1497dcc5dd94114547e5cd3bf57227be98567a2043e85ad26df9dacf3a340874

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 24.4MB
Sample260804-ml8y7shf45
SHA256 1497dcc5dd94114547e5cd3bf57227be98567a2043e85ad26df9dacf3a340874
MD5 9d782ea71e0c201d7dcd07844574656e
SHA1 817b53edb5782c531724fae244eb60e0bca0d1dd
SHA512 9a17733959589130ffbcdfe5385f24bca930c3bac93a3e5ecff72f8b2901e7145295f844cf623c66585af75c891dfaae6f7db720f6e806ab1e4f7b0e2d9f19bd
SSDEEP 196608:CpawS0KoSQKn2xIl8Ii1BFrqYmK8+NZoAe38X7Fpu9Eov35XexOz0syR+:ZwowIm1rrDV7ZZVLFSD35Xexkyg
TLSH
T156474A217A5A996CD09BC474834B8A724E7170DB1B35BAFF449492383F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_457643344\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_457643344\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_1908283726\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_1908283726\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_1908283726\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_457643344\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_457643344\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_848397836\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_848397836\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_848397836\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_1908283726\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5116_1908283726\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5152	msedgewebview2.exe
5152	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5116	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4612	2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5116	4612	2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 5116 wrote to memory of 5808	5116	msedgewebview2.exe	90
PID 5116 wrote to memory of 4144	5116	msedgewebview2.exe	91
PID 5116 wrote to memory of 4144	5116	msedgewebview2.exe	91
PID 5116 wrote to memory of 4144	5116	msedgewebview2.exe	91
PID 5116 wrote to memory of 4144	5116	msedgewebview2.exe	91
PID 5116 wrote to memory of 2796	5116	msedgewebview2.exe	92
PID 5116 wrote to memory of 4800	5116	msedgewebview2.exe	93
PID 5116 wrote to memory of 4800	5116	msedgewebview2.exe	93
PID 5116 wrote to memory of 4800	5116	msedgewebview2.exe	93
PID 5116 wrote to memory of 2672	5116	msedgewebview2.exe	94
PID 5116 wrote to memory of 2672	5116	msedgewebview2.exe	94
PID 5116 wrote to memory of 2672	5116	msedgewebview2.exe	94
PID 5116 wrote to memory of 2672	5116	msedgewebview2.exe	94
PID 5116 wrote to memory of 2672	5116	msedgewebview2.exe	94
PID 5116 wrote to memory of 4216	5116	msedgewebview2.exe	98
PID 5116 wrote to memory of 4216	5116	msedgewebview2.exe	98
PID 5116 wrote to memory of 4216	5116	msedgewebview2.exe	98
PID 5116 wrote to memory of 244	5116	msedgewebview2.exe	99
PID 5116 wrote to memory of 244	5116	msedgewebview2.exe	99
PID 5116 wrote to memory of 244	5116	msedgewebview2.exe	99
PID 5116 wrote to memory of 5152	5116	msedgewebview2.exe	100
PID 5116 wrote to memory of 4952	5116	msedgewebview2.exe	101
PID 5116 wrote to memory of 4952	5116	msedgewebview2.exe	101
PID 5116 wrote to memory of 4952	5116	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4612.4468.12376764689345408649 /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView /prefetch:4 /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0xa0,0x7ffe9f1e5fd8,0x7ffe9f1e5fe4,0x7ffe9f1e5ff0
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView" --webview-exe-name=2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,402796066458163206,5033810289642728466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView" --webview-exe-name=2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1748,i,402796066458163206,5033810289642728466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView" --webview-exe-name=2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1748,i,402796066458163206,5033810289642728466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView" --webview-exe-name=2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3416 --field-trial-handle=1748,i,402796066458163206,5033810289642728466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView" --webview-exe-name=2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4344 --field-trial-handle=1748,i,402796066458163206,5033810289642728466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView" --webview-exe-name=2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=1748,i,402796066458163206,5033810289642728466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView" --webview-exe-name=2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4348 --field-trial-handle=1748,i,402796066458163206,5033810289642728466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView" --webview-exe-name=2026-08-03_9d782ea71e0c201d7dcd07844574656e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1748,i,402796066458163206,5033810289642728466,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:633ae8ccdc5d8bd2361487f4ef9eef19e33a7d67
    3⤵
    PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e047e299a617e92588975845529227f1b0f4b8cad812d226e43b37933c862164
MD5 1cc7373d11c1fa14e030d307f622873b
SHA1 625531527760f1a649715ea341ce3dac34fa4641
SHA512 6fc2dc31b88ad52920a130692155191e70265bec831cdab2f5d0a5c442f963b9e02e7eb6a4ad11234d8355f1d87cf6a9e8b1246570238d764dba4e704e22fde6
TLSH
T1D9D01256361106BCC42039B31012BD090400C20FC10F50409838C57E1B140D01A03441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 37a586531f91a14e3abf0dacdfb4a09a9c96f2216f8dd6a4597dfa93ea963e74
MD5 9e630ada105abe9a68351dda48ae2b2f
SHA1 d04b11be225384af717463ab58a7765edfbf27ba
SHA512 b4d849d4f7b287df5362c743a76af66a7901a5f09341f931abda6ca18d79b78dac4e6edb8991b840f4500dabda212cb66c54e8e4a18d517012667c6d8ce957a4
TLSH
T1BED004D4551015DCC5107DF51030DD0141044544C10F35404430407505500C11143000
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

868db549-92ec-460d-94aa-92ea5864ce44.tmp

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\868db549-92ec-460d-94aa-92ea5864ce44.tmp
Size 6KB
SHA256 15f907fef4af47d3b4b14d8bb84d45e02768c3b6b05b8dce14cc22be5282efdc
MD5 a0fbc9fc8fd029275d15f512fcd7ca22
SHA1 91adfab20e39728df828264bba5217a47aa34ab4
SHA512 6bb09077619169589a8e2aa6567e9f7d9e12474f6ad94b173375870ffbb3fafd579c5fbeb943916f7e3cc7debec884582cba91648b923192633450ed195d4cd7
SSDEEP 96:st3U/dcVfU9b9wOfkQo5h16Z0EAs7/x+6MhmuecJS51ejeHK+gP28XM1C7K:st3Y6lwf3onEAsV+FdS5QjR1G6K
TLSH
T12AD1A7055E24B97B4CCBF519BA39BA07E2FA607271D11DA8E7F9562C04DA6CC230790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 bea073128ce709b6bae750bb4ba40e4a381d8cc9d0c978be5ae680545d5f77b0
MD5 4b6a3e44c82c935458b46f7ac7e0b512
SHA1 e46b3acb65d349681fd0213b426fabfb066495e2
SHA512 029641f877092ead20a135dca7eb150aa4a1891a324c12b9e21b8b3b5de3ff27c02dff8c4eeba6001638fd0896f21423f5472913c8c67073e36c4abea8255ba1
TLSH
T1FBA0026025D19603C340037511C5C1513630DF108673074345E08076C892398C902358
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594ced.TMP

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe594ced.TMP
Size 48B
SHA256 f812f41ca6051d3e02de12acf6eb8e0761f63018639e0382c9c1b165a8fac8d5
MD5 98420ca4e01570bdbea6aac7f1ac7d69
SHA1 8335eb24c54f7a982f92d26301b874700843581b
SHA512 6521be1b18e47ad773102b6c6c939f6d72984b74fa37e9da0b36a028c61f83e0ebe86a00d3bbd609159a078a9338caec15233eba3ea55ab156c800add3612156
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2145.TMP

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\Network\Network Persistent State~RFe5a2145.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\Preferences
Size 6KB
SHA256 b4b24132ddcc8fecf09497c4138dfdffd320e25bbc3e4578edb286b7d69fc2ea
MD5 2660254506df08e56464d17e55602718
SHA1 11daefe66c5240aea5a03a21087cb5092f8d3a5f
SHA512 bce57075cf8a01b2636a18b85f2a46653b3eeee4fb4f84e004d50ef649b4e76d56aeef944c8c5a2ef38539c433b0da0af174e8252eafad1dffed500a9d96e917
SSDEEP 96:st3U/dcVfbG9b9wOfkQo5h16Z0EAs7/x+6MhmuecJS51ejeHK+gh28XM1C7K:st3Y6l+f3onEAsV+FdS5QjRzG6K
TLSH
T1F9D1A7065E24797B4CCBF519BA39BA13E2FA607261901DA8E7F9592C04DB6DC230790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Local State
Size 3KB
SHA256 8ac26d3202ace0b10a625626a70be558d451e99972ea5bcfea962e916ded2edf
MD5 5c864594fd717621d7870464aa6b462f
SHA1 542641ae12d8f46c062369fa2ba5b900a70c6e77
SHA512 f79868e6a4a153017fb9c3b3b32d9f615eab5b12f4de62038f88d78ee95101b981379df901dbccfac44aedcd037a4689549dff71358775fc39feea9d61f18835
TLSH
T1446175376864A9378DF79A04B8862F1AA7B65023E5813FA4D6ED0F0C01DB2DC1301C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Local State
Size 15KB
SHA256 5f559dea44735560d54168e0fceb5b7f76cd4b13f1455ce9b0c5c4fda09efe14
MD5 1a5d9f560b3d905a8127a71f3fe2936d
SHA1 2e7cbd209bf1ae1833a0e590281e54c8ce0d3ecd
SHA512 d33ba8fa3990ddae7d46747cc285b65545aad895a7d8eb67835d85aa037d8019c74aca0e6f6a607e421043f0822ea82941d45c92d7892ab53787d360c00a6015
SSDEEP 384:X+aQikB+z/xvxjg/qhEwNBS5kv6phd6w+d9zW:m/UxvxjgC+mQP6w+dFW
TLSH
T19872AE2B95797E2395F7E904794A0B4FCAB994B291817EB849EE6F0D06C72D8130281B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Local State
Size 2KB
SHA256 a09201698e0e1760cd4c97091bfdb5b7f366ea6b1d6e16e171f7083fa4337082
MD5 877118ea0cae02b0c90f5c85e5f6e845
SHA1 8cab6b9894cb2f5d203e48afc6d786a9ff4dd414
SHA512 07a6f82d33429ae7e5b51bcea880a200a0189225c4cc6c1e5d0676c539072d0496620aa8a6c77318ae12b8f0ca6b4004c8e96df2e65c06cea9d454e8ad7c9a00
TLSH
T17D5188736814AB37C5F79A04794B7F27CA7A50A2EA512FB0A6DE0B1C40DA59D2301C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58fa0b.TMP

Path C:\Users\Admin\AppData\Local\com.blackat.hoshi2star\EBWebView\Local State~RFe58fa0b.TMP
Size 1KB
SHA256 f0b75ad4eaca84ea765d8602b00efbbda7f2d760e435ce61e54c07465d4b263d
MD5 c54d233d1759700082160757300059de
SHA1 617796f1e57875dc371861b0a9709e8d4ac509c3
SHA512 b1de29420da33c35ed60788ef1b9d0b55a63e303bc5704599f21a52a3c693e87b912659b2c398282a1f84ba5a695e2d61be2a9317c2219fe2f62e3946bc6ddb7
TLSH
T1C92187B3E4649B32D9D762457187BE1F5E312063D2105E5071DF0B1C41DA0DEA21AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2672-98-0x00007FFEBE820000-0x00007FFEBE821000-memory.dmp

Download

memory/4144-24-0x00007FFEBE820000-0x00007FFEBE821000-memory.dmp

Download

memory/4216-251-0x00007FFEBED40000-0x00007FFEBED41000-memory.dmp

Download

memory/4216-252-0x00007FFEBF790000-0x00007FFEBF791000-memory.dmp

Download

memory/5152-302-0x0000016ABE0C0000-0x0000016ABE0C1000-memory.dmp

Download

memory/5152-308-0x0000016ABE0C0000-0x0000016ABE0C1000-memory.dmp

Download

memory/5152-309-0x0000016ABE0C0000-0x0000016ABE0C1000-memory.dmp

Download

memory/5152-312-0x0000016ABE0C0000-0x0000016ABE0C1000-memory.dmp

Download

memory/5152-313-0x0000016ABE0C0000-0x0000016ABE0C1000-memory.dmp

Download

memory/5152-311-0x0000016ABE0C0000-0x0000016ABE0C1000-memory.dmp

Download

memory/5152-310-0x0000016ABE0C0000-0x0000016ABE0C1000-memory.dmp

Download

memory/5152-304-0x0000016ABE0C0000-0x0000016ABE0C1000-memory.dmp

Download