c57586eb0724cc401da7da8e39b668fabfe405f04d29faf1f4c59cb9dc8f7b5a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Size 16.3MB
Sample260629-hcdpgsfs3z
SHA256 c57586eb0724cc401da7da8e39b668fabfe405f04d29faf1f4c59cb9dc8f7b5a
MD5 675153d1322e3b39384cafb38135d79f
SHA1 a15ff90d15e48bd83c89c80221ceee10b4a93abc
SHA512 2190395e1f50f00772c47692ca043c3cd80ea77c8b226bc3dde813bb5c79dcd755cdacb66b947e847a8bafa6f4216c235abf5ce4c175ca2b9686ce022016d88c
SSDEEP 196608:A/T/jvVZ9etsZTokGOaaya8l0S7oPTLhzb8iO2M0t7:m/jxrZTJGOaayFsPTLhv8hM
TLSH
T1D50707217B5A99ADC05BC474834B8B72497130CB0B39B9FF449496382F6ABF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
6276	tasklist.exe
6932	tasklist.exe
6640	tasklist.exe
1772	tasklist.exe
6080	tasklist.exe
5812	tasklist.exe
1672	tasklist.exe
3900	tasklist.exe
6556	tasklist.exe
704	tasklist.exe
4628	tasklist.exe
6416	tasklist.exe
2488	tasklist.exe
832	tasklist.exe
5836	tasklist.exe
6452	tasklist.exe
852	tasklist.exe
904	tasklist.exe
1108	tasklist.exe
1868	tasklist.exe
2896	tasklist.exe
5556	tasklist.exe
5036	tasklist.exe
5996	tasklist.exe
6980	tasklist.exe
6228	tasklist.exe
7100	tasklist.exe
2768	tasklist.exe
4488	tasklist.exe
3836	tasklist.exe
852	tasklist.exe
6352	tasklist.exe
6524	tasklist.exe
6640	tasklist.exe
5648	tasklist.exe
5596	tasklist.exe
3908	tasklist.exe
2284	tasklist.exe
1672	tasklist.exe
5192	tasklist.exe
6092	tasklist.exe
4956	tasklist.exe
6256	tasklist.exe
5504	tasklist.exe
6012	tasklist.exe
552	tasklist.exe
1052	tasklist.exe
6244	tasklist.exe
1128	tasklist.exe
5036	tasklist.exe
1804	tasklist.exe
6404	tasklist.exe
7136	tasklist.exe
5644	tasklist.exe
6668	tasklist.exe
4204	tasklist.exe
5696	tasklist.exe
4740	tasklist.exe
6116	tasklist.exe
7028	tasklist.exe
2452	tasklist.exe
5564	tasklist.exe
6740	tasklist.exe
2740	tasklist.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\model.markov	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1987511846\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1987511846\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1987511846\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_891792266\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1987511846\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4916_1987511846\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2968	msedgewebview2.exe
2968	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4916	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	tasklist.exe
Token: SeDebugPrivilege	4740	tasklist.exe
Token: SeDebugPrivilege	4628	tasklist.exe
Token: SeDebugPrivilege	1772	tasklist.exe
Token: SeDebugPrivilege	6640	tasklist.exe
Token: SeDebugPrivilege	6276	tasklist.exe
Token: SeDebugPrivilege	852	tasklist.exe
Token: SeDebugPrivilege	5556	tasklist.exe
Token: SeDebugPrivilege	1672	tasklist.exe
Token: SeDebugPrivilege	6932	tasklist.exe
Token: SeDebugPrivilege	6080	tasklist.exe
Token: SeDebugPrivilege	5648	tasklist.exe
Token: SeDebugPrivilege	6416	tasklist.exe
Token: SeDebugPrivilege	2768	tasklist.exe
Token: SeDebugPrivilege	2452	tasklist.exe
Token: SeDebugPrivilege	5596	tasklist.exe
Token: SeDebugPrivilege	5192	tasklist.exe
Token: SeDebugPrivilege	4488	tasklist.exe
Token: SeDebugPrivilege	1052	tasklist.exe
Token: SeDebugPrivilege	3908	tasklist.exe
Token: SeDebugPrivilege	6092	tasklist.exe
Token: SeDebugPrivilege	904	tasklist.exe
Token: SeDebugPrivilege	7136	tasklist.exe
Token: SeDebugPrivilege	2896	tasklist.exe
Token: SeDebugPrivilege	2488	tasklist.exe
Token: SeDebugPrivilege	3836	tasklist.exe
Token: SeDebugPrivilege	5036	tasklist.exe
Token: SeDebugPrivilege	4956	tasklist.exe
Token: SeDebugPrivilege	2284	tasklist.exe
Token: SeDebugPrivilege	5812	tasklist.exe
Token: SeDebugPrivilege	6256	tasklist.exe
Token: SeDebugPrivilege	5504	tasklist.exe
Token: SeDebugPrivilege	1804	tasklist.exe
Token: SeDebugPrivilege	6244	tasklist.exe
Token: SeDebugPrivilege	6228	tasklist.exe
Token: SeDebugPrivilege	852	tasklist.exe
Token: SeDebugPrivilege	1672	tasklist.exe
Token: SeDebugPrivilege	3900	tasklist.exe
Token: SeDebugPrivilege	5564	tasklist.exe
Token: SeDebugPrivilege	6556	tasklist.exe
Token: SeDebugPrivilege	5644	tasklist.exe
Token: SeDebugPrivilege	6740	tasklist.exe
Token: SeDebugPrivilege	6352	tasklist.exe
Token: SeDebugPrivilege	704	tasklist.exe
Token: SeDebugPrivilege	5836	tasklist.exe
Token: SeDebugPrivilege	6012	tasklist.exe
Token: SeDebugPrivilege	6116	tasklist.exe
Token: SeDebugPrivilege	6668	tasklist.exe
Token: SeDebugPrivilege	552	tasklist.exe
Token: SeDebugPrivilege	4204	tasklist.exe
Token: SeDebugPrivilege	832	tasklist.exe
Token: SeDebugPrivilege	1108	tasklist.exe
Token: SeDebugPrivilege	2740	tasklist.exe
Token: SeDebugPrivilege	6640	tasklist.exe
Token: SeDebugPrivilege	6524	tasklist.exe
Token: SeDebugPrivilege	5996	tasklist.exe
Token: SeDebugPrivilege	5696	tasklist.exe
Token: SeDebugPrivilege	1128	tasklist.exe
Token: SeDebugPrivilege	6980	tasklist.exe
Token: SeDebugPrivilege	1868	tasklist.exe
Token: SeDebugPrivilege	6404	tasklist.exe
Token: SeDebugPrivilege	6452	tasklist.exe
Token: SeDebugPrivilege	7028	tasklist.exe
Token: SeDebugPrivilege	7100	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 4916	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	90
PID 4916 wrote to memory of 4116	4916	msedgewebview2.exe	91
PID 4916 wrote to memory of 6052	4916	msedgewebview2.exe	92
PID 4916 wrote to memory of 6052	4916	msedgewebview2.exe	92
PID 4916 wrote to memory of 6052	4916	msedgewebview2.exe	92
PID 4916 wrote to memory of 6052	4916	msedgewebview2.exe	92
PID 4916 wrote to memory of 4768	4916	msedgewebview2.exe	93
PID 4916 wrote to memory of 3064	4916	msedgewebview2.exe	94
PID 4916 wrote to memory of 3064	4916	msedgewebview2.exe	94
PID 4916 wrote to memory of 3064	4916	msedgewebview2.exe	94
PID 4916 wrote to memory of 2792	4916	msedgewebview2.exe	95
PID 4916 wrote to memory of 2792	4916	msedgewebview2.exe	95
PID 4916 wrote to memory of 2792	4916	msedgewebview2.exe	95
PID 4916 wrote to memory of 2792	4916	msedgewebview2.exe	95
PID 4916 wrote to memory of 2792	4916	msedgewebview2.exe	95
PID 2780 wrote to memory of 5036	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	96
PID 2780 wrote to memory of 4740	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	99
PID 2780 wrote to memory of 4628	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	101
PID 2780 wrote to memory of 1772	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	103
PID 2780 wrote to memory of 6640	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	105
PID 2780 wrote to memory of 6276	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	107
PID 2780 wrote to memory of 852	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	109
PID 2780 wrote to memory of 5556	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	111
PID 2780 wrote to memory of 1672	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	113
PID 2780 wrote to memory of 6932	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	115
PID 2780 wrote to memory of 6080	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	117
PID 2780 wrote to memory of 5648	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	119
PID 2780 wrote to memory of 6416	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	122
PID 2780 wrote to memory of 2768	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	124
PID 2780 wrote to memory of 2452	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	126
PID 2780 wrote to memory of 5596	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	128
PID 2780 wrote to memory of 5192	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	130
PID 2780 wrote to memory of 4488	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	132
PID 2780 wrote to memory of 1052	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	134
PID 2780 wrote to memory of 3908	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	136
PID 2780 wrote to memory of 6092	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	138
PID 2780 wrote to memory of 904	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	140
PID 2780 wrote to memory of 7136	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	142
PID 2780 wrote to memory of 2896	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	144
PID 2780 wrote to memory of 2488	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	146
PID 2780 wrote to memory of 3836	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	148
PID 2780 wrote to memory of 5036	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	151
PID 2780 wrote to memory of 4956	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	153
PID 2780 wrote to memory of 2284	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	155
PID 2780 wrote to memory of 5812	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	157
PID 2780 wrote to memory of 6256	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	159
PID 2780 wrote to memory of 5504	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	161
PID 2780 wrote to memory of 1804	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	163
PID 2780 wrote to memory of 6244	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	165
PID 2780 wrote to memory of 6228	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	167
PID 2780 wrote to memory of 852	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	169
PID 2780 wrote to memory of 1672	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	171
PID 2780 wrote to memory of 3900	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	173
PID 2780 wrote to memory of 5564	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	175
PID 4916 wrote to memory of 6456	4916	msedgewebview2.exe	177
PID 4916 wrote to memory of 6456	4916	msedgewebview2.exe	177
PID 4916 wrote to memory of 6456	4916	msedgewebview2.exe	177
PID 2780 wrote to memory of 6556	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	178
PID 2780 wrote to memory of 5644	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	180
PID 2780 wrote to memory of 6740	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	182
PID 2780 wrote to memory of 6352	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	184
PID 2780 wrote to memory of 704	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	186
PID 2780 wrote to memory of 5836	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	188
PID 2780 wrote to memory of 6012	2780	2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	190

C:\Users\Admin\AppData\Local\Temp\2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2780.4244.255194962404156265 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8e9b75fd8,0x7ff8e9b75fe4,0x7ff8e9b75ff0
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,1383355764750023298,14446162500075677026,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1768,i,1383355764750023298,14446162500075677026,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1768,i,1383355764750023298,14446162500075677026,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3320 --field-trial-handle=1768,i,1383355764750023298,14446162500075677026,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd /prefetch:1
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1768,i,1383355764750023298,14446162500075677026,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:6456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4556 --field-trial-handle=1768,i,1383355764750023298,14446162500075677026,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4540 --field-trial-handle=1768,i,1383355764750023298,14446162500075677026,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:6388
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6640
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6276
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:852
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5556
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6932
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6080
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6416
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5596
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5192
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6092
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:7136
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3836
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5812
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6256
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5504
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6244
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6228
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:852
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5564
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6556
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5644
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6740
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6352
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5836
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6012
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6116
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6668
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:832
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6640
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6524
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5996
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5696
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6980
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1868
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6404
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6452
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:7028
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:7100
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  PID:6644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2d15f461ae9eb2b7927a36c4ed67f1ed812fdb7f89f874cf5cbfa851484777f3
MD5 155128d3f47a7e6bb93bc8d459ee7a6d
SHA1 5cdb23e1a01ed02efed652fef1d0d58f390f6add
SHA512 c377f2117ac273fbc32269e61e2b3123927b7d52baa5849d6a2e2e83b6e5db29a12fdd3f5ff79d08f6eeedd53481277053ec19fdc15cb3939e21a11365cff3d0
TLSH
T144D0121272010175C0313133184271494502C10B804940845C78851D2E080D549024CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1eabfabbac1ab52acc2e7f681c8e687fe1e279778a9724798ad02d6f07c94e32
MD5 62f345df8608af69b7f38668fa11718d
SHA1 62c8d01be7bf0832f47dc361f48fca15e0b05b7b
SHA512 36e6593ec37ba8fbf68a6e7e9af0400648621973ebe2c5695b48298f5e40b8f92a5a7ba1cb45d7834000fd77e7e12e5367f012c0636631233d97cf67461c4b16
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

65cf16a9-c9f5-4b01-b0b9-fdf30a6dc124.tmp

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\65cf16a9-c9f5-4b01-b0b9-fdf30a6dc124.tmp
Size 6KB
SHA256 5dc90d7fb49027d67754a3a94a4e3e29e08e394cb0d17b6fa0b384cd84560f24
MD5 28787f2cb5adf29d157ab77e5ca77ebd
SHA1 f447603614984f5383a8e7d15ea42ef469847b68
SHA512 f9b939378210787b948f6cb4e3e3ef5984b2463c4ba300a1af604febf91b9ab862c48c04d168545dc7f129df38b842f4166841df0e7af29e0e675b24e1884690
SSDEEP 96:stD/d7qEiob9bkZo5h16Z0Ms7/x+6MhmuecJuT1ejeFK+grT28XM1C7K:st7hqC6onMsV+FduTQjjJG6K
TLSH
T1E3D1A6065F24697B8CC6E108BA3A7B17E3F5A03261D51E58EBF8461C09DB6CC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 2ee1375256a402058455bb98adceda8adaece3205462a3f769e420d6448988a7
MD5 a0142ce644978cc90ef0e647d8ea1893
SHA1 7c7fd5bfe0c6edd29dd8c09cba24d6f0a045d06f
SHA512 c1fd03d8ffd61713ce8034df70e04fe14d10d1c754b26d5cfbfc2c954b66dec9f76850e9df59e43c0acaedbd0264c8b2ad74c9a53560ede91cf33ddf81330d94
TLSH
T168E01718C79D105ECB8D477129F05C427B306B44C323CD17E09187F9948B3F68D81029
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e5c7.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58e5c7.TMP
Size 48B
SHA256 4952042f9f7250049283c5c24be524c98c52b050ad038b12cee8709a1b7f7091
MD5 c1ec0053af67aeddb250acee8d10a16d
SHA1 8632d6068854b90c99f7055f1bc2bebe105ddd64
SHA512 3d089c38b762eb697803a9f85a3d0ec8805ad1aaec5f42fe18f65694f708721586075d5e3ae796e7019b0e15e3d476a2fe49c00d895beda530368716cbd9a4e9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 b68159242923e661f10ba71941387887a2c5f94be8b4af7e9fcbe6cc19923ed5
MD5 70767cf1f4a41119a11c367a1996d9e2
SHA1 d501690f51ff0b81d46ef93910917d3f5daa3a6c
SHA512 c3302152b8633ed3f8e48abae9b864cf7ce17a341d377e88633729130d7e4bb1d97f14a73bf7dd251d8f114ab31cb7d85b7db4785e53be73715455e12863d5da
TLSH
T10531B2A683F4C67D8A4166E427347D17CC2E051993286E37CDEAEBD667D20B1E21120F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe597ecb.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State~RFe597ecb.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity
Size 859B
SHA256 ec2409c7a0dd10dd589c8b496da1b3128e160712445eba73b45d4e7c0af6aed1
MD5 5bf8689b4120238948cfcb071731d776
SHA1 7c28237e03a527ca9caece35a59f5f3ec25e599c
SHA512 85a82450f69377ed672c9d94048507e26fc75ce52a6255d44e7fb345b1789bf90c677eca5397079cf73796e926222659afa9ff60e8bba8d961a556d0a89973c3
TLSH
T11C1188DB513EA8EB1078187B1D84BC05AA73E834035238F5CB66806CF8820F35A27476
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58bbe8.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity~RFe58bbe8.TMP
Size 691B
SHA256 8d82a184d956c00f8aa70e69cb5d091661799374adf4d9a1daa97d03da438e15
MD5 80de72ee059e0b2537a931a48777fbd6
SHA1 d0ccecb5ff77e8787edc1fa92e31f26484975718
SHA512 a4b960731bcf6f7f88aa3396d085f5a537a5ef80f1700fd9c7256914c08eb9b6493a15b87eea4fc9c0136628168e890f9d682d41f4ceff5bc0dd04d1ac232d8c
TLSH
T18B0176D3953EA4FB2078187B0D847C15AB76F93913425DE4CB66816DF4820F70E274AA
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 6KB
SHA256 9538e3b6158189e63b0245e2c7bcdf259c9a3835ed980c777f5282c141b742f5
MD5 dcb879978cd11eb886800c0d54de8c80
SHA1 dcc22b0ff511f4bd212921dd99abd24a3df2fdeb
SHA512 f65783d493d34f766dbd90b2203044b128cf633f542702fb23b1cb4f15258e3a9d324d968d5a2676878c7971672d7a667985a553eb52e3f2c7e3edc390f3845d
SSDEEP 96:stD/d7qEZGob9bkZo5h16Z0Ms7/x+6MhmuecJuT1ejeFK+g22K28XM1C7K:st7hqc6onMsV+FduTQjjaG6K
TLSH
T1A9D1A7065F24697B8CC7E108BA3A7B17E3F5A03261D51E58EBF84A1C09DB6DC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 2KB
SHA256 5daefc4c50a2f662d0c45bccbcf397a9a7660c813babc1b5d6e6ff2778f06abd
MD5 06584fa5736216e8c524a4369cd0925f
SHA1 14f1518c0f4e5e59c3b9a3e84b516e18f63296b2
SHA512 ade35c74d92741d29f6eaf1ff2c4f97df3c2e276d70ccb955a72f800b6db5d73102f0aea2eadbc9b6d72992a6a93dbcbffb771cb59739bf933f5d1248b65bb55
TLSH
T15451B87769109B3BCAE3D60979463F569A79D092A6522F209ADC070801CB45C2317C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 4a6d353462b50e34ca80d887a185317091e46eb8d6ba7bd92de3269aaa9eedaf
MD5 c7714ba2ac554d280b4e4a457d0d5699
SHA1 41e6c01e38da703add28747be41f76734558d055
SHA512 b092ca18cae8abf1ea5b2bd8f6a36210c4359a92644be4481cfe83a0d42f97f19e6add20c8d5f6dbcd766353d42e2bd8ae5adb1f90455f1f7df516e22f033f1e
TLSH
T1A671967B6960993B8EE3D505B8863B1AB7B99023E5917F65DAEC0F0C02CB6981356C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 15KB
SHA256 014eb51b62f4531328c2632aa73947da3a2e6b71c2c6744a986760411d16aebd
MD5 efcf3d79b258a1d1ba5b8ca02258fee1
SHA1 ddefea2d728d0ab55ec6415caa9bae6893e0c9ad
SHA512 2169795cc566417d3957b3688eb73774f616b69d41d5ee2a8ffb75630fe9bcda3a445d7baeb3cdc8c37cfb75a6529a7bc43db6536bd4f47dfd818f64ac55a584
SSDEEP 384:isrv+89zHqlDNP9oid6NBSquhQ5k337KNg:trv+4UNbd829337KNg
TLSH
T12572AE33E678AA379DB3D509B48A6B0B7BB8A09352C21A70D9D91B4D42CF4D92307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe586abb.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State~RFe586abb.TMP
Size 1KB
SHA256 d7b2dd17a812acfa6059ca9cb287ad3ead99997affcd8e017769edd67bf8d450
MD5 b2f145a96358186eded0638f1575452a
SHA1 bab4accc099d79ede7a06b6b6317e2227684a1ee
SHA512 400d2d821bed3069a2710f3e97f1c320cc01b8d03e93e082f7f2c8dd38848944f5820b4ad2c717f4dce1b3672603a795eac13f986f1a8866fdad68b9ace268b4
TLSH
T17331A4BB5A901F7AEC92E10B31027FDB2E7490A792525E147ACC030813C744CA63FC32
MD5 SHA1 SHA512 TLSH

Submit Download

ui-state.json

Path C:\Users\Admin\AppData\Roaming\Cosmic\ui-state.json
Size 2KB
SHA256 e4a17198a7be8cecadb68009ea372c2f186c23af9121633990c43a8e96e82217
MD5 25bace007e73d81d3160a5f4fbc61ef1
SHA1 151126f33672ef4760b6ddfd3ea31772a161b482
SHA512 3b87d98028264d7a4673c41a18d99ac3676564add842e58b0a872ab5db12ed7af3b43b9453ad0620400ada7a32467837fbe012a2b6bfd43dd182473b32636195
TLSH
T11841492ACA680C7710E4762A9CED52436A7582530D593C2CB78C5A0C1F9E33F65B79ED
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2792-58-0x00007FF90B570000-0x00007FF90B571000-memory.dmp

Download

memory/2968-362-0x000001A684600000-0x000001A684601000-memory.dmp

Download

memory/2968-364-0x000001A684600000-0x000001A684601000-memory.dmp

Download

memory/2968-369-0x000001A684600000-0x000001A684601000-memory.dmp

Download

memory/2968-368-0x000001A684600000-0x000001A684601000-memory.dmp

Download

memory/2968-370-0x000001A684600000-0x000001A684601000-memory.dmp

Download

memory/2968-373-0x000001A684600000-0x000001A684601000-memory.dmp

Download

memory/2968-372-0x000001A684600000-0x000001A684601000-memory.dmp

Download

memory/2968-371-0x000001A684600000-0x000001A684601000-memory.dmp

Download

memory/6052-24-0x00007FF90B570000-0x00007FF90B571000-memory.dmp

Download

memory/6456-318-0x00007FF90A680000-0x00007FF90A681000-memory.dmp

Download

memory/6456-317-0x00007FF90C5C0000-0x00007FF90C5C1000-memory.dmp

Download