a0a063e64c94c191813d2d5772c7af778e6602098c6fb16caf487ade1697d95f

Analysis

max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 45.2MB
Sample260802-rvh7csbd47
SHA256 a0a063e64c94c191813d2d5772c7af778e6602098c6fb16caf487ade1697d95f
MD5 4d8bc40e1b7cedcf65f15071afa978d4
SHA1 525501aa3afdb86bdb7eaddfea4a87cbce9e4caa
SHA512 9fa54c834db0d635752ac5e314a9bd41b3563027ae9161e7749bd0e6f7ca307f153d661dc439307b6f7134cd791341798f26c474765acb4e9c771a16d57c719b
SSDEEP 393216:GRR+p8/ER6FYDZN8z6i3thSUZOOrx9F0ng53njpORSp3:GRR+p8/ER6azvidYUlDWS3n1r
TLSH
T15BA74A117A5B996DD58BC8B0C3878A774E2130DB0A36B9BF44C452393F7DBF46B29218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c61f-304.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Loads dropped DLL 2 IoCs

pid	Process
3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
10	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_702242669\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_940349749\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_702242669\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_702242669\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_702242669\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_702242669\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_332293060\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_332293060\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_332293060\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_332293060\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_332293060\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_940349749\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4760_940349749\manifest.fingerprint	msedgewebview2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5900	powershell.exe
1296	powershell.exe
1740	powershell.exe
3236	powershell.exe
352	powershell.exe
5312	powershell.exe
4136	powershell.exe
4596	powershell.exe
3768	powershell.exe
5032	powershell.exe
4776	powershell.exe
1620	powershell.exe
1064	powershell.exe
708	powershell.exe
1816	powershell.exe
708	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\omniget\URL Protocol	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\omniget\shell\open\command	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\omniget\shell	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\omniget\shell\open	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\omniget\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe\" \"%1\""	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\omniget	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\omniget\ = "URL:wtf.tonho.omniget protocol"	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\omniget\DefaultIcon	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\omniget\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe,0"	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3368	reg.exe
4040	reg.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
708	powershell.exe
708	powershell.exe
708	powershell.exe
1816	powershell.exe
1816	powershell.exe
1816	powershell.exe
5900	powershell.exe
5900	powershell.exe
5900	powershell.exe
352	powershell.exe
352	powershell.exe
352	powershell.exe
1296	powershell.exe
1296	powershell.exe
1296	powershell.exe
3768	powershell.exe
3768	powershell.exe
3768	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
5312	powershell.exe
5312	powershell.exe
5312	powershell.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
4596	powershell.exe
4596	powershell.exe
4596	powershell.exe
708	powershell.exe
708	powershell.exe
708	powershell.exe
1740	powershell.exe
1740	powershell.exe
1740	powershell.exe
4776	powershell.exe
4776	powershell.exe
4776	powershell.exe
3616	msedgewebview2.exe
3616	msedgewebview2.exe
1620	powershell.exe
1620	powershell.exe
1620	powershell.exe
3236	powershell.exe
3236	powershell.exe
3236	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4760	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	708	powershell.exe
Token: SeIncreaseQuotaPrivilege	708	powershell.exe
Token: SeSecurityPrivilege	708	powershell.exe
Token: SeTakeOwnershipPrivilege	708	powershell.exe
Token: SeLoadDriverPrivilege	708	powershell.exe
Token: SeSystemProfilePrivilege	708	powershell.exe
Token: SeSystemtimePrivilege	708	powershell.exe
Token: SeProfSingleProcessPrivilege	708	powershell.exe
Token: SeIncBasePriorityPrivilege	708	powershell.exe
Token: SeCreatePagefilePrivilege	708	powershell.exe
Token: SeBackupPrivilege	708	powershell.exe
Token: SeRestorePrivilege	708	powershell.exe
Token: SeShutdownPrivilege	708	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeSystemEnvironmentPrivilege	708	powershell.exe
Token: SeRemoteShutdownPrivilege	708	powershell.exe
Token: SeUndockPrivilege	708	powershell.exe
Token: SeManageVolumePrivilege	708	powershell.exe
Token: 33	708	powershell.exe
Token: 34	708	powershell.exe
Token: 35	708	powershell.exe
Token: 36	708	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeIncreaseQuotaPrivilege	1816	powershell.exe
Token: SeSecurityPrivilege	1816	powershell.exe
Token: SeTakeOwnershipPrivilege	1816	powershell.exe
Token: SeLoadDriverPrivilege	1816	powershell.exe
Token: SeSystemProfilePrivilege	1816	powershell.exe
Token: SeSystemtimePrivilege	1816	powershell.exe
Token: SeProfSingleProcessPrivilege	1816	powershell.exe
Token: SeIncBasePriorityPrivilege	1816	powershell.exe
Token: SeCreatePagefilePrivilege	1816	powershell.exe
Token: SeBackupPrivilege	1816	powershell.exe
Token: SeRestorePrivilege	1816	powershell.exe
Token: SeShutdownPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeSystemEnvironmentPrivilege	1816	powershell.exe
Token: SeRemoteShutdownPrivilege	1816	powershell.exe
Token: SeUndockPrivilege	1816	powershell.exe
Token: SeManageVolumePrivilege	1816	powershell.exe
Token: 33	1816	powershell.exe
Token: 34	1816	powershell.exe
Token: 35	1816	powershell.exe
Token: 36	1816	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeIncreaseQuotaPrivilege	5900	powershell.exe
Token: SeSecurityPrivilege	5900	powershell.exe
Token: SeTakeOwnershipPrivilege	5900	powershell.exe
Token: SeLoadDriverPrivilege	5900	powershell.exe
Token: SeSystemProfilePrivilege	5900	powershell.exe
Token: SeSystemtimePrivilege	5900	powershell.exe
Token: SeProfSingleProcessPrivilege	5900	powershell.exe
Token: SeIncBasePriorityPrivilege	5900	powershell.exe
Token: SeCreatePagefilePrivilege	5900	powershell.exe
Token: SeBackupPrivilege	5900	powershell.exe
Token: SeRestorePrivilege	5900	powershell.exe
Token: SeShutdownPrivilege	5900	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeSystemEnvironmentPrivilege	5900	powershell.exe
Token: SeRemoteShutdownPrivilege	5900	powershell.exe
Token: SeUndockPrivilege	5900	powershell.exe
Token: SeManageVolumePrivilege	5900	powershell.exe
Token: 33	5900	powershell.exe
Token: 34	5900	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4760	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 4760 wrote to memory of 4020	4760	msedgewebview2.exe	90
PID 4760 wrote to memory of 4856	4760	msedgewebview2.exe	91
PID 4760 wrote to memory of 4856	4760	msedgewebview2.exe	91
PID 4760 wrote to memory of 4856	4760	msedgewebview2.exe	91
PID 4760 wrote to memory of 4856	4760	msedgewebview2.exe	91
PID 4760 wrote to memory of 4248	4760	msedgewebview2.exe	92
PID 4760 wrote to memory of 4348	4760	msedgewebview2.exe	93
PID 4760 wrote to memory of 4348	4760	msedgewebview2.exe	93
PID 4760 wrote to memory of 4348	4760	msedgewebview2.exe	93
PID 4760 wrote to memory of 296	4760	msedgewebview2.exe	94
PID 4760 wrote to memory of 296	4760	msedgewebview2.exe	94
PID 4760 wrote to memory of 296	4760	msedgewebview2.exe	94
PID 4760 wrote to memory of 296	4760	msedgewebview2.exe	94
PID 4760 wrote to memory of 296	4760	msedgewebview2.exe	94
PID 3216 wrote to memory of 708	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	95
PID 3216 wrote to memory of 3368	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	96
PID 3216 wrote to memory of 4040	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	99
PID 3216 wrote to memory of 1816	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	102
PID 3216 wrote to memory of 5900	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	104
PID 3216 wrote to memory of 352	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	106
PID 3216 wrote to memory of 1296	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	108
PID 3216 wrote to memory of 3768	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	111
PID 3216 wrote to memory of 5032	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	113
PID 3216 wrote to memory of 5312	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	117
PID 3216 wrote to memory of 4136	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	119
PID 4760 wrote to memory of 2328	4760	msedgewebview2.exe	121
PID 4760 wrote to memory of 2328	4760	msedgewebview2.exe	121
PID 4760 wrote to memory of 2328	4760	msedgewebview2.exe	121
PID 3216 wrote to memory of 4596	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	122
PID 3216 wrote to memory of 708	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	124
PID 3216 wrote to memory of 1740	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	126
PID 4760 wrote to memory of 1084	4760	msedgewebview2.exe	128
PID 4760 wrote to memory of 1084	4760	msedgewebview2.exe	128
PID 4760 wrote to memory of 1084	4760	msedgewebview2.exe	128
PID 3216 wrote to memory of 4776	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	129
PID 4760 wrote to memory of 3616	4760	msedgewebview2.exe	131
PID 3216 wrote to memory of 1620	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	132
PID 4760 wrote to memory of 2780	4760	msedgewebview2.exe	134
PID 4760 wrote to memory of 2780	4760	msedgewebview2.exe	134
PID 4760 wrote to memory of 2780	4760	msedgewebview2.exe	134
PID 3216 wrote to memory of 3236	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	135
PID 3216 wrote to memory of 1064	3216	2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	137

C:\Users\Admin\AppData\Local\Temp\2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.8.3 --user-data-dir="C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3216.5088.1898513470374659246 /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView /prefetch:4 /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff897915fd8,0x7ff897915fe4,0x7ff897915ff0
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView" --webview-exe-name=2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,14617764152993948945,4738591873796479627,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView" --webview-exe-name=2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2136 --field-trial-handle=1776,i,14617764152993948945,4738591873796479627,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView" --webview-exe-name=2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1776,i,14617764152993948945,4738591873796479627,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView" --webview-exe-name=2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3416 --field-trial-handle=1776,i,14617764152993948945,4738591873796479627,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5 /prefetch:1
    3⤵
    PID:296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView" --webview-exe-name=2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=1776,i,14617764152993948945,4738591873796479627,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView" --webview-exe-name=2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=1776,i,14617764152993948945,4738591873796479627,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView" --webview-exe-name=2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4508 --field-trial-handle=1776,i,14617764152993948945,4738591873796479627,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\wtf.tonho.omniget\EBWebView" --webview-exe-name=2026-08-02_4d8bc40e1b7cedcf65f15071afa978d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.8.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4300 --field-trial-handle=1776,i,14617764152993948945,4738591873796479627,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8bc929bff8ba4dcf1606634bb2fd27bbcae205c5
    3⤵
    PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:708
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Google\Chrome\NativeMessagingHosts\wtf.tonho.omniget /f
  2⤵
  - Modifies registry key
  PID:3368
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Mozilla\NativeMessagingHosts\wtf.tonho.omniget /f
  2⤵
  - Modifies registry key
  PID:4040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-CimInstance Win32_Process -Filter \"Name='LeagueClientUx.exe'\" | Select-Object -ExpandProperty CommandLine"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact