Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 06:55
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
General
- Target 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
- Size 18.2MB
- Sample260729-hpsdeaxejf
- SHA256 37223a3e1f90376fc5d7af9040e7232d139a41700d583e4f53f02ebcb5deda13
- MD5 730ac850188990e1c45bd7f590dab9b1
- SHA1 382916bc4aad53298cbe733fcef7b2b4af513d51
- SHA512 98dc305aa025471deba152bd646fe0a66644454d562f229e933e6796cee60b2c09f723347bce52f82bd0c1785bf2184ca3ee6a4a1a485d9f49cfe58f01641009
- SSDEEP 196608:XBProFVOAPBFFLZJ99zBnFdaIjy0OwvJnsrohVixu:XRroFVOAPBFFLZJ999FdaIjXvmrohVYu
- TLSH T1D517F8257A5B996CD09BC474834B8A720A7130DB0B35B9FF449496383F6EBF42F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 14 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe - Drops file in Program Files directory 61 IoCs
description ioc Process File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-af.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-es.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-eu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-la.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-nn.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\manifest.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_2066445531\manifest.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-nb.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-nl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_1989670197\crl-set msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-as.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-fr.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-pa.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-sk.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-it.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-pt.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-uk.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_1989670197\manifest.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-da.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-hr.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-mr.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-tk.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-ta.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\_metadata\verified_contents.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-en-gb.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-hu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-ml.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_1989670197\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-de-1901.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-et.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_2066445531\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-bn.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-el.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-en-us.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-gl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-hy.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-sq.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-sv.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-be.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-hi.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-lt.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-te.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-ga.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-ka.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-cs.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-kn.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_2066445531\protocols.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-bg.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-cu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-cy.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-lv.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-de-1996.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-ru.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-sl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-gu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-or.hyb msedgewebview2.exe - Loads dropped DLL 1 IoCs
pid Process 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe - Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral1/files/0x00070000000244a9-227.dat embeds_openssl - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297817266013431" msedgewebview2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 412 msedgewebview2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1764 wrote to memory of 412 1764 2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 86 PID 412 wrote to memory of 3660 412 msedgewebview2.exe 87 PID 412 wrote to memory of 2956 412 msedgewebview2.exe 88 PID 412 wrote to memory of 2956 412 msedgewebview2.exe 88 PID 412 wrote to memory of 2956 412 msedgewebview2.exe 88 PID 412 wrote to memory of 4332 412 msedgewebview2.exe 89 PID 412 wrote to memory of 3952 412 msedgewebview2.exe 90 PID 412 wrote to memory of 3952 412 msedgewebview2.exe 90 PID 412 wrote to memory of 888 412 msedgewebview2.exe 91 PID 412 wrote to memory of 888 412 msedgewebview2.exe 91 PID 412 wrote to memory of 888 412 msedgewebview2.exe 91 PID 412 wrote to memory of 4228 412 msedgewebview2.exe 109 PID 412 wrote to memory of 4228 412 msedgewebview2.exe 109 PID 412 wrote to memory of 3808 412 msedgewebview2.exe 110 PID 412 wrote to memory of 3808 412 msedgewebview2.exe 110 PID 412 wrote to memory of 5016 412 msedgewebview2.exe 111 PID 412 wrote to memory of 4668 412 msedgewebview2.exe 112 PID 412 wrote to memory of 4668 412 msedgewebview2.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1764.2196.72724281146178791612⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffc0efab078,0x7ffc0efab084,0x7ffc0efab0903⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,5113684343113949884,4642735778592208581,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:23⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1376,i,5113684343113949884,4642735778592208581,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:33⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,5113684343113949884,4642735778592208581,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:83⤵PID:3952
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3592,i,5113684343113949884,4642735778592208581,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:13⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2132,i,5113684343113949884,4642735778592208581,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:83⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4472,i,5113684343113949884,4642735778592208581,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:83⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4560,i,5113684343113949884,4642735778592208581,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:83⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-07-29_730ac850188990e1c45bd7f590dab9b1_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1288,i,5113684343113949884,4642735778592208581,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:83⤵PID:4668
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_1989670197\manifest.json
- Size 113B
- SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
- MD5 7ef3c71464d0fef472bc1d81fd363c62
- SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
- SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
- TLSH T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_2066445531\manifest.fingerprint
- Size 66B
- SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
- MD5 06d2b48de0edcb3e022ed639f0fb0085
- SHA1 32f93d5a76998c407087269794026d1ea028828f
- SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
- TLSH T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_2066445531\manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-as.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-hi.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\hyph-nb.hyb
- Size 141KB
- SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
- MD5 677edd1a17d50f0bd11783f58725d0e7
- SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
- SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
- TLSH T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_489822111\manifest.json
- Size 82B
- SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
- MD5 2617c38bed67a4190fc499142b6f2867
- SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
- SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
- TLSH T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
- Size 206B
- SHA256 ec43eb065992cc178a817cdcf70cd403ecdab606c444cf29337d5216fdbd5859
- MD5 dea74c100a5dd5e14d6cfa3a4465a409
- SHA1 2d879a0fd568a47b4b6fd8a2103baa43f4654615
- SHA512 c94f8a6326875f5b3ead96c7794c02a44222a045aecf58555fd430e39848af37feb351907ec2eff541ea51ac5b8cfe42e75e407db2f3cc37d62d7b9d76696dbc
- TLSH T19CD0E95062BCE8A2511A73435F591ED096D1F54614844CFC378AC7067714D730EEF90B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
- Size 679B
- SHA256 fefe22d2a1c013c71b5f0c27ef14162fb4ac517f941807d14347b86dae163272
- MD5 0a6b95ac3582c849d403028171ce5eb7
- SHA1 cb271c5c51267e952e8d6e23cecf8e36f7a88866
- SHA512 0c332291716ffadc076f9cbc3c2843e2131267388baa3b1108e6a46dacc4aa12646ed5e0a42b5a26ccd57536a4dcb63a3e1ad86e0021009830fb8afdd09b3c4a
- TLSH T1E4016DC45CFADD6A084256519BAD0DD1C4F0F20D5A919EA12389B7443394CAF5FBB71C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
- Size 1KB
- SHA256 c079614f6590eeb928f0d818d5b186372569df4c8f4a5d8ac1bfad38f586dca8
- MD5 e5564360345e8a4d92249e1620edaad3
- SHA1 9fb8c948c798ca334e23cbe7c4b3e756611977bf
- SHA512 ec79ada0af2f15ee041d3c1c029674a4c2284377aa97d41131fcbd738083e9d69744b3df32b37efd0159739c928c096827e075b356390ab5907ceb73c6d34f2b
- TLSH T17331CF851CBADE2600905241CF5C0DE2C4E5F20F22904D65ABD0535867A1C9BAEBFB2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
- Size 3KB
- SHA256 e8e5e8c248bba02e93b21c8bfbd3291a2e83ff13c02930ffa3c17fc017ac9cc4
- MD5 71e9ebb14f4d5f05c2615670fb0eb3c2
- SHA1 ef20b97497f81b94c11d0924a9fd7ed351fbdebb
- SHA512 e7ff87a121261dd7e6ebd0cf7007a84f7bf3511ddacabb6615fca918588a9132d75aa164e4841a26830b71438a0258072c94139f49f6f17bd9aebbc66af40596
- TLSH T1D671328258FACC2604905302CB9C1EE5C4B1F60E66E15D20BBD453597791C9BAFBF72E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
- Size 4KB
- SHA256 013c418a591a8b29d3ed303711df2667d8a471f64deafa4bf71f27160496ac7f
- MD5 f2be8979a434b4b6d5b498d1c7d23ad0
- SHA1 12f6d060b10ed1d346cb6c705cf09341ffab990f
- SHA512 87cb322c64a179ee73b216644df24745b89ab65261979db062a2cd9e069f851bfb2675feb3db5f2064fb6647c231ed310e53d08b65cff13a3c988eb2c72fa3f2
- SSDEEP 96:o2MMC+bIL74BWKnxiyGW2hR7k+Rz4/WmF0+J8kZZkgqzpZfkn7NwEFPhRvI7qIh8:3MMCYOcBPnxiyGW2hR7k+RzmWmF0+J8o
- TLSH T1AE9130C618FADC2609908241CF9C1EE581A1F60E27E15D20BBD5135873A1C9B6FBF729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bin\dll\SolaraV3.dll
- Size 14.0MB
- SHA256 99cb9725498e62b5229d52a894fcb9751d6338f0b9b7b78f0a61de11b2a1260b
- MD5 7531ca5ca2235a04f39c220f4e1c2caa
- SHA1 fffd5801346a1a6e6553a76e950749c97fc7b882
- SHA512 1ce3917521b3672278fccd4120f8728592ee0efab5f2fafb80405a26fb8a7e1867040be5fb07836c15e51bc1287b9ab81713a654c1e425ec372a422f3eab8676
- SSDEEP 393216:ZXhFyiazD2dfohmB5VqAR51bQWD0nvkFE51:Zz8h4qT1
- TLSH T1C8E68DD630D9119CC42AC5BDC743EA3BCA6F74390328D6E707A496661E23ED5367AF02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
- Size 3KB
- SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
- MD5 5e2067a92dcfcb05537479c384a89725
- SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
- SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
- TLSH T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
- Size 22KB
- SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
- MD5 d01869348d5a783f61f90cbb27b82a78
- SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
- SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
- SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
- TLSH T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 1dd570bf0376aebaa34716b24d85f6c6be2a367e89b0016d0b057de7a85f46c7
- MD5 8a1b2be93e204c2458947054e8123324
- SHA1 db8c1d612184acb92a66f01ca877fd2b3b991c0b
- SHA512 ec19e77888ee8f21968905594500990c7c146831527051697c50d1d336401634742786a4aa9bb854cbdf2713dac179edfe983f6a42f4e84bfa0055c547fbac09
- TLSH T13AD0121236010235C0102A330112B1082908C50B4005C0019828CE9D6A5C0501A07481
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 32c271e444d8917f9a8de7127d698c85f58dca931fb93a9542eecc4ce0329d99
- MD5 249ac21911e07c8952ec76e311c97ed5
- SHA1 23ff4f39f0f3291b858dc0bb98142b49df24509b
- SHA512 8c41e04cdeae6464364cb43a3ff33f06a447e014284b8c3aded6be5db9e577aa6c7da6e28cd13fb730be4fca7b19950651eedcbc61fab4fa4809d61a41ed7879
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 288B
- SHA256 d1bf071436e1ab94e7ccebbbde7e4ed5464eda65362244169b8d3f8ba9349b58
- MD5 7d9f4a10aeabcec6384d0f17d31a1423
- SHA1 dcc4c054cc138752d83a9262c2bf2854e6a07a6f
- SHA512 1f5fd59130e832d2f5e3cbe7ab27f45cfaeefa6564a6363f7107ef6846112e37a616e7f5e5b08e1606996ff0d8e41ba8682b86a518969218b5e0152b53d09b2c
- TLSH T1CFD0A9308202E3C0CB41227282C066BF36B2C674E2870FE3388A1231608E7CD8C8E120
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58e8e4.TMP
- Size 48B
- SHA256 c41b7f6e57927a6b629d6e5211a0d714e460f56a993f06f26eeb504eac1499af
- MD5 fa7f0d6f90d983390f378d2af2b0acc7
- SHA1 37d0deebdc4bf7444706923604230ba18b2652fe
- SHA512 00f87810d8a8eeb67bc40f8d3920a01a0d4d904910e4c32ab80f75ed2a061cfbbc76b2977a0ea688542261821e72efe9540eb0c141ccb5b52450724cb11770c4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnGraphiteCache\index
- Size 256KB
- SHA256 d7853a0168ae14a74f0a6039968640e81dffa76c0bfc3662c942b3a7661ccfea
- MD5 d45948944eafad8785f1f9e650a594bb
- SHA1 c3c9580b10e45be89fdab44296806c0b66d90145
- SHA512 c3902fe03cf0bca1c2f3c8bde1069c88ea4f47b76b14fcbb536d5e48d0fbebc0a2eb053ea34a46c79ea2195dba7bb9eb80be69cbf65cdfb43522a8ec8abb70c3
- SSDEEP 3:LstlNllkll/l3+dZKX:LsX3lEtOdZK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\2a477672-0389-4105-96f5-beea175d4088.tmp
- Size 1KB
- SHA256 31ea489c91fc08e3ffc496853033095b7990c75a676fcf212eac00e553a70c9b
- MD5 0060d439b13ef1d32d7960b3f790ea6d
- SHA1 995a2cbb9ee889db6d66166f9610d4802ed8f4bb
- SHA512 27b421059156ecdc5174264d303306faf4cf951d35b5082b3f20c0fb5f1fac3ed1f2a1cc6fe97766138d84b08083716fa5a88485347c892d36f1162491fcdd2c
- TLSH T1B13181A6C7F4C67D854126E427307817CD2D0519A2287E27CDDBFBDA57D10B1E22160F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State~RFe596d95.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
- Size 6KB
- SHA256 4f33e1850d49fcba90cb7b7d63607482ae3a5b835148b3586c51875eb3ebe6e5
- MD5 a808d37a7593a789ef61a6fa213d5979
- SHA1 496bf27e323934efd1cac23ea664ca1738e0ae7e
- SHA512 75ce7a9fb188b9929f2b7a75e575ba8146c3e8d34b1121d89a42b2ce3915df53d0904135dcdcaab3bc14f9b8b787e882b043f970bff65855c0a9183c1f8d17f5
- SSDEEP 96:stc05l3ePXb9Boffq/Z8i0vhEJktbm/7qx+WVHMSm+uecJVy1ixgzQjl+gI+MEB:stc077fkZ8pawK/S+WiTVywxgz0G+M8
- TLSH T17CD1B7076E28A9B74CC7E6197A35FB53D2FA206162D50E58EBFC860C08D67CD630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
- Size 6KB
- SHA256 39d90a1a10b63245692bf2d2854c77b689dec23315ffda321d9b245b9fc5cd39
- MD5 d5a48e1db5517104020084590920f7a4
- SHA1 3d57341274899dc8053431cea121b89d46a4c187
- SHA512 a5e79568b8c54524944d655032512bcdf1fe281fceb3d9466a74be3368e4e1489ca44c737b1323864a1e1736454cddeef214a79bdf9252444c20b138517cc834
- SSDEEP 96:stc05l3ePXb9Poffq/Z8i0vhEJktbm/7qx+WVHMSm+uecJVy1ixgzQjl+gu+MOB:stc07BfkZ8pawK/S+WiTVywxgz0k+MC
- TLSH T1B1E197076E28ADB74CC7E6197A25BB53E2FA106166D50E58EBFC870C04D67CD630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences~RFe589cd7.TMP
- Size 6KB
- SHA256 9f320cf625c08e823340257700d7ba7d40a82f98774d19543c793228ed881d10
- MD5 1c580c5ebf776ff0b01a18306a747553
- SHA1 99333cf4d897725c0437fdd60b86789efe737fda
- SHA512 9c3c608012fd9a3f60773f3cb261b4ef6edf9fbd7a19536033b6ac94bb0da2374618e2956e48c41b766929f7a30288b14af8efeeeed25d2aeb35ae2a6af382ee
- SSDEEP 96:stc05l3ePXb9BoffuZ8i0vhEJklm/7qx+WVHMSm+uecadQjl+g9+MEB:stc077fmZ8paX/S+Wi8d0b+M8
- TLSH T12CD1A7035F28A9774CC7E6197A36BB42D2FA202166D50E98EBFC861C08D66DD231790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
- Size 2KB
- SHA256 2bef90175cb04d02d1fd421cdf5d26840bfbaea9281422e258c23a8563c7d891
- MD5 e70adb6296d2eac5feddb442bfd0e9ac
- SHA1 517086232435033b81e8618ee618ed77551a9151
- SHA512 bdc04f5040f84ba3469f6acce6f8dadb540c292df36e5148d39e985b06e9410084bfbb900e6d8c0a0cb8cb1e2fc306fae4c1e671e480c83139a4739c18db110c
- TLSH T1065195B3B818AB7789D25A44B94E3F135A775165CA612F94EAEE0B0C01DB6DC2313C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
- Size 3KB
- SHA256 67480a79fd91cc45e2bc4ef616c4bf38649ec074cc5954590c9a51200d66df26
- MD5 fb7fc61150e2981c6b40268c66441cf3
- SHA1 f71616a9f371da4ddf0fa23bb334c116616e96d9
- SHA512 36e1ca44932b89dd0bcfcf43295527e63c610fd6d68828fb62633279448c6a9cbd6e21e6119f45a1389cf0a5ad44bbe509b79dd6728259358b1400c01c04b80d
- TLSH T1D171A677A968AA774DE29A05B88A3F1777A64127D5A03F98DAED0F0C01DB3D81353C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
- Size 16KB
- SHA256 0b42e820670d824b38d3dccee514a513be2c596ee8e5253c0fae5f941c43abf8
- MD5 0465238b990538a2286e284296a67dc3
- SHA1 1d59c5c0e1818d6b5bd480d855a301ac8f96b652
- SHA512 fe3d0d65851b72c9146a882a41e633981eb4e34e5cd3d8f72c8bfa1cff0720b98437839612b8b137458038a08255fd1e9e15a56135eec10bb0833ba05e9d2ef5
- SSDEEP 384:zG+aQikB+z/xvxjg/qhEwNbASjOls9xyVO579zJ:9/UxvxjgC+wyls9xyVO57FJ
- TLSH T13F729E2B546D6E2395F3A6057A5D0B4BDBBA887290C16EB88EFD1F0906CB3D81343D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
- Size 1KB
- SHA256 5fa66ea48566b7561248ea9f78903063d5622b5525054dd0e5892cef1211a5c7
- MD5 6cb3653cb107aca2cd54e879af447da3
- SHA1 f52bfb6878f4b7309d72436649224611e0815b7a
- SHA512 e4b5d22a00f3bc1b4189269dbc8b7b1d73120ac6f70105109dc17428cbb65c34fc4bcbcba8c5bba9f28dbd6291b8f583f77eab2fbbe5674b331cc8649ee91705
- TLSH T1943177B3E4546F765C826646B58B7B572F625026C2205F88F2EE870C02E76DC936BC33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe5845ce.TMP
- Size 1KB
- SHA256 935aef7c1250228dd154ea76d1e138761702d2a833e20060a7ef3b3cbc978397
- MD5 6f095ec4afcd97d02eff5fb62fa08661
- SHA1 7e60815d27489b30dc881e69633996e7bb4eaf01
- SHA512 42933fc3418d7f1798e0524dd7a4e2b7473e412a3878e2d90d108d93178e6910281f63402e41599894f59c7ff2874ffa0d5af5d59469acd0ece6f323fddc6071
- TLSH T17D2184B3D4986F76A9815556B58BBB872EA14026C2205F4CF2EE830902DB6DC8367C33
- MD5 SHA1 SHA512 TLSH