b21648dae8d9d9aab707ed2c6eab076d56bb6b6bdd61c1024214008a9ae9eaea

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 23.9MB
Sample260730-ac6fhaha48
SHA256 b21648dae8d9d9aab707ed2c6eab076d56bb6b6bdd61c1024214008a9ae9eaea
MD5 6e9ae904879b0bd668f0b5047db7b424
SHA1 c2e8a18aefb616312d7b11297aeea86cb504550f
SHA512 3c332d0e8574e0345b0db4a43fb2e22c5497c7cd99ce9314fbb1b70bb1b1dda922e5aa5082066efa4a5bf6df9d4d5bd67f7e3bdc8182cdc95162a8ccba52637a
SSDEEP 393216:ikhCFaLeCv6xT2tv0w1RaFQMgsd0Cg8ZQQWUWv6Asv8f5RIzn:ikhlLeetMw1Raaz0Q7UWyrv8f5RIzn
TLSH
T15447DF03F26290F8C16AC075925A6632FB727C4947357AEB5BE08B213E66FD0673DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_493657883\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_704019165\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1043860622\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1043860622\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_493657883\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_704019165\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_704019165\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_493657883\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_704019165\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_704019165\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1115586461\model.markov	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4664	msedgewebview2.exe
4664	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1348	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1348	2820	2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 1348 wrote to memory of 3156	1348	msedgewebview2.exe	90
PID 1348 wrote to memory of 908	1348	msedgewebview2.exe	91
PID 1348 wrote to memory of 908	1348	msedgewebview2.exe	91
PID 1348 wrote to memory of 908	1348	msedgewebview2.exe	91
PID 1348 wrote to memory of 908	1348	msedgewebview2.exe	91
PID 1348 wrote to memory of 3896	1348	msedgewebview2.exe	92
PID 1348 wrote to memory of 5988	1348	msedgewebview2.exe	93
PID 1348 wrote to memory of 5988	1348	msedgewebview2.exe	93
PID 1348 wrote to memory of 5988	1348	msedgewebview2.exe	93
PID 1348 wrote to memory of 1956	1348	msedgewebview2.exe	94
PID 1348 wrote to memory of 1956	1348	msedgewebview2.exe	94
PID 1348 wrote to memory of 1956	1348	msedgewebview2.exe	94
PID 1348 wrote to memory of 1956	1348	msedgewebview2.exe	94
PID 1348 wrote to memory of 1956	1348	msedgewebview2.exe	94
PID 1348 wrote to memory of 4480	1348	msedgewebview2.exe	98
PID 1348 wrote to memory of 4480	1348	msedgewebview2.exe	98
PID 1348 wrote to memory of 4480	1348	msedgewebview2.exe	98
PID 1348 wrote to memory of 3320	1348	msedgewebview2.exe	99
PID 1348 wrote to memory of 3320	1348	msedgewebview2.exe	99
PID 1348 wrote to memory of 3320	1348	msedgewebview2.exe	99
PID 1348 wrote to memory of 2700	1348	msedgewebview2.exe	100
PID 1348 wrote to memory of 2700	1348	msedgewebview2.exe	100
PID 1348 wrote to memory of 2700	1348	msedgewebview2.exe	100
PID 1348 wrote to memory of 4664	1348	msedgewebview2.exe	101
PID 1348 wrote to memory of 1068	1348	msedgewebview2.exe	102
PID 1348 wrote to memory of 1068	1348	msedgewebview2.exe	102
PID 1348 wrote to memory of 1068	1348	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2820.5832.2346399864220280316 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView /prefetch:4 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x50,0x7ffbe0e65fd8,0x7ffbe0e65fe4,0x7ffbe0e65ff0
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1844 --field-trial-handle=1848,i,1719296430118492466,5826916883415108127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2080 --field-trial-handle=1848,i,1719296430118492466,5826916883415108127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1848,i,1719296430118492466,5826916883415108127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3364 --field-trial-handle=1848,i,1719296430118492466,5826916883415108127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=1848,i,1719296430118492466,5826916883415108127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1848,i,1719296430118492466,5826916883415108127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4508 --field-trial-handle=1848,i,1719296430118492466,5826916883415108127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4584 --field-trial-handle=1848,i,1719296430118492466,5826916883415108127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4664
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView" --webview-exe-name=2026-07-29_6e9ae904879b0bd668f0b5047db7b424_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=1.2.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4584 --field-trial-handle=1848,i,1719296430118492466,5826916883415108127,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:27b018e0dd51edd84b99528c05f91ad7dd955531
    3⤵
    PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b0540724167f333b0d190b2d6239e3ad6cb5030822e6e6236ffea8d0acb95d27
MD5 b9a63448828b7d5db54f88681efbbbd0
SHA1 b6a6a29f7b9ca057080c872978f564379786046e
SHA512 93a90cde9a77fdde2a2f0c4d65e65d2685931742135fd8ba05201900d7678bec3ac44da6c8814e30f22acd7d42e6e085a93cdf420220b1562daecabd2ebe8adf
TLSH
T16CD0121333025574C41035B3450271080402D50F4147834158299E1D1E245902926542
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c327f4325df2fa41afaaf5cf3f2600cd23aa9cf4c91b0400a976095326be89a7
MD5 0d83ee809d535dbbb28237266f200cf9
SHA1 2164bb7341638f58f4981a9a11332a2262b5d215
SHA512 2fc7e2692da9b75b83c58134450311c8091b8512c43d14a8d9a5b4e50dbcd21fc0a88d9235f2cae5760cb6ec135a3d74402dcd7912ddff37d37737224c0e2750
TLSH
T1CAD0041373057451D40035F5C514510001035C0C0153474104111D0C0C707403035301
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 a193b4ddc86062ad3a9ecbafc496630fa74146cd55a51a619e4a638ae3eb8657
MD5 8fa5763e63c39c158be1880c952881cd
SHA1 028e03fd2796c54b8b9ed207f4f35cd50647b54e
SHA512 64fcdd1af01a1e6389efe2fd9b0a75dd6f34c2bc3b7e4d7fff4d70c57d84c69a3b4cdc9aa54bf9c433739f02f16c9349682afc882e7323dd2ef2dbd2a74ab650
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 948fa361dfc36a7c45b002c4c5e3e6afcef3b936d142cabab37d07af48119441
MD5 00b5e193c312ec4847695d577075f96a
SHA1 8c246d649268b1c52f53403de48a11f9099d2863
SHA512 5f3694a33a27ed0b7a9fbe535b3d82ac14531250b4aa99df0a6be2c844a910de057c0b8e1507e61b7b12047bfc559497ea04a303dbbd903858aec406158b61d9
TLSH
T133F09A1298BDB81AF3CC563A34C548C470B7620D44870CE2DCAC01F460833078B11EEE
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 91e8d5905efc2bafcfbc5ccb92e5d85ff8e0bf073478fdbf494f4cf8f80ce4f3
MD5 50524d661236598ac327ad98f537fff5
SHA1 9e0955bc706ee482404166e44e37311efc6f10cb
SHA512 b88403e33e05fea4f13f3fce305be6cb3b39c7e6e6c4746f18c91160ddba8528af5711c87837ffd30b99093f8ab555154568c7994b7b82d5d8cea99e4edc684f
TLSH
T1C4217293C3E8C66D8A4167E467343927CD2E051992243D2BCDEAEFD95BD2072D21164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa087.TMP

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Default\Network\Network Persistent State~RFe5aa087.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Default\Preferences
Size 6KB
SHA256 c23be44c6f4a8d96a4dd1a225e0cff56d46e0a4b7effd044dcdc53a2cfcd0ab6
MD5 a264a71ed73d41a12f3f9bd1ea0c5555
SHA1 511ae767bfca6de787d1c0dd7caa05c9a01d623d
SHA512 08581ec165be60cdb3762e9253af97e9448f16bb5cbb60523a73762a5781f328ebcee622f598cf85bbf9c5a5529e87949f7f5ce0dcf33cfd3be42e5fd57ccf41
SSDEEP 96:stxt/dyjMGLb9ck7o5h16Z0Cs7/x+6MhmuecJIH1ejeEK+gVdfG+28XM1C7K:stHMOkonCsV+FdIHQjoLNG+G6K
TLSH
T144D1B6465E28B9BB4CC7E108BB297B07E2F5603265D12E58E7F8461C08DB6DD6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd02122b-a7b1-4d77-8f72-93520fb530a6.tmp

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Default\cd02122b-a7b1-4d77-8f72-93520fb530a6.tmp
Size 6KB
SHA256 79d803b5800ee1d33aaac98598eaecb097c861750ab33b794d926ced34e0f5a6
MD5 92a31edd6397855c52626f0fb775213d
SHA1 e32acb0411894c56edf16094df8f3db1cee8b279
SHA512 b112a271e3a496332734ff103a930ad5741cdc69591a1ffc0004ddff78b491073edc07fd56317d768adfeb33ec41aaae68e9abc7963bf96716a989e65f577d6f
SSDEEP 96:stxt/dyjFLb9ck7o5h16Z0Cs7/x+6MhmuecJIH1ejeEK+gVd7b+28XM1C7K:stHMgkonCsV+FdIHQjoLtb+G6K
TLSH
T1CCD1A6465E28B9BB4CC7E109BB397B07E2F5A03265D12E58E7F8461C08DA6DD6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Local State
Size 2KB
SHA256 bde9022878a87617a0609b75e6a9bf2e1a75a09d8f3becda25707604e1fdc719
MD5 4820cfaed96efa30c40f1a834b639d18
SHA1 f0a6ec0cc08f9e71442ed06419951ed8fb669c17
SHA512 ee8c873259086d93437c0315613ae7076c69ac0ba11bd522b371156398c8b3008db87080b68f6beea478d950c267b6871320d07b4a6ca8c6895ddb2fff877abe
TLSH
T1745194736D28A73789E286047D8A3F275E799062EB526F50EAED4B1C01C729E1347C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Local State
Size 3KB
SHA256 8b7a37bb69261bf232bee95f8593977fb230336bd24330ebc901b52659e5c392
MD5 2520010ff1fe0fd4065c1ff78da8dc31
SHA1 d1b9f73e8067c409acaefc201d475a20844b2e25
SHA512 f32808ed2d6f665872203f2fda5db60508cac9dca1e7d1105c677e7e0dfb100dac99cb16350d31ca63ebfeab3a2a92bdaf4342f3b18743aa18af2bb3ccf63143
TLSH
T14861857B6974A6378DE29A05B9863B167BA59033EA917FA4D6EC0F0C01C738D1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Local State
Size 15KB
SHA256 529cf0d8e98a4e8a0ea717e0e09be6c6fdb189f1865a063394fe0f8177384b7d
MD5 22b279bf33db3511784d3bcbf63b68dc
SHA1 ce0650852451c687074ccf2d4bd1b6f9aa10685a
SHA512 b6933e8c9956838676bb5e5bf428c3cd56377047b32d3a19746a73d9cc33d34c622b97983344496360f23d4ca260dad7d0d2f9d138e77c01b2853c1e87a7401a
SSDEEP 384:n+aQikB+z/xvxjg/qhEwNBSIRGLDLisd+o9zz:2/UxvxjgC+QEvLisQoFz
TLSH
T1B7729E2B55383D2395F6EA057949179B9BB984739582BEB48AED5F0D0AC32D90342C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe598bac.TMP

Path C:\Users\Admin\AppData\Local\com.dagthomas.graphgen\EBWebView\Local State~RFe598bac.TMP
Size 1KB
SHA256 b82b212cd2432a968124f688c5263c660028eaeb01e22d192e954774625920d0
MD5 1b4e9317784a8b801894ec22f482d287
SHA1 1096b94e4682058e2ab40757ba38a38bd6ce8e18
SHA512 20ea30caf1a0c646385c7df42c0feb0c4ad53a6338ad49c33ac06af64a6f0b82033749172ba2dc8895ac46e1e98a368814b7130919976ebf8f8585b997b6db8a
TLSH
T18C211DB3A9784733AD95664676863FAB2E719073C3019F40A2DD8B1906D718E926BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/908-198-0x000002C852940000-0x000002C852942000-memory.dmp

Download

memory/908-232-0x000002C852BB0000-0x000002C852BB2000-memory.dmp

Download

memory/908-204-0x000002C8529A0000-0x000002C8529A1000-memory.dmp

Download

memory/908-203-0x000002C852AB0000-0x000002C852AB2000-memory.dmp

Download

memory/908-202-0x000002C8529A0000-0x000002C8529A1000-memory.dmp

Download

memory/908-201-0x000002C852920000-0x000002C852924000-memory.dmp

Download

memory/908-200-0x000002C8529A0000-0x000002C8529A2000-memory.dmp

Download

memory/908-207-0x000002C852B30000-0x000002C852B33000-memory.dmp

Download

memory/908-196-0x000002C852930000-0x000002C852932000-memory.dmp

Download

memory/908-213-0x000002C852AC0000-0x000002C852AC6000-memory.dmp

Download

memory/908-212-0x000002C852B30000-0x000002C852B33000-memory.dmp

Download

memory/908-215-0x000002C852B40000-0x000002C852B42000-memory.dmp

Download

memory/908-214-0x000002C852B30000-0x000002C852B31000-memory.dmp

Download

memory/908-218-0x000002C852B30000-0x000002C852B34000-memory.dmp

Download

memory/908-217-0x000002C852B50000-0x000002C852B52000-memory.dmp

Download

memory/908-219-0x000002C852B50000-0x000002C852B51000-memory.dmp

Download

memory/908-225-0x000002C852B50000-0x000002C852B55000-memory.dmp

Download

memory/908-224-0x000002C852B80000-0x000002C852B83000-memory.dmp

Download

memory/908-220-0x000002C852B60000-0x000002C852B62000-memory.dmp

Download

memory/908-222-0x000002C852B70000-0x000002C852B72000-memory.dmp

Download

memory/908-228-0x000002C852B80000-0x000002C852B85000-memory.dmp

Download

memory/908-227-0x000002C852B90000-0x000002C852B93000-memory.dmp

Download

memory/908-235-0x000002C852BC0000-0x000002C852BC2000-memory.dmp

Download

memory/908-234-0x000002C852BB0000-0x000002C852BB1000-memory.dmp

Download

memory/908-233-0x000002C852B90000-0x000002C852B94000-memory.dmp

Download

memory/908-205-0x000002C852AE0000-0x000002C852AE2000-memory.dmp

Download

memory/908-230-0x000002C852BA0000-0x000002C852BA2000-memory.dmp

Download

memory/908-249-0x000002C852BB0000-0x000002C852BB1000-memory.dmp

Download

memory/908-250-0x000002C852BD0000-0x000002C852BD2000-memory.dmp

Download

memory/908-209-0x000002C852AC0000-0x000002C852AC1000-memory.dmp

Download

memory/908-270-0x000002C84D3A0000-0x000002C84D449000-memory.dmp

Download

memory/908-471-0x000002C84D3A0000-0x000002C84D449000-memory.dmp

Download

memory/908-210-0x000002C852AD0000-0x000002C852AD2000-memory.dmp

Download

memory/908-208-0x000002C8529A0000-0x000002C8529A6000-memory.dmp

Download

memory/908-290-0x000002C84D3A0000-0x000002C84D449000-memory.dmp

Download

memory/908-197-0x000002C852920000-0x000002C852921000-memory.dmp

Download

memory/908-26-0x00007FFC025F0000-0x00007FFC025F1000-memory.dmp

Download

memory/908-195-0x000002C852920000-0x000002C852921000-memory.dmp

Download

memory/1956-89-0x00007FFC025F0000-0x00007FFC025F1000-memory.dmp

Download

memory/1956-340-0x000001CCF58C0000-0x000001CCF5969000-memory.dmp

Download

memory/1956-271-0x000001CCF58C0000-0x000001CCF5969000-memory.dmp

Download

memory/1956-302-0x000001CCF58C0000-0x000001CCF5969000-memory.dmp

Download

memory/4480-311-0x00007FFC01E10000-0x00007FFC01E11000-memory.dmp

Download

memory/4480-310-0x00007FFC01840000-0x00007FFC01841000-memory.dmp

Download

memory/4664-445-0x0000024C0A070000-0x0000024C0A071000-memory.dmp

Download

memory/4664-446-0x0000024C0A070000-0x0000024C0A071000-memory.dmp

Download

memory/4664-444-0x0000024C0A070000-0x0000024C0A071000-memory.dmp

Download

memory/4664-442-0x0000024C0A070000-0x0000024C0A071000-memory.dmp

Download

memory/4664-441-0x0000024C0A070000-0x0000024C0A071000-memory.dmp

Download

memory/4664-443-0x0000024C0A070000-0x0000024C0A071000-memory.dmp

Download

memory/4664-437-0x0000024C0A070000-0x0000024C0A071000-memory.dmp

Download

memory/4664-435-0x0000024C0A070000-0x0000024C0A071000-memory.dmp

Download