1 IoCs

pid	Process
940	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEWE~1\APPLIC~1\122023~1.106\msedgewebview2.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~2.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1198995347\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1198995347\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1342147936\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1342147936\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1342147936\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1342147936\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1342147936\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\svchost.com	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1198995347\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1198995347\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1741815748\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1741815748\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1741815748\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_1198995347\keys.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3744	msedgewebview2.exe
3744	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2300	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
940	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5200 wrote to memory of 940	5200	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe	89
PID 940 wrote to memory of 2300	940	2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe	90
PID 2300 wrote to memory of 5092	2300	msedgewebview2.exe	91
PID 2300 wrote to memory of 5932	2300	msedgewebview2.exe	92
PID 2300 wrote to memory of 5932	2300	msedgewebview2.exe	92
PID 2300 wrote to memory of 5932	2300	msedgewebview2.exe	92
PID 2300 wrote to memory of 5932	2300	msedgewebview2.exe	92
PID 2300 wrote to memory of 5884	2300	msedgewebview2.exe	93
PID 2300 wrote to memory of 1676	2300	msedgewebview2.exe	94
PID 2300 wrote to memory of 1676	2300	msedgewebview2.exe	94
PID 2300 wrote to memory of 1676	2300	msedgewebview2.exe	94
PID 2300 wrote to memory of 5016	2300	msedgewebview2.exe	95
PID 2300 wrote to memory of 5016	2300	msedgewebview2.exe	95
PID 2300 wrote to memory of 5016	2300	msedgewebview2.exe	95
PID 2300 wrote to memory of 5016	2300	msedgewebview2.exe	95
PID 2300 wrote to memory of 5016	2300	msedgewebview2.exe	95
PID 2300 wrote to memory of 3172	2300	msedgewebview2.exe	99
PID 2300 wrote to memory of 3172	2300	msedgewebview2.exe	99
PID 2300 wrote to memory of 3172	2300	msedgewebview2.exe	99
PID 2300 wrote to memory of 4420	2300	msedgewebview2.exe	100
PID 2300 wrote to memory of 4420	2300	msedgewebview2.exe	100
PID 2300 wrote to memory of 4420	2300	msedgewebview2.exe	100
PID 2300 wrote to memory of 3744	2300	msedgewebview2.exe	101
PID 2300 wrote to memory of 4408	2300	msedgewebview2.exe	102
PID 2300 wrote to memory of 4408	2300	msedgewebview2.exe	102
PID 2300 wrote to memory of 4408	2300	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe --webview-exe-version=0.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=940.2848.10680521504490088672 /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView /prefetch:4 /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff49505fd8,0x7fff49505fe4,0x7fff49505ff0
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView" --webview-exe-name=2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,5221428918718055177,13750566741802303058,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView" --webview-exe-name=2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1764,i,5221428918718055177,13750566741802303058,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView" --webview-exe-name=2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1764,i,5221428918718055177,13750566741802303058,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView" --webview-exe-name=2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2976 --field-trial-handle=1764,i,5221428918718055177,13750566741802303058,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf /prefetch:1
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView" --webview-exe-name=2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4040 --field-trial-handle=1764,i,5221428918718055177,13750566741802303058,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView" --webview-exe-name=2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1764,i,5221428918718055177,13750566741802303058,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView" --webview-exe-name=2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4596 --field-trial-handle=1764,i,5221428918718055177,13750566741802303058,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3744
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView" --webview-exe-name=2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4676 --field-trial-handle=1764,i,5221428918718055177,13750566741802303058,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:2d14148c40d2b1cacbebf7c2308551c824ad58cf
      4⤵
      PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_d9d664bdbdcf8838977101ec5d553fc1_akira_cobalt-strike_elex_glassworm_neshta_ransomhub_vidar.exe
Size 7.2MB
SHA256 505dfb4c2c1052b055e3fc694a76cb7ce093a64962c7713aa294f5549c6734f5
MD5 6fd61860795d49a79ec2594ddc637f4c
SHA1 d818b53ab77c8f47b38fce08f4e2e46e8cd57d97
SHA512 d5b79bcf09da22d10101fea63d6e377f9c39d7ac9e88caf39bc42659163f4cae222c232333fdde2ca0b3e6eddb0d55e4be5db05dd5d60e9c284c544b2bfc04c4
SSDEEP 98304:Nszh2wMRWTA0LqA/4V1AcNSMuQ3MTMnwn+x:+F2wS0dBQ3MBW
TLSH
T17A768E03F6A281ECC06EC174835A9633E732B88D493472AF5BE45B212F66F906F5D749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fe0b2133be789af2e03ef7d2367064647f7a9139dc31afe37a1c98c2c2962215
MD5 3c13f51493cce73ed6960eb00dbd3959
SHA1 d75b5e1bbb667cd957645a983b9dac9f9e9f5432
SHA512 2d0f943b2a92305ba5ce97b1ec01900499befc5e04a6182f0c7846b7977e3df6cd6def446c4f01fbc8afd4a03808300cd6a339c89b6e9107309901aa8a669612
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6aa2b254286b6b172fe9a7a8ca207dd3e99f42911371e1b88228638eded5ea77
MD5 ea2effc511b197d132d7de4e74b577c9
SHA1 8e726d699df1ac23bbc1d1405f7b4c4b5e5fb987
SHA512 be41d221bd38c0ac42a94bae33d708ce0aa59ee55754e111989802fe31959869fa0c451a9ac2d66183344a101dd6c87076bb7a11aea1c2abc7b611ee33a47174
TLSH
T158D01122330A02B8CA20A2B302A2A20C8880E20B800B8000E8388AAE2E080B00B02882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2170b892177ac821cdf06a9cfe9e4706caf189485c07caa307fbbd210f2aa8a2
MD5 47d5f74927a125428fa045d64b64bda6
SHA1 e4b836c8681b1194d174e6816f313af0f6b9d433
SHA512 988b06d4a1719dd8b2ff1fa67152c985281ceaba037e189f5d898bfe610437917fcbd8bd8c0e8033b2b0bea2c0cad2e9c20462bed3adde15f6ea3952ea30bc70
TLSH
T1AFA002982140960ED255577030E645523778D878973B8713C19100699859754866B401
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599c17.TMP

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599c17.TMP
Size 48B
SHA256 a7152d4d6bc8e04a78b4b4b94f6135fa598ae363a3d6ea1a23d7f5b056d5cbe4
MD5 30873a58df8c70b0fa4f9140331bab51
SHA1 483d6c08dbaf45d6b836b27604e31e25b0717866
SHA512 95a09ccdfaa7e6ae0503c95ea4f619fe348d884f6ca34131df45502b6c9e6f36064a22066a7592f5b2bec942039f79bc2ca8fd5e73558d6ebcd3cb7d6efefcba
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7205.TMP

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Default\Network\Network Persistent State~RFe5a7205.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Default\Preferences
Size 6KB
SHA256 9565b69b5ed4c73ede3091cd5f20576d9772c445e0df0ca23435e138230ac3f5
MD5 178b4eaa6207e56f8a232b04cf9956e7
SHA1 f614010df607032126d862a81ab3e63b5c5353fb
SHA512 1884c0589117397aca7d34d9aeaa709af4830ddaee7016f55806ca6eac293abf5531af2cf39df18b1dd829a68d526a164163d6a7df01e9462476fc2350edd24c
SSDEEP 96:stO/dadLxGOb9qkQo5h16Z0As7/x+6MhmuecJLQ1eje7K+gfKV28XM1C7K:stWEKLonAsV+FdLQQjJ9KVG6K
TLSH
T13BD1B6065E24797B4CC6E559BA297F13E2F9607261D51E08E7FC4A2C48DAACC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4275880-f660-45cf-9dd0-78b5608d596c.tmp

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Default\a4275880-f660-45cf-9dd0-78b5608d596c.tmp
Size 6KB
SHA256 2416bb8e016d48c3df424018838c868e8f9ea1ce303d9373f3007d727d15fbbd
MD5 efc275aeb972cef6b49a6658031a2018
SHA1 4fba65a401c0de36b767bdb826946ab2817aaf52
SHA512 51754c64c075298e812ceb85e75a3d2a7421a5afec6aa0450d91a99d76b27b5dcdda948ae509e8b1c14e8cd5d1337ab101dae578f0874f70fcce3f0aa8519bb8
SSDEEP 96:stO/dadLqOb9qkQo5h16Z0As7/x+6MhmuecJLQ1eje7K+gfKz28XM1C7K:stWEsLonAsV+FdLQQjJ9KzG6K
TLSH
T179D1C7055E24797B4CC6E549BA39BF17E2F9607271D51E48E7F88A2C48D6ACC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Local State
Size 16KB
SHA256 1559abdab7ecac35d59052eafccde1c082c5942563f2fa96178b3af991af66b4
MD5 c3e51448b14064341a5ef78a789ca728
SHA1 d9ae9e0704c01ba3641d272cc49789f16c396296
SHA512 ec28fc18603508f0e1d9e44338cb5c5aefe3a7066a524069f8f2f42ff1c9449295a1c0e908c008266563f34f183bb62049f26c742ab961224f2ea247886490fe
SSDEEP 384:t+aQikB+z/xvxjg/qhEjNBSZIuSuXZmAo9zf:4/UxvxjgC+ASCDoFf
TLSH
T15072AE2F99A8BD33A5F3E9053D491F8BDBB894B254C26E748AAD5F0906C77C80307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Local State
Size 2KB
SHA256 de6e4f0f8b3c0ac0ace6e099f2c4fb4985d33c24997130ac62bf66c529196742
MD5 a0c8c4bdb8ffed40673e3d44255c6ef3
SHA1 64ed69d78ad5416daee962e4bb8d24a2ca1a8634
SHA512 5876a74979c06d0df290843b7add141293aad7ff79f7de649c18f46259e0aa075bbadfc6fc04e8d0778503ad6ed8a8cffd5f04012aca2e88778e1ce0c1ae8563
TLSH
T1F55195336C50BA37A9A28A457D453F53DF7A80A9AA432F50AADD0B1C81CB95C2347C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Local State
Size 3KB
SHA256 c6215d669bd2e0e6337be9aedd95bd2cb9b21a1ca79ee2a22fa4d4f4d1cf7cd1
MD5 e747b191fa86839166355f56bd651f01
SHA1 96a053c4e0ba9ddee33463b83fdfffb8b8977d08
SHA512 6a7faa74ce1dce4194afe8eededf51f77a687cd7e925c13e486699bc98fca7317e636646196f33b3456b85e8ac9cdea9a1fafad3ef75f48f8d36c2a3f78384b6
TLSH
T1E271833B6DA0A93B5EA29A457D853F06BBA6403AA9863F94D6EC0F0C41C769C1343C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe594acb.TMP

Path C:\Users\Admin\AppData\Local\com.nousresearch.hermes.setup\EBWebView\Local State~RFe594acb.TMP
Size 1KB
SHA256 a96d8e1e9d816acaff0844ead2c130df38d96ebcccba3f5a23cc46c304133056
MD5 c9758223587b493a6a7a884c2ab9f9c5
SHA1 41f218e0b7c38ecb0a3eb29f098b5225087d4bd9
SHA512 9eaedebeec570344e3b2d35c8fd08869b134ee28884a1a1730a7433a060e805482dfa0d07baffbfa469811e92afb965be34702cd7496aa3055eccedec2edfad2
TLSH
T10F31967799D07F32BD5192562101BF836F22407E52420F0466DD4B1C96DB84D662FC36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3172-364-0x00007FFF68BB0000-0x00007FFF68BB1000-memory.dmp

Download

memory/3172-365-0x00007FFF67A90000-0x00007FFF67A91000-memory.dmp

Download

memory/3744-434-0x000002688E1C0000-0x000002688E1C1000-memory.dmp

Download

memory/3744-444-0x000002688E1C0000-0x000002688E1C1000-memory.dmp

Download

memory/3744-440-0x000002688E1C0000-0x000002688E1C1000-memory.dmp

Download

memory/3744-441-0x000002688E1C0000-0x000002688E1C1000-memory.dmp

Download

memory/3744-442-0x000002688E1C0000-0x000002688E1C1000-memory.dmp

Download

memory/3744-443-0x000002688E1C0000-0x000002688E1C1000-memory.dmp

Download

memory/3744-436-0x000002688E1C0000-0x000002688E1C1000-memory.dmp

Download

memory/3744-445-0x000002688E1C0000-0x000002688E1C1000-memory.dmp

Download

memory/5016-308-0x000001F079A60000-0x000001F079B36000-memory.dmp

Download

memory/5016-135-0x00007FFF68AD0000-0x00007FFF68AD1000-memory.dmp

Download

memory/5200-330-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5200-315-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5200-294-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5200-326-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5932-307-0x000001A98B600000-0x000001A98B6D6000-memory.dmp

Download

memory/5932-37-0x00007FFF68AD0000-0x00007FFF68AD1000-memory.dmp

Download