9bf17729dd6095dbfb7f033e2492f326b20d64b42ab7429f102fecd4fed24224

Analysis

max time kernel
151s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 26.6MB
Sample260723-ccdftsfb47
SHA256 9bf17729dd6095dbfb7f033e2492f326b20d64b42ab7429f102fecd4fed24224
MD5 36b54614e3aeb237b6cb452d50052735
SHA1 768e42d8cfdd905a8e8d998b7f7374cf298850cb
SHA512 2e7d9e5c09ff859cd6be963d13001cb2b9d77ffb8a35370e49de39295c3885e790eed2f240ec3e3f50ce47072af3e3df3d991f6c97beb442b6925a289c59879a
SSDEEP 98304:17UW+kSU9KFKAcRHs/aYMkJwrNuq8j2tNGAIOlIdmLaNJDLJgVE6HtCez/Amdkx+:NAcRXUWG3RJyzuxLbkIXru
TLSH
T11E570725BA5A996CD09AC474834B8A725A3130DB0B35B9FF44D492383F6DBF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
33	discord.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_390683590\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_390683590\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_390683590\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_1320349139\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_390683590\manifest.json	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1456	msedgewebview2.exe
1456	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5704	msedgewebview2.exe
5704	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5756	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5756	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5756	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5756	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5756 wrote to memory of 5704	5756	2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 5704 wrote to memory of 3496	5704	msedgewebview2.exe	90
PID 5704 wrote to memory of 5112	5704	msedgewebview2.exe	91
PID 5704 wrote to memory of 5112	5704	msedgewebview2.exe	91
PID 5704 wrote to memory of 5112	5704	msedgewebview2.exe	91
PID 5704 wrote to memory of 5112	5704	msedgewebview2.exe	91
PID 5704 wrote to memory of 2896	5704	msedgewebview2.exe	92
PID 5704 wrote to memory of 4656	5704	msedgewebview2.exe	93
PID 5704 wrote to memory of 4656	5704	msedgewebview2.exe	93
PID 5704 wrote to memory of 4656	5704	msedgewebview2.exe	93
PID 5704 wrote to memory of 296	5704	msedgewebview2.exe	94
PID 5704 wrote to memory of 296	5704	msedgewebview2.exe	94
PID 5704 wrote to memory of 296	5704	msedgewebview2.exe	94
PID 5704 wrote to memory of 296	5704	msedgewebview2.exe	94
PID 5704 wrote to memory of 296	5704	msedgewebview2.exe	94
PID 5704 wrote to memory of 5812	5704	msedgewebview2.exe	95
PID 5704 wrote to memory of 5812	5704	msedgewebview2.exe	95
PID 5704 wrote to memory of 5812	5704	msedgewebview2.exe	95
PID 5704 wrote to memory of 5812	5704	msedgewebview2.exe	95
PID 5704 wrote to memory of 5812	5704	msedgewebview2.exe	95
PID 5704 wrote to memory of 3212	5704	msedgewebview2.exe	96
PID 5704 wrote to memory of 3212	5704	msedgewebview2.exe	96
PID 5704 wrote to memory of 3212	5704	msedgewebview2.exe	96
PID 5704 wrote to memory of 4836	5704	msedgewebview2.exe	100
PID 5704 wrote to memory of 4836	5704	msedgewebview2.exe	100
PID 5704 wrote to memory of 4836	5704	msedgewebview2.exe	100
PID 5704 wrote to memory of 1456	5704	msedgewebview2.exe	101
PID 5704 wrote to memory of 2700	5704	msedgewebview2.exe	102
PID 5704 wrote to memory of 2700	5704	msedgewebview2.exe	102
PID 5704 wrote to memory of 2700	5704	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5756.5776.8483945540695941565 /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView /prefetch:4 /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x104,0x7ff9616e5fd8,0x7ff9616e5fe4,0x7ff9616e5ff0
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1752,i,734116789798951765,5964763709521572085,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1752,i,734116789798951765,5964763709521572085,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1752,i,734116789798951765,5964763709521572085,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1752,i,734116789798951765,5964763709521572085,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5 /prefetch:1
    3⤵
    PID:296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3356 --field-trial-handle=1752,i,734116789798951765,5964763709521572085,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5 /prefetch:1
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=1752,i,734116789798951765,5964763709521572085,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2636 --field-trial-handle=1752,i,734116789798951765,5964763709521572085,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5156 --field-trial-handle=1752,i,734116789798951765,5964763709521572085,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView" --webview-exe-name=2026-07-22_36b54614e3aeb237b6cb452d50052735_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.0.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4196 --field-trial-handle=1752,i,734116789798951765,5964763709521572085,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b595fd530105ecd2814aa0fa77decb456994a3b5
    3⤵
    PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cfa295d7977d3441ce963798d72c7ac62ba6a90e4f61a77aec682fd917d95aef
MD5 45635e26cce99656f739cd0632f9032e
SHA1 d83756096b9fea862d68d3f6e5f9df265e32d7c8
SHA512 ed0f43cabf2181d0095d620c482e3bbf8a14829b06626014de74114ea11f3e097e6e98ac9cbb47c7e7d70dfbb52fda96d8c404f908aa8895e53db307c8c67b60
TLSH
T18AD0121273510534C01036330442658904C0C30B8045C0006438E56E2B142912902592
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4e9df9e9f74c8725288b1fec8453907bac864e39bf59457861cbc5371216b5c0
MD5 0690362db9b6437d809167b2e280ff4a
SHA1 a79bc2dc973c3122637c7124b615dc37ac0dd302
SHA512 0b847d40e7c56b0fdca9551a6f496dfbf640fb20b4e5d6a4a4e2af0cbd7734b0455d0aee166450959c11abc09d3f3fc074445f8e8715e3c4a2da48d7760a3048
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 381e1319a1595d09470e1017fb4b3a50866fcf0a325631ad055fcb8c80ac9940
MD5 4a1043a137d2ea049ecf1961380dafc5
SHA1 7782b9c393b9554181b8d808680efe98dbfbe093
SHA512 535ef789920806e897d59a212abb3c0006c5758ae4f5b2c46b674e41aaabd768d0b2ee41ad9c69b3174cbc184e164568c73dd5497982e714ea1d142639a442db
TLSH
T190B00151408D185AD28113B969D2F680BA74AD610F43EF8681A541AEA714F499983654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596fe7.TMP

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596fe7.TMP
Size 48B
SHA256 c9229e9eac0c4494851649b751a91e7e3744d84071f726ffb159c9f6691f9f2a
MD5 f4a169ea0aeebd7f8da008af8f6be2ff
SHA1 07db075326839699bf20ede5f8014d5ef812da7c
SHA512 60db92b327e93d71d2e1924118cabec146ddb67f1712c2e09a70718d667f8a1c246cd09d96ac82ecb076d9021b1eed3bd1b223ddbe6f7b6ac5022efa7a2e2a40
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 d0e332c7f674072e6979d8af1b9af367221f6f69fcc0c944efd7772acc8ef130
MD5 13f8ed756dc7ca803e5059f4a60fd626
SHA1 8adfee86b0ca028c2fab66fa858dfb8a7faeb606
SHA512 fe373a7e0d0ba7bc4a377c3953b7a74b932a16d432b453f137f15b2474ae9f1c03d2d521b43c43bea6fec8e0d3e2be91e149749476c92ee83f7436944f31ce54
TLSH
T1C851BE92C2E4C66DC91566F427347817C92E0918D2283E278DEBFBDB67D20B1E22154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f35f.TMP

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Network\Network Persistent State~RFe59f35f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 4e25c79dbf04277e867e1f3508915390a7c37e8653dc610e77a63c74aaed1326
MD5 82b19863828b48932775748d3d8aae10
SHA1 a05c3384f004a87364dddab2b114bdf79cb3f289
SHA512 d38baa81872c4dec771895731818b1fe10906b7481b5dd74c33a365795e610a8bb07dfb16064eedf435d53ba49b4ad4400d0e1eedf62f223c544bda9f8bf6ec4
TLSH
T147F09EA341BEE43710BD0A6E0E867A057B7FA4351256E4F8C95B946CE0D7DF38342462
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 1936d8f4e41b35315809694fd62777b8c61153735e8a4475ffafae4f82bcb78b
MD5 caae78a102046cda3ed41636e7242219
SHA1 436720b496e6c202f5346e4881033c8bd295cfad
SHA512 dc999c27e9aab75f8cbf734071c605f91be4b64a6ae0ec8f28cbe7c167fb841edd19c252d3d9bff73cf25d2cc1037e71347ed5345ee945e994054e3154f4159a
TLSH
T139F09EA341BEE42710BD0A6A0E867A057B7FB4351257E4F8C95B946CE0D6DF34342462
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59643e.TMP

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Network\TransportSecurity~RFe59643e.TMP
Size 188B
SHA256 788b3a0465a67dd83f5f1f5617d2cc62e6f99d5bca68154689991f8e4f2c59d6
MD5 c20bb0211de021e8acc7a871dcd7bc1d
SHA1 49d7cf1ce9da92a0af62e3a5cf1caddbd0e8fb77
SHA512 473077c37566df2898c6f3bd82c3398363a3aad82d784b08ebf015f0ec5243651ccebdc5aa734bce2a954f2ffc090cb15c7e89de6c59e0c5ea981b71b897ee2d
TLSH
T11EC022620069A032507806210984BF086F3AA03502C594E8829609AC90804775503422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 3c54e3fede0b297dc96b3dfa381329e2920ab08e46319147694ca8bec774fae5
MD5 94fe7ca29a6cc5e8daeaabe3d066347a
SHA1 6e659bf8a7e72c226e6defd0388e9b98701326a8
SHA512 31fd693f1c434142e1fbd8c983824fa2fae839516a416b9494a98573a56bd4e8e935ced0dfd2abbfa03f3009f775a9ea6147610d1c70d7781061c15d1e6f8d52
SSDEEP 96:st9/dyaoJz8b9vuk+Io5h16Z0Ags7/x+6MhmuecJAGcMkkjemK+gykiU28XM1C7K:stBLU0onrsV+FdXcwjGzG6K
TLSH
T1AED1A4065E28687B4CCBE108BE29BA07E2F5607265951E58EBFC861C08DB6CC7303D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 44cdd776a309b363e5a999fe08378907c2bc78c145f280e1a3564783c23edafd
MD5 947a86e76b65b72a59195a9be46b2d1e
SHA1 942c60283d7de5a441d2b3f7ac63c8ac7b762539
SHA512 b88e1fe3b4e65428b79f5e24f682d2a4acccf0d67da8c60939c9d46babfa6c4107b53314c246ebe5e4e6ca605a99e1ec77cb7b1169161af0f62707d64cf34db4
SSDEEP 96:st9/dyaoJyG8b9vuk+Io5h16Z0Ags7/x+6MhmuecJAGcMkkjemK+gykkZ28XM1CO:stBL20onrsV+FdXcwjG8G6K
TLSH
T1FAD195065E24787B4CCBE518BE29BA07E2F5607265951E58EBFC461C08DB6CC6303D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5948f6.TMP

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Preferences~RFe5948f6.TMP
Size 5KB
SHA256 1d05da0947dc809df9bc21c8ea1a3dc77ef27d5fee05a07bc6e2f8aeee5bdf21
MD5 b7c7f6920d8300c77838b2e741a36bab
SHA1 e8c1eb78b29c196488a7a627c1e2697e253e68bd
SHA512 60af880fb730fb3fec55534a6cedc5c25cc5c24075ced6cb235e3b7c6ccc6a97919491faba8fe21c3305403dcac1333cc273217ba23196724208e43cecdb3c64
SSDEEP 96:r9/dyaoJz8b9vukXdo616Z0Ags7/x+6MhmuecJAGcMkkjemK+gyHu28XM1C7K:rBLU4o6rsV+FdXcwjGjG6K
TLSH
T12BC195065E24797B4CCBE508BA39BA07E2F9507165D51E58E7FC8A1C08DA6CC7317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\1487141e-4063-4678-b305-3a460afd859b\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\1487141e-4063-4678-b305-3a460afd859b\index-dir\the-real-index
Size 384B
SHA256 3d80e1754df12d8499b39a5a42dc48fb7a46be528d080f37488a0bf624565d2c
MD5 ea1c4ef57bea6eabb338e7973d58cc06
SHA1 a67e73d6b9d887431a008648be5c7091c559aa0b
SHA512 db19b842000b798471383a19edbdbda530e94099f2a1b586bd8106257b1e09248dfa7d4767bbcdbf4cd27832f8fc9e2e69609b63c8bd140f20e6201ead626edd
TLSH
T1CFE02B71E912CC27FC346AB97B5580AC373342A2A750570271B5B4FCDD569449143260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597843.TMP

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\1487141e-4063-4678-b305-3a460afd859b\index-dir\the-real-index~RFe597843.TMP
Size 48B
SHA256 c2da2efb96cf3ed2fa1e34da9f6b0539091d0b144d1bfd026f33a700fb249080
MD5 e2452a7cdc57a1fc737f7ed8ac670021
SHA1 59d2fbcc377e44597c3a9d507865ae34b2546233
SHA512 d63add352564b68175ba457f73fb1867136f4367b642d649a511ea8965844f4310a73d04251a560d2f9b3b680a0fcdd5d305756fe349c5c940b63c16b342e685
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt
Size 54B
SHA256 dca74eb15081805dec65e1bb4f8ce9cc3e67b8485e2b5cbcd4b0107d232482e4
MD5 8d23ffa8b4e23edbb07f484ffce14949
SHA1 a12a0f054e53c0fa5587813c93dc360e8469be59
SHA512 c7a674f4238c4bf092b1a393fc99b020af64363a026989fe839605ec233c8bab6d7e792fb66027aace65a73473465172acdcf9d2b51f737d39c2b9a8405a3688
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt
Size 145B
SHA256 8bdc9e731cc7f26a957e799f622193efdb92053cdb2b268a4b04b94256d96a17
MD5 f1593edfe914480ea0d4f1b192c08d9a
SHA1 c8e386ca5ed182b84d665c87db4ff0c10166b98f
SHA512 55fafd7b5477211b6f7e9379c0715da3915a8d6f82c34e3bf665000cf79eba3d914c10b802218d270212a0dc6d03bb0598c3e309fd25927c9ddeb3663a80b99e
TLSH
T1CAC08C9E3A02CA3942A09DC67BD88E3EA20A00D50295290491008C7002C010C303233C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt
Size 152B
SHA256 2109e8fea9bece01c17eadaad4b7a3bbc87162199626622e3937a6b2d1d5a790
MD5 725e531a7e28d3d62215f546da069875
SHA1 3631077bf5401feed293d4191ca29ba5879d29b5
SHA512 89e3dc900fe46d99f5a9a054b1dd268f39730d07e3bc70d0c1d6745358422e7e0d061d3137237a1961f2e9da5a801be2e483f842ee526c4ae51b4f959ca24f67
TLSH
T162C04C9D2A02853957A09DC7BBE88E7EA64A0DD5469629449144BCB112F121D317173D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe592a52.TMP

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt~RFe592a52.TMP
Size 152B
SHA256 90964613d0391318f0717d9fdae32e90e37a0eaa3e4ed8f9bcabb96f6b095641
MD5 1b05d5e605c4bd82ba74f31793321b32
SHA1 fd49b2aadde4e18100bf8be0df72bfbd9193cdeb
SHA512 b58e82ca44950ef7230984189ee2639dc06bd24967db964ac1f4873ed1f957cc42a3597e9e822523a717229f8f685568352577a191d82cd934af130dffba64e6
TLSH
T171C04C8D1E51852A876068C3BAF88D2E551A2DE5059A29449108BD9216F030EB07573F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 a91c419b2e8a24459364f57059175b65c1928f41bfd16a824679e96008bedd74
MD5 efdbbb25d054073289c53c16a814f9e9
SHA1 3361d99aee58c6e036823b8296b269d968292686
SHA512 39385379df24bb6b4e1cf2cad4ec8f141cec5943759288427fe7a2628547e461a3d4b62eb6d1816be6f55d7e95e9d65f3cb3d66c5c1aedb4552b4f91f1b1cdc3
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe597872.TMP

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597872.TMP
Size 72B
SHA256 dc2fa009176b0c37e05def43836db409c660b4650ed367833a2af367dfd4704a
MD5 e31ebdc2bdce4add70061ab346ddf056
SHA1 3e0ab587e3ce3341db572bfcb987d327e297abc3
SHA512 7b4f9c5fef6b6a29ade998b7f61050f6fc68cfc785eda64830ddcce181956b8c956dcff4c97fd6700fbc114098eef17a19e3f3f80e045106bbfe1596329963e8
TLSH
T107A0021543413A70C10142F2102672947330BE25D4085B666ADA06459C6466C6A21650
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Local State
Size 2KB
SHA256 2c4d5d9589d122e8713e4a8a9252efc98307bcf1ea68d6a1aa218f7634add43f
MD5 5c18306e7bed937b7a587b515152f73a
SHA1 b87fe7c0430c5b40dcaa1f8eb14dcebca1142411
SHA512 1c226546ec5902ca64f904ea3a7a95e7578327e5d6d86259e1866d12da63bb99203f16935dbda3885b18250c5b8d0cba2c151015c21286276edde7fc305a619d
TLSH
T1F451827368506A3689E397097D86AF539EB590A5BB522F90AADC0B1C00DA59C2347C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Local State
Size 3KB
SHA256 4e047c230f9f60f0fe830ca52cbc9aa260b4b6af02fa186c6f6e1e7ef541c3b1
MD5 7bab3846374d69de54b593b10b7431ff
SHA1 9aecf17abce0978b37469a38c42d37b6c1501ea7
SHA512 125a8d7959f09bb704cb9321ae411374477270f6f8b83de9bd04f86ab748df7ba4a91a4d5922405f9deac7f05a33f7835d66e3c08beb162c977771cad9cd4c9c
TLSH
T1AD71857B586099374DE39A05BC856F42BBE55026E6853F94D5EC0F0C01CB29C1353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Local State
Size 4KB
SHA256 2ba31330d326f6d50654cfe6854d4b1fa27197432eece18d7037a8a9c7877bd2
MD5 9eaa3902a552982693af363ff822d8b0
SHA1 121b590268914294aff9ea6e50618d0a9d5a3719
SHA512 14b6339b19aa87f8a285ebc11540833a2417d52412fc4c098919d39f3993a7f36cf971fd95bbbf72ad286d671288a65fbe6ce16c5707947fd5825b6ad44b05a3
SSDEEP 96:CNkGSCBffXAVeGRD8kh/cI9URoDoto+5R1Q8eBzHA6yl3ZbKTULJja:CNBS2AJHeoDUhRPezHwjSD
TLSH
T16781937B6460A9374DF29609BC816F43ABE58067E6953F98D5EC0F0D01D728C1343C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Local State
Size 4KB
SHA256 9a7bea88d319b1c0eb0f04a64d3ae612d69a37898bea69198a62c5fb495fa508
MD5 1d65afc15c7fc62ed9ad1e461d069f17
SHA1 6e8332a401093cf8185df4cb27fff91538d31f09
SHA512 6fc01253c4e62f744897408f04c15e6c89bab3669d74ef613d84dc5bf4954a72bdd2687d43bced516ca8f79524130d3defef68f55fc67703c21b9fdf4d3456d5
SSDEEP 96:YNkGSCBffXAVeGRD8kh/cI9URoDoto+5R1Q8eBzHA6yl3ZbKTULJja:YNBS2AJXeoDUhRPezHwjSD
TLSH
T1F181933B68B0A93749F29A09BC816F43BBE58067A6953F98D5EC0F0D01C768C1343C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Local State
Size 16KB
SHA256 75fc77dce0558df7219077c5a666be79be8a24b38a7ef19d3d5bb05cd21f956e
MD5 016d67e18b13de4d84b85c36fb8a0e79
SHA1 08b9096c07bc4acc7ea56ae14f1fac66b7c21e4e
SHA512 c111ad313dad2014054696876d4cd1a55907a25c203f88b6eb20727389e619786c35c73efaee1b7b8978f6cd0eef08e59bf9d75a4763d7ae8f9479191accbf8a
SSDEEP 384:F+aQikB+z/xvxjg/qhEyNBS2Bkee7wdzisdOl9zX:Q/UxvxjgC+o48dzisaFX
TLSH
T158729D3B54743E3395F3EA057D49478BDBF984B2A5C26EB84AAC5F0D06C72981342D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58cacd.TMP

Path C:\Users\Admin\AppData\Local\com.oxolemon.launcher\EBWebView\Local State~RFe58cacd.TMP
Size 1KB
SHA256 a2c9e9f158dedb61fc29c54d756c5e9f4dd4f4101e86d4b7d9b6521c160b7b2b
MD5 6ccfa04d9c82efc58606033a7a0e4603
SHA1 936b429ffc41795bcd3c8703d74d70d27b54f3a4
SHA512 7aed073890e266b120c16492cda87e0a0baff4a2ca138659bd9f1a09551a2ca0c4a813000cd05f177bc355c2c6de6849938db7b0b9fbaa97de633ba715ce2a9e
TLSH
T1DC3174B394905B36ACE363463581EF93AFA190AAA3510F4075DC4B2D01DA45C667FD3B
MD5 SHA1 SHA512 TLSH

Submit Download

007-first-light.json

Path C:\Users\Admin\AppData\Roaming\com.oxolemon.launcher\chats\007-first-light.json
Size 852B
SHA256 ccefe90d03c10edc2347c12f231bf77800b8edc9ec2b5414c5910d0191a4c79f
MD5 11745f0998cf0f2e67d24f038bf261dd
SHA1 2046ee92e2d9ab70f079a02fc87e2933dea8d6af
SHA512 2f5ae265e8a8134b1a9b66064714131efba55b65c0ee80a582e803669cf3fd9e5a4f2a5b7e167423df38fcb4d1461a87683afdf622e2977ec03f422e2a48dad9
TLSH
T1C8014404D0519C3B4659449AE9E96FC58298C9070F08B93E77541DAD1F4DF0F21F6B26
MD5 SHA1 SHA512 TLSH

Submit Download

among-us.json

Path C:\Users\Admin\AppData\Roaming\com.oxolemon.launcher\chats\among-us.json
Size 1KB
SHA256 514e296307697a0664794ea43fc64d06af226d68fa650eeff7a7a8167e8fc281
MD5 b09e70ea9b4c5c6b1a637fc689bd1358
SHA1 fc78f5b8cc8286b91e8ad6d74f0677026fb9fe71
SHA512 aa12ad8297055deab8085a8c11ff14b2836974dded2f2ae338ec050890b53b3ebf335d29b2ec27504b7fa0cbb004baaef3dcdfd5b86c8cd635af1fa7d01a171c
TLSH
T199215E41E4545C3B5659849AACEA6E819388C6030F0CB92E7B441D6D0F0CB0F15FBF67
MD5 SHA1 SHA512 TLSH

Submit Download

octopath-traveler-0.json

Path C:\Users\Admin\AppData\Roaming\com.oxolemon.launcher\chats\octopath-traveler-0.json
Size 3KB
SHA256 8f7e2c795b8b53f664cc9f13bacacb08703c0be9754a22003ae5a7e5842a140e
MD5 7365c7b911ed6f0e1ee35fa37707921e
SHA1 ea89bdcd85725460602f892999e68f9226d87378
SHA512 2669650b9ef234925b4a48b8653e3ac15cafda3157ec6b6557cb91fda08dbf9fac12f7d553a9188fca4218df84947b45969c3bb9e3c484ec428da414915a45c1
TLSH
T1DC618004D491AC3B1A45849AACE96F8142A8C6531F0CB92E7B151E9D0F4DF0F25FBF2B
MD5 SHA1 SHA512 TLSH

Submit Download

platform-state.json

Path C:\Users\Admin\AppData\Roaming\com.oxolemon.launcher\platform-state.json
Size 549B
SHA256 760f6b71f46bd3c62c470d31379c4100620f076f875a83df8c3df36b8ab9ac83
MD5 7ea0c9e0b7be2e81d96f210830abd543
SHA1 5c4d3497355ef1faee2b6082c702e61b6d2e669f
SHA512 5c391723cbe890da4cc2e975147dc29b3f8840088837904dc0f6ccbc43060cc076e4bc8837fdb3f60dbbbc763d995b534a08162172b08659343647e70a174b9b
TLSH
T1E0F02B7DD1108CBB29E0632E4C2D7643247585530C15B42C76E5075CAF1F62E52B6A97
MD5 SHA1 SHA512 TLSH

Submit Download

memory/296-112-0x00007FF982FD0000-0x00007FF982FD1000-memory.dmp

Download

memory/1456-629-0x000001CE2F930000-0x000001CE2F931000-memory.dmp

Download

memory/1456-618-0x000001CE2F930000-0x000001CE2F931000-memory.dmp

Download

memory/1456-620-0x000001CE2F930000-0x000001CE2F931000-memory.dmp

Download

memory/1456-628-0x000001CE2F930000-0x000001CE2F931000-memory.dmp

Download

memory/1456-627-0x000001CE2F930000-0x000001CE2F931000-memory.dmp

Download

memory/1456-626-0x000001CE2F930000-0x000001CE2F931000-memory.dmp

Download

memory/1456-625-0x000001CE2F930000-0x000001CE2F931000-memory.dmp

Download

memory/1456-624-0x000001CE2F930000-0x000001CE2F931000-memory.dmp

Download

memory/4836-566-0x00007FF983800000-0x00007FF983801000-memory.dmp

Download

memory/4836-565-0x00007FF9831A0000-0x00007FF9831A1000-memory.dmp

Download

memory/5112-552-0x00000276BCBD0000-0x00000276BCD93000-memory.dmp

Download

memory/5112-180-0x00000276BCBD0000-0x00000276BCD93000-memory.dmp

Download

memory/5112-19-0x00007FF982FD0000-0x00007FF982FD1000-memory.dmp

Download