40e0563d9824b006e37cd2430249686ad3a4452c91033cb53a4f789bd59bde26

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 38.0MB
Sample260801-dhsclsdk9v
SHA256 40e0563d9824b006e37cd2430249686ad3a4452c91033cb53a4f789bd59bde26
MD5 89eb8c9d6fd6848d819bcdc9684beddb
SHA1 52989d4f88721ea899f9e5b07f5653feffaba0ce
SHA512 3cb471212d0796a773a5bf203d62553144843a426604233df8315293104e06b5661ae09481c370aa98495f1ba2707666cfa4e8679a05d277dd72072f892e32a9
SSDEEP 393216:X9JIfH0kBT3N704HqLOeN+o42YQ9PIqSnop5Y6xU:X9JIfH0kD704HqLOeN+o47OPeopKD
TLSH
T1B09719117A5FA96DD48BC87083478A774E2130DB0A36B9AF44C452393F7EBF46B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_744397579\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_744397579\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\https\URL Protocol	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\https\DefaultIcon	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\http	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\http\URL Protocol	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\http\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe,0"	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\http\shell	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\https\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe,0"	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\https\shell\open\command	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\https\shell	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\https\shell\open	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\http\ = "URL:com.donutbrowser protocol"	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\http\shell\open\command	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\http\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe\" \"%1\""	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\http\shell\open	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\https\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe\" \"%1\""	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\http\DefaultIcon	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\https	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\https\ = "URL:com.donutbrowser protocol"	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4260	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4260	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5704	msedgewebview2.exe
5704	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
940	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4260	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4260	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4260	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 940	4260	2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 940 wrote to memory of 2324	940	msedgewebview2.exe	91
PID 940 wrote to memory of 96	940	msedgewebview2.exe	92
PID 940 wrote to memory of 96	940	msedgewebview2.exe	92
PID 940 wrote to memory of 96	940	msedgewebview2.exe	92
PID 940 wrote to memory of 96	940	msedgewebview2.exe	92
PID 940 wrote to memory of 360	940	msedgewebview2.exe	93
PID 940 wrote to memory of 1264	940	msedgewebview2.exe	94
PID 940 wrote to memory of 1264	940	msedgewebview2.exe	94
PID 940 wrote to memory of 1264	940	msedgewebview2.exe	94
PID 940 wrote to memory of 2424	940	msedgewebview2.exe	95
PID 940 wrote to memory of 2424	940	msedgewebview2.exe	95
PID 940 wrote to memory of 2424	940	msedgewebview2.exe	95
PID 940 wrote to memory of 2424	940	msedgewebview2.exe	95
PID 940 wrote to memory of 2424	940	msedgewebview2.exe	95
PID 940 wrote to memory of 5704	940	msedgewebview2.exe	99
PID 940 wrote to memory of 4580	940	msedgewebview2.exe	100
PID 940 wrote to memory of 4580	940	msedgewebview2.exe	100
PID 940 wrote to memory of 4580	940	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.28.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4260.2736.2940287671169551527 /pfhostedapp:ada9affe44ab7261a5751858224619b33134ad56
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView /prefetch:4 /pfhostedapp:ada9affe44ab7261a5751858224619b33134ad56 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x50,0x194,0x7ff862555fd8,0x7ff862555fe4,0x7ff862555ff0
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView" --webview-exe-name=2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.28.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1916 --field-trial-handle=1924,i,8773782958137230159,5877375630374356587,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:ada9affe44ab7261a5751858224619b33134ad56
    3⤵
    PID:96
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView" --webview-exe-name=2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.28.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1924,i,8773782958137230159,5877375630374356587,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:ada9affe44ab7261a5751858224619b33134ad56
    3⤵
    PID:360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView" --webview-exe-name=2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.28.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2100 --field-trial-handle=1924,i,8773782958137230159,5877375630374356587,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ada9affe44ab7261a5751858224619b33134ad56
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView" --webview-exe-name=2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.28.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1924,i,8773782958137230159,5877375630374356587,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:ada9affe44ab7261a5751858224619b33134ad56 /prefetch:1
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView" --webview-exe-name=2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.28.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4412 --field-trial-handle=1924,i,8773782958137230159,5877375630374356587,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ada9affe44ab7261a5751858224619b33134ad56
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView" --webview-exe-name=2026-08-01_89eb8c9d6fd6848d819bcdc9684beddb_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.28.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,8773782958137230159,5877375630374356587,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ada9affe44ab7261a5751858224619b33134ad56
    3⤵
    PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app_settings.json

Path C:\Users\Admin\AppData\Local\DonutBrowser\settings\app_settings.json
Size 494B
SHA256 21073b1ce8432c43271c9cf1e18a18a6421aac7b70cadc9184d21db49d66faf1
MD5 001241adcacedf038ff822020f9cb586
SHA1 19d8eead693d099ed7968082d94cf9d662412c65
SHA512 7579fd5616d753e42614d1197bd242385c6caa5b8eae528a36a010ed1e563ab8d333521b1006dad883a4eabc2bf4d332cc24aa8e8ad9bbbf89b1fb35b3a7008c
TLSH
T1CCF0EC25D18898BA07C5A0AC8AECE2570718DE1302083C388A83890C364E77176BBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

background_update_state.json

Path C:\Users\Admin\AppData\Local\DonutBrowser\version_cache\background_update_state.json
Size 66B
SHA256 fb0e797d9c683312f74cd0507c6b62546760b02cd7e220bb7eec878e93117f71
MD5 28f16251b3cba53c4858c45391106b88
SHA1 a91a967e243a139eb9cd1ef5fe82bd47560ed400
SHA512 5d54c204e9a05b80015e399b2e77db87259e50acf1a85d89f5630720b1b74d4ee252314c5170b5823536c1b091d6ce11fd191d28d046f186da6e1f04770a8630
TLSH
T110A0023D8617E86C98F03A98009D85865D116E3741973E00230B8C4C0197923AC6F7AF
MD5 SHA1 SHA512 TLSH

Submit Download

wayfern_versions.json

Path C:\Users\Admin\AppData\Local\DonutBrowser\version_cache\wayfern_versions.json
Size 114B
SHA256 3d75fa4e44757761e38f18583f86fb8a2659e41c82fd51ee3cc2504c76bfb7e8
MD5 3d5c486e285d02c35b7bd8bed4e91d3a
SHA1 343e83e4c584ca83015c78b6aefd5b8812935316
SHA512 d79b6628e6ff1175d6d1c524a34dee4d06d95057b0a9186e072193b06e2b9fb4b44696339caa076bbcc7a0ec1c542f38e15705e43722c1656dad7bdf7e80f69e
TLSH
T1E0B0121488150C7222455AB9CA084081A76095CB569D6D18325D28088F1953718FD52B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b1ebbc98808ff284805e0de96572db67ccb4f14259e7f1b4d7eae8f2b46471ef
MD5 af06b754340bf134738dd4a08b160f8f
SHA1 b861295ffcbe5dfb528efc1e5229c0eda2d7f6fd
SHA512 c9e33d8d37e6f0492fd6304217b206c0fe1c1cde2be0e609d1364f17f6c6bb8e5ae1691c078f56528ef403f151131fc4e7ee117745278ccbbbe508f7cddd258e
TLSH
T157D0121677010134C02021B3800376080840D60B800941807429E91E7A944641A26882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e5f970d0a2fd87fdbf1887a200d2a2bf7590608af4a571757385c1357906a337
MD5 4472b107fc50fd5cc5df2b53172670df
SHA1 0e287ce53e10f083fb5260956a73ee5552f5a65e
SHA512 6ea175eaac14f7effefbcc022dbca179b192c57afac3768c7615fd71eb23a4d5ccec77ea84eac36b39c09710ca0ce7d57070822bc960bfd2e88a736206870fad
TLSH
T183D00414F7001010D11111F7C017570005445D41500503C03011F40574D05151135441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

327635ff-bc53-4f39-bd3b-7f4bd7000dd3.tmp

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Default\327635ff-bc53-4f39-bd3b-7f4bd7000dd3.tmp
Size 6KB
SHA256 ced57b53f2ffb7a2f6fc4d038b158a590bf23d3da18fbda08d222a362d305647
MD5 2ef3629a69df76bd3406406ec6144b2d
SHA1 b46a2489f1f7ede8e995e9453ff22feb06d25c1a
SHA512 a94429ddd5339db2cddd5906ea74711250083d036a81d2c5b65b161ea95fd4943114bcc5e04605fd7073705afe53f8d11c72d10e532e690dde7d49c98ce9743a
SSDEEP 96:st9/doyvreOb95kwZo5h16Z0AAs7/x+6MhmuecJAmsZ1ejeaK+gJla28XM1C7K:stBpvXLZonAAsV+FdAmsZQj2fIG6K
TLSH
T100D185055E24797B4CC7E509FA297B47E3F9607270D21E68E7F9462C08DA6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 0191800d387d650fcadb6e946e2c0caadd0c7eb943b215e9bbb591b3ff8a92cd
MD5 59a109c692150fc7ed419f42fa4b62fb
SHA1 d7af6a533efd01b9058d4b05328080be902c6943
SHA512 558839f8b8117ef49f2bb2153137c58bb21d0e066fabcec882aca8bf2f77f73f4a247e4d9e75f4093efc8c5856fb07df02133e5e4bbcb38ea0fe96d79051e6f4
TLSH
T1C8D0CA08203B0A3CC7CA5D39C8C61B9331374921AAB74ECBAAA09234D95A3B571B910E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ba6d.TMP

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59ba6d.TMP
Size 48B
SHA256 c37433e3af6a1a07f460894c3a80d4209ce16c8c36d49d2258cd84cee39b9972
MD5 af0a3120ce0d1240340c64eb03e350d2
SHA1 182c020d36a7c3878956ba980fe8a18461b7b9ab
SHA512 422fba3cc064433e51d49aa90bab6cd78764008058837e1f7d8c43d1bfd833672eda8b268f9a938932a36d480bebbaf9fe15776fec92c0444b57e1274949805f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

17bb1489-71fe-4dd2-9b40-44ad943895f3.tmp

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Default\Network\17bb1489-71fe-4dd2-9b40-44ad943895f3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aab06.TMP

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Default\Network\Network Persistent State~RFe5aab06.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Default\Preferences
Size 6KB
SHA256 f137f7fcdb5826cc3df1283a505305d4eac472c979b9e856879283002d250bbe
MD5 569154347239f5a1e70506889374009d
SHA1 6d3b074299a184abbd9f632e2d24f89dd13a0777
SHA512 7cca8d99cd68f7c95674870d85a1545be373bddacd14f329abe8ccd88df6206436cf77243785cc826934b59cbb7159e1ba0e50cec38bac048272d2f4a33a4a05
SSDEEP 96:st9/doyvrFGOb95kwZo5h16Z0AAs7/x+6MhmuecJAmsZ1ejeaK+gJVFr28XM1C7K:stBpvtLZonAAsV+FdAmsZQj2fVZG6K
TLSH
T110D1A5065E24797B4CC7E518FA297B57E3F9607261D12E68E7F84A2C08DA6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Local State
Size 3KB
SHA256 db4cb1400c14a7860f3a46027c4cc668d74435da0e78b990161a4e0a1f03f588
MD5 3c1c5c6ce0c477db94b9bcb4fcb7bdeb
SHA1 9fbac05713970ee90094bf55e26f2f7faec6f9ea
SHA512 78ab16ea8de401d32edc99b0152f9634de3c2ccf99a81977733c66314b5df49a7e673d6855c9166ba2433d3c520f764bfbc1d704862edeba391f075137dbc20e
TLSH
T15C71852A6974A53B5DF3D904B9C63B0BB7B55023D9913FA5DAEC1F0C01DB2891342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Local State
Size 2KB
SHA256 340ac01aaf223c2fcc44003416cb29a192a9f9cd2469ab4f4c64e12da16643fb
MD5 1b40a18909de87d90ae43121b72111a4
SHA1 0edffde63f94db35b6d183d749e459b0ba326f21
SHA512 545c277153f9d0bcf827f702f176550696c82bbf9f0c041705532781f1422fa943d9e6bac2d810f8418d80b8ce2d3e052b563478ceb2d28aa47197599b468ba1
TLSH
T15C5194337824A73799F38604B9873F6B9B769062DA522F319ADD1F0800CB65D1305C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Local State
Size 3KB
SHA256 a9c5dcf71243eadd33e549a94336da202d05b2dc402ad5f6a0be9a2709e3e6fe
MD5 ecc7270efb64bf69fe1bab4e6c092291
SHA1 ce1ed1890afa94f23f7bb337faa0bfa175fa4036
SHA512 c03fb1753a2fa1d683e0f2884d4c392f2bc939907cb74a408a7c890a6babc951bb41f8ed75cec228a96468bf3849a824180bd5c208adb3c333df0afaade12658
TLSH
T1D661632B6974A6375DF3DA04B9C63B1AA7A55023E5963FA5DAEC1F0C01DB2881341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Local State
Size 15KB
SHA256 d48f981a98b66781f8ecb8de804b86ca412ed4d35eb1f79b5b69bae24706a693
MD5 c06e1b505b926a63bacde0e7c9ba78d0
SHA1 7a2de2b1c9a29416f5787b35b8ddb24eb3800622
SHA512 2fa8f6964f4f7ab1c9ea40582f7e24fddc5214b99745946df070fcb065eaa5e8e802121da2cf674edfde8f1c31d2142c28f3127b7cca96d538cd4c37219d6248
SSDEEP 384:i+aQikB+z/xvxjg/qhEwNBS8sImRjpAVdp/a9zY:N/UxvxjgC+0E9pUyFY
TLSH
T1D1729E2B55397E37A5F3EA04799D0B8FDBF8947290813EB44AB96F0D06CB2980346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59678a.TMP

Path C:\Users\Admin\AppData\Local\com.donutbrowser\EBWebView\Local State~RFe59678a.TMP
Size 1KB
SHA256 64ad993dbceb09755cab5cc5ab58d78eb99051d630fab1601dfa5dacc3bb04ad
MD5 83df2cf2f01946f4b8f301c7e416bae1
SHA1 d4335df1fe6d6923582190d3713e4fc311ea403a
SHA512 520949700cdc02f78e9bbdb8b916dce83635913e56c1583ae93f02ac5f88b725b8549756686bdd5c7e42755259f9797ba864d00ecd135ebc64c8c041ac7d9d92
TLSH
T12F218777E5789733BCA3621572D3BAAF2F715063C3110F10A6DE1B1801D714E562AC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/96-26-0x00007FF883C00000-0x00007FF883C01000-memory.dmp

Download

memory/2424-57-0x00007FF883C00000-0x00007FF883C01000-memory.dmp

Download

memory/4580-744-0x00007FF8845E0000-0x00007FF8845E1000-memory.dmp

Download

memory/4580-743-0x00007FF8835F0000-0x00007FF8835F1000-memory.dmp

Download

memory/5704-324-0x0000024104600000-0x0000024104601000-memory.dmp

Download

memory/5704-319-0x0000024104600000-0x0000024104601000-memory.dmp

Download

memory/5704-323-0x0000024104600000-0x0000024104601000-memory.dmp

Download

memory/5704-322-0x0000024104600000-0x0000024104601000-memory.dmp

Download

memory/5704-320-0x0000024104600000-0x0000024104601000-memory.dmp

Download

memory/5704-313-0x0000024104600000-0x0000024104601000-memory.dmp

Download

memory/5704-321-0x0000024104600000-0x0000024104601000-memory.dmp

Download

memory/5704-315-0x0000024104600000-0x0000024104601000-memory.dmp

Download