080a291a5f6028d327ffee5f628a316ff2a42471cfbaec0f832d6c53b52cf2cd

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 12.1MB
Sample260724-a48pyaej9z
SHA256 080a291a5f6028d327ffee5f628a316ff2a42471cfbaec0f832d6c53b52cf2cd
MD5 b8cca568f180c59ffc1f2ee602acfc23
SHA1 87c46c3a119898929e37ebeacb144f2d24f8e1b9
SHA512 1600bc13549c08bb5b0f034c17fa1823f009698c87b7a07224270865f5bd700a33cbfc6f77b1ad9ba323e9a4fdeb14eb98e32aeed43405eebf1c29433be98b36
SSDEEP 196608:5KeHa89e/Jrbg/zPFKceB7AJnGxIvfJh:BHa89e/Jrbg/zsBo
TLSH
T137D6F7216B5B996CD09BC474834A8B62097130DB0B35B9FF449496383F6EBF52F38369
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 50 IoCs

discovery

Process Discovery

T1057

pid	Process
1012	tasklist.exe
3316	tasklist.exe
688	tasklist.exe
4276	tasklist.exe
4756	tasklist.exe
3540	tasklist.exe
2248	tasklist.exe
2144	tasklist.exe
2968	tasklist.exe
1776	tasklist.exe
200	tasklist.exe
3232	tasklist.exe
1688	tasklist.exe
4280	tasklist.exe
3004	tasklist.exe
4416	tasklist.exe
3848	tasklist.exe
2096	tasklist.exe
2500	tasklist.exe
5916	tasklist.exe
3296	tasklist.exe
2532	tasklist.exe
5140	tasklist.exe
3296	tasklist.exe
4192	tasklist.exe
3084	tasklist.exe
1852	tasklist.exe
2348	tasklist.exe
5432	tasklist.exe
1992	tasklist.exe
3428	tasklist.exe
3832	tasklist.exe
4536	tasklist.exe
5192	tasklist.exe
3000	tasklist.exe
1616	tasklist.exe
880	tasklist.exe
5432	tasklist.exe
6024	tasklist.exe
6036	tasklist.exe
1792	tasklist.exe
3540	tasklist.exe
2984	tasklist.exe
5376	tasklist.exe
5384	tasklist.exe
3184	tasklist.exe
2388	tasklist.exe
3964	tasklist.exe
4708	tasklist.exe
5736	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2372	msedgewebview2.exe
2372	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4684	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	tasklist.exe
Token: SeDebugPrivilege	3232	tasklist.exe
Token: SeDebugPrivilege	5384	tasklist.exe
Token: SeDebugPrivilege	1688	tasklist.exe
Token: SeDebugPrivilege	3316	tasklist.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeDebugPrivilege	4192	tasklist.exe
Token: SeDebugPrivilege	4280	tasklist.exe
Token: SeDebugPrivilege	688	tasklist.exe
Token: SeDebugPrivilege	5192	tasklist.exe
Token: SeDebugPrivilege	3004	tasklist.exe
Token: SeDebugPrivilege	1776	tasklist.exe
Token: SeDebugPrivilege	4416	tasklist.exe
Token: SeDebugPrivilege	5916	tasklist.exe
Token: SeDebugPrivilege	3848	tasklist.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	3084	tasklist.exe
Token: SeDebugPrivilege	4756	tasklist.exe
Token: SeDebugPrivilege	1852	tasklist.exe
Token: SeDebugPrivilege	2348	tasklist.exe
Token: SeDebugPrivilege	3540	tasklist.exe
Token: SeDebugPrivilege	2248	tasklist.exe
Token: SeDebugPrivilege	3296	tasklist.exe
Token: SeDebugPrivilege	3000	tasklist.exe
Token: SeDebugPrivilege	2096	tasklist.exe
Token: SeDebugPrivilege	5432	tasklist.exe
Token: SeDebugPrivilege	1012	tasklist.exe
Token: SeDebugPrivilege	3184	tasklist.exe
Token: SeDebugPrivilege	1992	tasklist.exe
Token: SeDebugPrivilege	1792	tasklist.exe
Token: SeDebugPrivilege	1616	tasklist.exe
Token: SeDebugPrivilege	3428	tasklist.exe
Token: SeDebugPrivilege	2388	tasklist.exe
Token: SeDebugPrivilege	2500	tasklist.exe
Token: SeDebugPrivilege	3832	tasklist.exe
Token: SeDebugPrivilege	2532	tasklist.exe
Token: SeDebugPrivilege	5140	tasklist.exe
Token: SeDebugPrivilege	3540	tasklist.exe
Token: SeDebugPrivilege	880	tasklist.exe
Token: SeDebugPrivilege	3296	tasklist.exe
Token: SeDebugPrivilege	3964	tasklist.exe
Token: SeDebugPrivilege	5432	tasklist.exe
Token: SeDebugPrivilege	2984	tasklist.exe
Token: SeDebugPrivilege	5376	tasklist.exe
Token: SeDebugPrivilege	6024	tasklist.exe
Token: SeDebugPrivilege	2144	tasklist.exe
Token: SeDebugPrivilege	6036	tasklist.exe
Token: SeDebugPrivilege	4708	tasklist.exe
Token: SeDebugPrivilege	5736	tasklist.exe
Token: SeDebugPrivilege	200	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 4684	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 4684 wrote to memory of 4888	4684	msedgewebview2.exe	90
PID 4684 wrote to memory of 3596	4684	msedgewebview2.exe	91
PID 4684 wrote to memory of 3596	4684	msedgewebview2.exe	91
PID 4684 wrote to memory of 3596	4684	msedgewebview2.exe	91
PID 4684 wrote to memory of 3596	4684	msedgewebview2.exe	91
PID 4684 wrote to memory of 2680	4684	msedgewebview2.exe	92
PID 4684 wrote to memory of 3724	4684	msedgewebview2.exe	93
PID 4684 wrote to memory of 3724	4684	msedgewebview2.exe	93
PID 4684 wrote to memory of 3724	4684	msedgewebview2.exe	93
PID 4684 wrote to memory of 5340	4684	msedgewebview2.exe	94
PID 4684 wrote to memory of 5340	4684	msedgewebview2.exe	94
PID 4684 wrote to memory of 5340	4684	msedgewebview2.exe	94
PID 4684 wrote to memory of 5340	4684	msedgewebview2.exe	94
PID 4684 wrote to memory of 5340	4684	msedgewebview2.exe	94
PID 5972 wrote to memory of 4536	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	95
PID 5972 wrote to memory of 3232	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	98
PID 5972 wrote to memory of 5384	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	100
PID 5972 wrote to memory of 1688	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	102
PID 5972 wrote to memory of 3316	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	104
PID 5972 wrote to memory of 2968	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	106
PID 5972 wrote to memory of 4192	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	108
PID 5972 wrote to memory of 4280	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	110
PID 5972 wrote to memory of 688	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	112
PID 5972 wrote to memory of 5192	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	114
PID 5972 wrote to memory of 3004	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	117
PID 5972 wrote to memory of 1776	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	119
PID 5972 wrote to memory of 4416	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	121
PID 5972 wrote to memory of 5916	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	123
PID 5972 wrote to memory of 3848	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	125
PID 5972 wrote to memory of 4276	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	127
PID 5972 wrote to memory of 3084	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	129
PID 5972 wrote to memory of 4756	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	131
PID 5972 wrote to memory of 1852	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	133
PID 5972 wrote to memory of 2348	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	135
PID 5972 wrote to memory of 3540	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	139
PID 5972 wrote to memory of 2248	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	141
PID 5972 wrote to memory of 3296	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	143
PID 5972 wrote to memory of 3000	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	145
PID 5972 wrote to memory of 2096	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	147
PID 5972 wrote to memory of 5432	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	149
PID 5972 wrote to memory of 1012	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	151
PID 5972 wrote to memory of 3184	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	153
PID 5972 wrote to memory of 1992	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	155
PID 5972 wrote to memory of 1792	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	157
PID 5972 wrote to memory of 1616	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	159
PID 5972 wrote to memory of 3428	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	161
PID 5972 wrote to memory of 2388	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	163
PID 5972 wrote to memory of 2500	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	165
PID 5972 wrote to memory of 3832	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	167
PID 5972 wrote to memory of 2532	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	169
PID 5972 wrote to memory of 5140	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	171
PID 5972 wrote to memory of 3540	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	173
PID 5972 wrote to memory of 880	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	175
PID 5972 wrote to memory of 3296	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	177
PID 4684 wrote to memory of 2372	4684	msedgewebview2.exe	179
PID 5972 wrote to memory of 3964	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	180
PID 5972 wrote to memory of 5432	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	182
PID 5972 wrote to memory of 2984	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	184
PID 5972 wrote to memory of 5376	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	186
PID 5972 wrote to memory of 6024	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	188
PID 5972 wrote to memory of 2144	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	190
PID 5972 wrote to memory of 6036	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	192
PID 5972 wrote to memory of 4708	5972	2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5972.4788.6687679432705619579 /pfhostedapp:fc3e74ab794765e7693635996901300d9a164469
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView /prefetch:4 /pfhostedapp:fc3e74ab794765e7693635996901300d9a164469 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff964d05fd8,0x7ff964d05fe4,0x7ff964d05ff0
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView" --webview-exe-name=2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,12254740890159848339,1399356031341487216,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:fc3e74ab794765e7693635996901300d9a164469
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView" --webview-exe-name=2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2164 --field-trial-handle=1788,i,12254740890159848339,1399356031341487216,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:fc3e74ab794765e7693635996901300d9a164469
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView" --webview-exe-name=2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1788,i,12254740890159848339,1399356031341487216,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fc3e74ab794765e7693635996901300d9a164469
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView" --webview-exe-name=2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=1788,i,12254740890159848339,1399356031341487216,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:fc3e74ab794765e7693635996901300d9a164469 /prefetch:1
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView" --webview-exe-name=2026-07-24_b8cca568f180c59ffc1f2ee602acfc23_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4320 --field-trial-handle=1788,i,12254740890159848339,1399356031341487216,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:fc3e74ab794765e7693635996901300d9a164469
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2372
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4536
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3232
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5384
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5192
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4416
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5916
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3084
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3540
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1012
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3184
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5140
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3540
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5376
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6024
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5736
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6af9e3c37976bf18fc1a0b28d96dacbd1d33e83442c3dede2390adc7e78c6158
MD5 83f91c149393d5e39088f79d9ec6f500
SHA1 fcadd6d466107d3c5d7284ee477f325f6771dc8f
SHA512 57ac8ed8bcbcb42bf2df9fc57f053fe0b0c87bab04ba9346c64c533a0088521da5258ff0727bfccc507efebae06e2857efc04760624e4c4a47bb9e47ac3637b0
TLSH
T162D0112233228238C02038332082A2880A00E23F800A8008E8288ABEAB288A00A03883
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 559d656c4f6dabc5139154e9b70d4ccd45c81795934928d25a4a8542ee2562b2
MD5 dbedc879052b259398e0048f676ab02e
SHA1 17d4ce64620abaff0c373058c83a94538c5cfed2
SHA512 e16c2e70dd8e71d335d8e03ab9b59a783ffda2a67de0606c561b8b140d419eedade381ef0c1307d37304ab8edff4789f6190dd9f55e9b39dceb99d3ee1b6e200
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8818d213-33d4-4cc3-9037-16feaa0c0fb3.tmp

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Default\8818d213-33d4-4cc3-9037-16feaa0c0fb3.tmp
Size 6KB
SHA256 7707ee328410b9235693851b70061c28818b7b81c6fd9fac6c4500c18fe024c9
MD5 0ccdb36174ddac8d0848b1ee285f25b5
SHA1 df0f4f8fed412e03dd3469af240693e7105fe864
SHA512 1f35362698d69d475256d8788afd4dfebc7196d756709c492910d02bf6e1d52df788bd3cd4d02796a08cdc279bff293231c81fadb49b97d4aa60435eaac44717
SSDEEP 96:st3U/daksxib9GJk9o5h16Z0ms7/x+6MhmuecJZG1ejebK+gfuqXD+28XM1C7K:st3Y3gWonmsV+FdZGQjddn+G6K
TLSH
T152D1A6065E28697B4CCAE119BA35FA13E2F9707271D51D58EBFC4A1C04DA6CD630BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 77e26c87d4850403d1d42a6a2f6ca1433833398c05e8a98775f7331504f7d9cb
MD5 93a067b139bf9ccf26ee17df113ea158
SHA1 830be9ab845d443596dcb8ba7744ed9e9261de20
SHA512 22ce7bf74a9463a29fff1544196eacf9b02b9d4e7db2a43f82e1f71fc266edc7fe152ba22720aa15c392badb35f353361f6b670af6488791e6a0db55fd6a2b46
TLSH
T16BA0023065846113C20483F022C111D2763A4B6052C70B6651D8586E8A503904181046
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59718c.TMP

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59718c.TMP
Size 48B
SHA256 4a2ebd0fdf0638e65efac22873aa2a402284e116da636711ff9677cacc8ca57f
MD5 5d1a0991ec20d7f239915572c0cb4352
SHA1 1a7a02135e4c1a2af7773401265c44d693e149a0
SHA512 46dd9aa2979bdc437b1d33ca609fc0866fba613a0cd54cba67fa23646617777883add629feeb187166312f7ba2c931af60672b0f3b81178fa95e8c5264642171
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a476a.TMP

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a476a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 28ea6e34038df15265c0ea7c7c48cd302971165a8e29bb71262c49aa1325da39
MD5 263f3a50096c4dca87b64b0b06628858
SHA1 4a2d5b397b149de8813e4b85b43ecd92f94cc7bd
SHA512 a12db284db1ffbf1b51a53bc9d75143ab54d575bfa58b8b4f6c2f1a0274f2266aaa38231b1588fbc95eb488eaa981d5cf36edfeaf17efc3455852206d85ca0fa
SSDEEP 96:st3U/daks4Gib9GJk9o5h16Z0ms7/x+6MhmuecJZG1ejebK+gfuqce+28XM1C7K:st3Y3iWonmsV+FdZGQjddL+G6K
TLSH
T11BD1B7065E28697B8CCBE119BA35BB13E2F9707271D11D58EBFC4A1C04DAACD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Local State
Size 2KB
SHA256 9e4c806b0bb3bfd8c327f13e0a799310539663b4c1fa233b7e2f2df89413286c
MD5 687d954cd7f96af7507c3555e263a28a
SHA1 d5d2ac75744697d05eb22d3330e683a7e2089a1d
SHA512 87728c17a8c81c29274d847aa1959f84cc78168faed5d9561f128964f22e9d7a7a68d827693bce45c983ae595112d32acbf1ce17284841603cac3ad2abe11fc2
TLSH
T1515185336D10977786E78604788ABE129E7660E9EA522F509ADC0F0C01DB84E271BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Local State
Size 3KB
SHA256 2abbc790337d351520b3ee1982d39352c5409f42a1ff012964fbd9e6533516ec
MD5 d845abff52b6176bd257dda90839d1cd
SHA1 025977b60861d936d0038b475a7138ecf5caf6be
SHA512 b50ec9f6cbfebd34a57d1964e64ba038cf7d3f5aa365a4dd14e97d0bf4ec768a661f3718209dd949a3c4233e2eb2110b694de2ecd2e3f2e3d0b687b981041a41
TLSH
T12371963B696099778EE38A047C867B06ABA1506BE5923F94DAEC0F0C01D768D1357C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Local State
Size 3KB
SHA256 67ce85493aa4a15b88902e61491f2a02d03c98b0dd49c8408aac6889e84fb965
MD5 d45e1f673d19aec4e62d14bc7e7f180b
SHA1 6987815fd93e6641cebf7b9c195e40259aec9716
SHA512 2d632eb313db1b6eeaa6daaa4d33e03013a061f3a3e217b02c665ac1907b4fa98955b73fb6f91bc945286663ec5f3d88960e58431654386c3dd932909be5e4df
TLSH
T14681963B996099774DE39A047C863B02ABA560ABE5D23F95D6EC0F0C01DB2892357817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Local State
Size 14KB
SHA256 21f60c11bb2bb611e2cd58636eca9ae46880405668eda498aa812627e66e1668
MD5 829ed08a5f91022c879c10f474c1a6fc
SHA1 862bcb6fa888043a1465f4c77902e477ad4a41e4
SHA512 6354634b46f03eafddd1cee2802c8e7e7347b5229db3552458abea5503f29f4a6a36ed0d5dde37155da4e72a7584d83dcb6fccf1b244dd8d3875f044b0806009
SSDEEP 384:y+aQikB+z/xvxjg/qhE0NBSsAkCdVYF9z/:d/UxvxjgC+VAFF/
TLSH
T190629E2B55686D3396F3EA043D495B8BDBB998B291C27EB84AFC1F0C06C76981347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe592050.TMP

Path C:\Users\Admin\AppData\Local\com.projectls.launcher\EBWebView\Local State~RFe592050.TMP
Size 1KB
SHA256 76d93819a68836c909e2ac8882b4e1466354f49ae7a978953c4df7ec0c32641f
MD5 f7adfc162b0d082f5aa3675d3669baba
SHA1 1731297e3c16853c7b7d63b2728a6b35b4d9b77d
SHA512 46e6922ad2a73cf49217a459a07ed44416f55b4b91bab0bef60e2362f17676dea52b4168b56ddd3574ecb44aab47316bdc7df5a0cc5d2a51c45361a59438f57e
TLSH
T1B83154B799608B729D8796453485BE575E3120AED2424F4466EC0F0C12EA48E6B2FC36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2372-271-0x000001D0AF390000-0x000001D0AF391000-memory.dmp

Download

memory/2372-269-0x000001D0AF390000-0x000001D0AF391000-memory.dmp

Download

memory/2372-279-0x000001D0AF390000-0x000001D0AF391000-memory.dmp

Download

memory/2372-278-0x000001D0AF390000-0x000001D0AF391000-memory.dmp

Download

memory/2372-277-0x000001D0AF390000-0x000001D0AF391000-memory.dmp

Download

memory/2372-276-0x000001D0AF390000-0x000001D0AF391000-memory.dmp

Download

memory/2372-275-0x000001D0AF390000-0x000001D0AF391000-memory.dmp

Download

memory/2372-280-0x000001D0AF390000-0x000001D0AF391000-memory.dmp

Download

memory/3596-193-0x0000015E58F00000-0x0000015E58FD3000-memory.dmp

Download

memory/3596-26-0x00007FF986310000-0x00007FF986311000-memory.dmp

Download

memory/5340-101-0x00007FF986310000-0x00007FF986311000-memory.dmp

Download