59062e411bee123d0b44e0cb0a3fa23dc62c842bbfa2e97ebaf436fb6e064fa0

Analysis

max time kernel
151s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 21.7MB
Sample261102-qtpgbacv6l
SHA256 59062e411bee123d0b44e0cb0a3fa23dc62c842bbfa2e97ebaf436fb6e064fa0
MD5 9d7026297d636c19c08fef4696de06c6
SHA1 c99845878475b8e3d376f44dc0a02395dda988d4
SHA512 01d9cef06d39fcfb2a51e66eeb01ad13cf08203c202a373f9b2d6a2dde5a6818ae31c8dd64bbb1066d0ac7447aaef1b7446a4b20d8d9a1055789d5318dc9ea5c
SSDEEP 98304:WIUit1ixdn44/rz1jNPb4ZIEJro3WKrHPAtuaCJl2Y1zzIo+RK+wLSaB0a1t64k1:W1i24kx4ofPMua6sa+UgaB0j5T
TLSH
T1583718167B9A58ACD09AC470838B46235A2174EB1B36BAEF45C441382F7EBF45F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_350228489\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_350228489\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_234012637\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_350228489\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_234012637\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4392	msedgewebview2.exe
4392	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4904	msedgewebview2.exe
4904	msedgewebview2.exe
4904	msedgewebview2.exe
4904	msedgewebview2.exe
4904	msedgewebview2.exe
4904	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4904	4440	2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 4904 wrote to memory of 944	4904	msedgewebview2.exe	91
PID 4904 wrote to memory of 1828	4904	msedgewebview2.exe	92
PID 4904 wrote to memory of 1828	4904	msedgewebview2.exe	92
PID 4904 wrote to memory of 1828	4904	msedgewebview2.exe	92
PID 4904 wrote to memory of 1828	4904	msedgewebview2.exe	92
PID 4904 wrote to memory of 4116	4904	msedgewebview2.exe	93
PID 4904 wrote to memory of 3168	4904	msedgewebview2.exe	94
PID 4904 wrote to memory of 3168	4904	msedgewebview2.exe	94
PID 4904 wrote to memory of 3168	4904	msedgewebview2.exe	94
PID 4904 wrote to memory of 5876	4904	msedgewebview2.exe	95
PID 4904 wrote to memory of 5876	4904	msedgewebview2.exe	95
PID 4904 wrote to memory of 5876	4904	msedgewebview2.exe	95
PID 4904 wrote to memory of 5876	4904	msedgewebview2.exe	95
PID 4904 wrote to memory of 5876	4904	msedgewebview2.exe	95
PID 4904 wrote to memory of 5352	4904	msedgewebview2.exe	96
PID 4904 wrote to memory of 5352	4904	msedgewebview2.exe	96
PID 4904 wrote to memory of 5352	4904	msedgewebview2.exe	96
PID 4904 wrote to memory of 5352	4904	msedgewebview2.exe	96
PID 4904 wrote to memory of 5352	4904	msedgewebview2.exe	96
PID 4904 wrote to memory of 3720	4904	msedgewebview2.exe	97
PID 4904 wrote to memory of 3720	4904	msedgewebview2.exe	97
PID 4904 wrote to memory of 3720	4904	msedgewebview2.exe	97
PID 4904 wrote to memory of 3720	4904	msedgewebview2.exe	97
PID 4904 wrote to memory of 3720	4904	msedgewebview2.exe	97
PID 4904 wrote to memory of 1240	4904	msedgewebview2.exe	98
PID 4904 wrote to memory of 1240	4904	msedgewebview2.exe	98
PID 4904 wrote to memory of 1240	4904	msedgewebview2.exe	98
PID 4904 wrote to memory of 1240	4904	msedgewebview2.exe	98
PID 4904 wrote to memory of 1240	4904	msedgewebview2.exe	98
PID 4904 wrote to memory of 5968	4904	msedgewebview2.exe	100
PID 4904 wrote to memory of 5968	4904	msedgewebview2.exe	100
PID 4904 wrote to memory of 5968	4904	msedgewebview2.exe	100
PID 4904 wrote to memory of 5968	4904	msedgewebview2.exe	100
PID 4904 wrote to memory of 5968	4904	msedgewebview2.exe	100
PID 4904 wrote to memory of 4556	4904	msedgewebview2.exe	103
PID 4904 wrote to memory of 4556	4904	msedgewebview2.exe	103
PID 4904 wrote to memory of 4556	4904	msedgewebview2.exe	103
PID 4904 wrote to memory of 4972	4904	msedgewebview2.exe	104
PID 4904 wrote to memory of 4972	4904	msedgewebview2.exe	104
PID 4904 wrote to memory of 4972	4904	msedgewebview2.exe	104
PID 4904 wrote to memory of 4972	4904	msedgewebview2.exe	104
PID 4904 wrote to memory of 4972	4904	msedgewebview2.exe	104
PID 4904 wrote to memory of 4360	4904	msedgewebview2.exe	105
PID 4904 wrote to memory of 4360	4904	msedgewebview2.exe	105
PID 4904 wrote to memory of 4360	4904	msedgewebview2.exe	105
PID 4904 wrote to memory of 4392	4904	msedgewebview2.exe	106
PID 4904 wrote to memory of 3236	4904	msedgewebview2.exe	107
PID 4904 wrote to memory of 3236	4904	msedgewebview2.exe	107
PID 4904 wrote to memory of 3236	4904	msedgewebview2.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-direct-composition-video-overlays --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4440.1796.17723521523175481996 /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView /prefetch:4 /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffb5cf65fd8,0x7ffb5cf65fe4,0x7ffb5cf65ff0
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2020 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3448 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3968 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7 /prefetch:1
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3756 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7 /prefetch:1
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4464 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7 /prefetch:1
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2084 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7 /prefetch:1
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4768 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4776 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4896 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4676 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView" --webview-exe-name=2026-11-01_9d7026297d636c19c08fef4696de06c6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.5.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4324 --field-trial-handle=1796,i,17862113400282351817,13656952276339580420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:02d7b527fda3eeaf8c8147864626ca56e60fdec7
    3⤵
    PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1b64c722-016f-4572-bc7f-b64c5b878dfb.tmp

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\1b64c722-016f-4572-bc7f-b64c5b878dfb.tmp
Size 2KB
SHA256 7ff7722ccff6f6dbadf7a8974d871076b89bac3227ee41e20466e317342cab07
MD5 e93701f21c9859281b81ac7fc3b8cf25
SHA1 da17799586a22bf35689433cc8a71be2940c39f8
SHA512 fa67b57e8c2caf7bac64e04358fd3014a4451059de944877fc4da2db7913b0c04175b75aecf048ca136d85cbb26eb854f69e9d05e969ad864326ac042bd5d13f
TLSH
T15451A7B3E855AF37EDA34A083D4A2A27DE3561A6D6932F608ECD0B1C02D715D1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 863514a2da8e0e1e3553504eccb2231b2a7b0fcc1de9e01fe4e331695a46fa5e
MD5 f31869cf2688eb2c2cddbb63271c6e97
SHA1 525eee78d6aafcede2a1598569480ba6a387b1c0
SHA512 0834de805c5045b7c130ca4e139f895013fbae604d8353cc78754a567c599618ae6f63665dc030ccca8d5a6cef599aa79d5570500304236d026ed5b369c31ddf
TLSH
T168D0245737014534DC3031331013F54C0404CD0F45C7C104543CC53F1F0C0501D03441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 788974485f99c955af45af234f64b1c0f7cf0fd7a51c717d8aff7e0ac818a30e
MD5 292cef8b8f48611e660d2032c5e2267a
SHA1 10ce74d14b6aa22dc68441966195a04dcbd71a78
SHA512 334270489d96181a06c3c2bca9e2d54d70f349db7876aa6bb8c4669a7e4db9cf4491648b1b2564106be75aba232a9d08dfbb1f196f73b07571cccd3749d0b73d
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e2dee901-5886-4e5c-832c-ddca9054d74f.tmp

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Default\Network\e2dee901-5886-4e5c-832c-ddca9054d74f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

d9d96157-903a-4526-baee-02c19bf1bef2.tmp

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Default\d9d96157-903a-4526-baee-02c19bf1bef2.tmp
Size 6KB
SHA256 493d6e41fbda7377bf15eabf69db9f867ad8472b113804030a959cbe9e5bd407
MD5 9e2f013be2f184a35fff8ed3296b3cf5
SHA1 e7fbece0a5e8e053778a891d4f4847178b344c7d
SHA512 1d4beb1c4513a86e0bd944a6da098cf174662da51dd45baa63a62f7ef1fde63d1e9cd0de145e20935e78d7b01adc767003a9dcdb2eba2248feee9eb1e8661e26
SSDEEP 96:st9XdZaJFGTb9Wkgo5h16Zdus7/x+6MhmuecmjexK+gq28XM1C7K:stlyxDoKusV+Fij/sG6K
TLSH
T165D196025E24797B8CC6E518BE29BB17E2F5607270E51E58EBFC462C08DB9DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f32fcb8b-8dcd-4ddf-b684-f377c24fb47d.tmp

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Default\f32fcb8b-8dcd-4ddf-b684-f377c24fb47d.tmp
Size 5KB
SHA256 617d8c5b9aba567cdac1f93f275d7eddbe86f69df8e9c682e0239aca880bbc63
MD5 d144d9149501307e579fd6ca00818b35
SHA1 69993fb05e833389853684f5cc1bddf9d859a7c1
SHA512 cee0edb2855f08c1e087285d5e8db5aff221c8405913807a877b289083f101b263d539fbd07f16e988be74e855400e36f7ade632bb2f67e5fc6479ad5d1bddf0
SSDEEP 96:st9XdZaJeTb9Wkgo5h16Zdus7/x+6MhmuecmjexK+gE28XM1C7K:stly7DoKusV+Fij/uG6K
TLSH
T15BC186025E24797B8CC6E519BA39BA07E2F9603274D51D58EBFC462C08DB5DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\Local State
Size 1KB
SHA256 c34a24048054d2b2d34590b985b441cac4959eb73c4e8842b44673a45c819b77
MD5 48ff968d51cf52a80dfcd40b3041f63b
SHA1 9ef6dfe8279ab3bdab59f655cd4b3529e396f376
SHA512 101536b5b20ec65f318ce257d4e2c5da96bccbbf79bc84e0617c27b45f2889b0aa6b97f47c5ebd6553f29eaf472a8f1b6fea503798239655e681e97f2190adaf
TLSH
T1602165F2E4955F32FC42564A35562A6B9F2060ABC2924E4099CE8B2C179300E9577C33
MD5 SHA1 SHA512 TLSH

Submit Download

cb3007fb-310e-44f9-9fd5-4dc542954b84.tmp

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\cb3007fb-310e-44f9-9fd5-4dc542954b84.tmp
Size 3KB
SHA256 ce264a50ee2714f7d9478935b37903671e90653f73b7920541dca6b451656f13
MD5 2e2e3d5de9380615f3bc36696043907f
SHA1 d95eaa69c5548edaaeab52039d891d29c6173501
SHA512 c565b2d608887365d7390f982a0567cf26495fab9558e303b864bb7e9e62e8361890fb7b6c8e437a56dd80c6fca15c48e1f231ed091ba68bed162092af7346d1
TLSH
T1EC619973A965AE3BDDE39A057C8A2B16EB555127E5D23FA4CDDC0F0C02D72881352C17
MD5 SHA1 SHA512 TLSH

Submit Download

d3e3a68e-6d25-4999-a558-a3cfe9eb3753.tmp

Path C:\Users\Admin\AppData\Local\com.modcomparer.desktop\EBWebView\d3e3a68e-6d25-4999-a558-a3cfe9eb3753.tmp
Size 15KB
SHA256 a7375bbc5b92287c9f50be6cc725074cf797c52f2d86b9c284a8ff70942184fb
MD5 5958a063207aeba47f70c41fbeea355e
SHA1 23dc188c14fdccc997137ea86fcb68565abea5bc
SHA512 27651546c559e5544622840671d00fd48790d1bd8bfd356bc0314151e1df2eac562e953a11aa46168b95708c027a991a35faaff29dc5e024d9df1573b5558a09
SSDEEP 384:C+OBqImmJvGBLx3NaFMJFS3NBS/gG2Gf60fg6rS:HcvGtlNSmfZNW
TLSH
T19372AEB628656E377CB789097E8D234BCB646293C0D57BE8CDEC9F0E126B4441392916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_234012637\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_350228489\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4904_731270558\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1828-25-0x00007FFB7ED40000-0x00007FFB7ED41000-memory.dmp

Download

memory/4392-441-0x000001D0603A0000-0x000001D0603A1000-memory.dmp

Download

memory/4392-439-0x000001D0603A0000-0x000001D0603A1000-memory.dmp

Download

memory/4392-450-0x000001D0603A0000-0x000001D0603A1000-memory.dmp

Download

memory/4392-447-0x000001D0603A0000-0x000001D0603A1000-memory.dmp

Download

memory/4392-449-0x000001D0603A0000-0x000001D0603A1000-memory.dmp

Download

memory/4392-448-0x000001D0603A0000-0x000001D0603A1000-memory.dmp

Download

memory/4392-446-0x000001D0603A0000-0x000001D0603A1000-memory.dmp

Download

memory/4392-445-0x000001D0603A0000-0x000001D0603A1000-memory.dmp

Download

memory/4556-237-0x00007FFB7E570000-0x00007FFB7E571000-memory.dmp

Download

memory/4556-238-0x00007FFB7F650000-0x00007FFB7F651000-memory.dmp

Download

memory/5876-112-0x00007FFB7ED40000-0x00007FFB7ED41000-memory.dmp

Download