d40896be90a0a443dcbf8b335e227e43a687c7dd7321c63e5e73245c61ec9365

Analysis

max time kernel
150s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 34.6MB
Sample260819-pmt8jsar71
SHA256 d40896be90a0a443dcbf8b335e227e43a687c7dd7321c63e5e73245c61ec9365
MD5 f093107470a053f862b6078933db203d
SHA1 64bd9169049f302dd16bcd9f60989e754a750cbd
SHA512 f42839ef12c224454a90c340fdcd2cbd1a2b564ffb7431481b8eedd6703151eb4bd0a1f060858bea963337a2a17f95e6644c8ac6d450d370a42e53208ec6002b
SSDEEP 393216:5AL7IsCAdIA3g116GqSuS9G6E17/W5tnlIU07f9STW9h1XbmRDfvryup6zS1Ve/N:5AzGJuS96jonlm713ERDfOuUe1Ve9KS
TLSH
T17587E052F6A280F9C16AC035820A6633FB717C4947357AEB5BE44B243EA5FE0673DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
944	enough-launcher-d40896be90a0a443dcbf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_14651120\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1470654181\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1470654181\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_14651120\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_14651120\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_14651120\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_14651120\manifest.json	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5552	msedgewebview2.exe
5552	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2868	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3816	2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 944	3816	2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 3816 wrote to memory of 2868	3816	2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 2868 wrote to memory of 5664	2868	msedgewebview2.exe	91
PID 2868 wrote to memory of 1628	2868	msedgewebview2.exe	92
PID 2868 wrote to memory of 1628	2868	msedgewebview2.exe	92
PID 2868 wrote to memory of 1628	2868	msedgewebview2.exe	92
PID 2868 wrote to memory of 1628	2868	msedgewebview2.exe	92
PID 2868 wrote to memory of 1896	2868	msedgewebview2.exe	93
PID 2868 wrote to memory of 3480	2868	msedgewebview2.exe	94
PID 2868 wrote to memory of 3480	2868	msedgewebview2.exe	94
PID 2868 wrote to memory of 3480	2868	msedgewebview2.exe	94
PID 2868 wrote to memory of 4920	2868	msedgewebview2.exe	95
PID 2868 wrote to memory of 4920	2868	msedgewebview2.exe	95
PID 2868 wrote to memory of 4920	2868	msedgewebview2.exe	95
PID 2868 wrote to memory of 4920	2868	msedgewebview2.exe	95
PID 2868 wrote to memory of 4920	2868	msedgewebview2.exe	95
PID 2868 wrote to memory of 4164	2868	msedgewebview2.exe	99
PID 2868 wrote to memory of 4164	2868	msedgewebview2.exe	99
PID 2868 wrote to memory of 4164	2868	msedgewebview2.exe	99
PID 2868 wrote to memory of 5552	2868	msedgewebview2.exe	100
PID 2868 wrote to memory of 2992	2868	msedgewebview2.exe	101
PID 2868 wrote to memory of 2992	2868	msedgewebview2.exe	101
PID 2868 wrote to memory of 2992	2868	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Roaming\enoughvisuals-launcher\restart-runtime\enough-launcher-d40896be90a0a443dcbf.exe
  "C:\Users\Admin\AppData\Roaming\enoughvisuals-launcher\restart-runtime\enough-launcher-d40896be90a0a443dcbf.exe" --ev-restart-broker 3816 Local\EnoughVisuals-Restart-3816-e0000aba-79b0-3906-8a7d-bd9fdfdf268d
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --user-data-dir="C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3816.4240.1596326806286021664 /pfhostedapp:45b1460f2ac7d03da705552beefd0d7286eba029
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView /prefetch:4 /pfhostedapp:45b1460f2ac7d03da705552beefd0d7286eba029 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x160,0x188,0x18c,0x16c,0x194,0x7ff89fbf5fd8,0x7ff89fbf5fe4,0x7ff89fbf5ff0
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView" --webview-exe-name=2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1772,i,117525743330165686,8892530955900322618,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:45b1460f2ac7d03da705552beefd0d7286eba029
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView" --webview-exe-name=2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1772,i,117525743330165686,8892530955900322618,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:45b1460f2ac7d03da705552beefd0d7286eba029
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView" --webview-exe-name=2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1772,i,117525743330165686,8892530955900322618,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:45b1460f2ac7d03da705552beefd0d7286eba029
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView" --webview-exe-name=2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3368 --field-trial-handle=1772,i,117525743330165686,8892530955900322618,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:45b1460f2ac7d03da705552beefd0d7286eba029 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView" --webview-exe-name=2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=1772,i,117525743330165686,8892530955900322618,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:45b1460f2ac7d03da705552beefd0d7286eba029
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView" --webview-exe-name=2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4364 --field-trial-handle=1772,i,117525743330165686,8892530955900322618,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:45b1460f2ac7d03da705552beefd0d7286eba029
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5552
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView" --webview-exe-name=2026-08-19_f093107470a053f862b6078933db203d_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4276 --field-trial-handle=1772,i,117525743330165686,8892530955900322618,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:45b1460f2ac7d03da705552beefd0d7286eba029
    3⤵
    PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 adfe06d8462d50690f1f0a0d1846164c8619d633c898f7dd05eaddf7a2ce80ea
MD5 ca1eeab3666aa01efc7826a20382b517
SHA1 14da68c87a41dabc52b4fc0456618768f9277810
SHA512 4d980cf8c678248314bda10891522b94c0bfc1c438aed04ef473fcda9a4ee856d768fc0b18b14ef1fc0721732076b2e5de5489818035292f01edce3de945c311
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1a895e5a3cc28d1b61673699e6e7f313c957dc9e43f7b18af8ab07e1b6d8e500
MD5 16200a1d2fa800b01a46b2aa8d6d8f44
SHA1 044b06aea82390a726151656d1d03add096f4aa3
SHA512 66776a89f5eeb6d36e8d15891d9b9d884d1f8f78a5751194ef4312f7659ca800a314754ee68d55ee342c609d33bccffc7bab42ba596bb1b94661d76c17fbdd70
TLSH
T117D0122633120134C02024730062750C0700C20B8047C045582CA95D5B044501913441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

4c1a8397-88d5-4e2a-b099-f46aa5b25bd3.tmp

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Default\4c1a8397-88d5-4e2a-b099-f46aa5b25bd3.tmp
Size 6KB
SHA256 60caa559470be9151395edffc0975bef8d2dba64c59ae027183a974511ff1429
MD5 b9fcd3a5bbd0035b8b31617cdabc1f6c
SHA1 35ff9df67d3f48cbda9ed59345ddd4deb3a13e9f
SHA512 0a113eb352a7d3f47cda100f28ae15ad25d124b0638f5c96076e9d308c2eb073ebe6c1fa401cc7a87dd436c94d2beeb86963130eaa74b3900e832a6bb548a2bf
SSDEEP 96:sti/da5FHb9gkZo5h16Z0ws7/x+6MhmuecJ5W41ejefK+gZaJ28XM1C7K:st6sKqonwsV+Fd55Qj9YG6K
TLSH
T1D0D1B4015E24B97B4CC7F149BB29BA03E3F9603265D11E58EBFD452C08DAADC630B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f6eb99962b17b2c9e57cdd32e58537a6a589259f8af103542e26ad0af17bda97
MD5 f3bb7040c9370ebe4a461996bbe5c924
SHA1 29dcfff86655d1f4364a44378775dec902c7f08d
SHA512 cb2ae62930de8625564fbe85f05518543d0d7fc35fd1ae8cfd5130ca6a50cb9a2ce0ef8041db53b4b70e2eab708c4327bae6196c79ab3c5d9939239335191124
TLSH
T158A002EC45C0014BE3000B7423C1538137FC88610A23B78281DD4964AE70B409659200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596315.TMP

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596315.TMP
Size 48B
SHA256 3cfe748f11690acc314bd8c78c2ba86849acb3bd2e46447837ef4320595bc8c8
MD5 67ac9873b16bb3be1f5494d3f8fa2095
SHA1 8ac45207f89b79717cfb660e88227d3a14096c38
SHA512 c283fa75d08260f7cad4748f8d4d83fac1023b75c707a9f4deea0b2f1ec19194d8e5bcdfce1bc2e8e248afd9c450376b651ad94e30895fbcee8d5bb0378ade6a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a40a4.TMP

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a40a4.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 c5d71a3ed5bac5f75a2e4e45e93c8ad44aee25c0d72d594d6057764beb5a8a2d
MD5 352e1ec58db379d174258b7de486ba04
SHA1 c83360cf267a8836e33ff19dbb8224b915e87f9e
SHA512 1c24f2dec990a6a613dad952fa1f3faccf5c6458fca245339332ddeee59de7e4e4d9afb84857926339128fc320278bac414e3d78a10a5937c8210e0826784687
SSDEEP 96:sti/da5MGHb9gkZo5h16Z0ws7/x+6MhmuecJ5W41ejefK+gZeSB28XM1C7K:st6s8qonwsV+Fd55Qj9FG6K
TLSH
T13FD193065E24B97B4CC7F149BB29BA13D3F9607265D11E58EBFD452C08EAADC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Local State
Size 15KB
SHA256 b02a3b8504943b4082d7f29ec73cbeb29ad98e185e739596350b3771ae090978
MD5 796eb277e0fb480f1824cc059273a955
SHA1 9f96b542018597bf240646216467061a02ee178e
SHA512 652592409cda854feb26d6c3e66b068aebbb97c177733d721a13cf350f4c300af4c114fa60af579ccf9f10664bb1b9b6bcd8a529e03624d9b858a2bc4fc67d17
SSDEEP 384:E+aQikB+z/xvxjg/qhEwNBSEZaluIVh8+79zd:j/UxvxjgC+8oPzFd
TLSH
T1DD729E3F98287D23A5F3E6557A490B47CBBC986291C26E788DFD5F0906D77D80302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Local State
Size 2KB
SHA256 6bdae2ae1a990a73fda5dc8679511c5315b7420ac2adb9d8e6a273c4c4349ed2
MD5 9663cdf8212ff6511bb42a402ac480ee
SHA1 e236c4bfb4747d4b4e69fa688e4cade77b7000da
SHA512 843b9980a42ffd8524b8cf74b723b4b5dea7fbeed822a1370acefbd8532613bed5a9758738435a0b1df7a68701400473679f2215570357c7c2ef58247d2323ac
TLSH
T1345194736C24E7338AB35B447A4A2F23CF7990529A622F51CDDD0B1C01DBAAD2706C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Local State
Size 3KB
SHA256 e90a835f55c0b28421da88468eda75c69a1834ee0139b2dfa9950a4552fff31d
MD5 378572448544374f641c1f8239704c16
SHA1 34cc51a167fd98118d7856ac7017fa1d0bf3151e
SHA512 84d2386665eb975bcd2bff5175083e1a4a36f0f102f975ec3d370a98ff39db6b456fe429eaf961f910f67e1badd004eaa89d07353f89927b193e1b884095204f
TLSH
T13961933B6974E6278EF39A4579862B12ABB94023D9917F95CDEC0F0D01D779C1342C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe591081.TMP

Path C:\Users\Admin\AppData\Local\fun.enoughvisuals.launcher\EBWebView\Local State~RFe591081.TMP
Size 1KB
SHA256 57089159036e38916fc6937d996a9ee7144747a161241f2ea253d01289d58bfd
MD5 1e25cdd3c901c0101836b79f83dde7c4
SHA1 c94987b0f798bf6313ceb214311868e6f31f250f
SHA512 56ef395a308261e4a6353960868eb1452d3ced0981dd612158191775a6b048fa21238f3570383ddf5b75975270b0617e8f2351d90cccd43445efe78c5f5f9cf7
TLSH
T1F42142B6E8649733ED63278622462A139F75005742508F408DDE4F1A12E66ADA92BC32
MD5 SHA1 SHA512 TLSH

Submit Download

enough-launcher-d40896be90a0a443dcbf.exe

Path C:\Users\Admin\AppData\Roaming\enoughvisuals-launcher\restart-runtime\enough-launcher-d40896be90a0a443dcbf.exe
Size 34.6MB
SHA256 d40896be90a0a443dcbf8b335e227e43a687c7dd7321c63e5e73245c61ec9365
MD5 f093107470a053f862b6078933db203d
SHA1 64bd9169049f302dd16bcd9f60989e754a750cbd
SHA512 f42839ef12c224454a90c340fdcd2cbd1a2b564ffb7431481b8eedd6703151eb4bd0a1f060858bea963337a2a17f95e6644c8ac6d450d370a42e53208ec6002b
SSDEEP 393216:5AL7IsCAdIA3g116GqSuS9G6E17/W5tnlIU07f9STW9h1XbmRDfvryup6zS1Ve/N:5AzGJuS96jonlm713ERDfOuUe1Ve9KS
TLSH
T17587E052F6A280F9C16AC035820A6633FB717C4947357AEB5BE44B243EA5FE0673DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1628-32-0x00007FF8C0E90000-0x00007FF8C0E91000-memory.dmp

Download

memory/4164-258-0x00007FF8C1E20000-0x00007FF8C1E21000-memory.dmp

Download

memory/4164-257-0x00007FF8C1550000-0x00007FF8C1551000-memory.dmp

Download

memory/4920-88-0x00007FF8C0E90000-0x00007FF8C0E91000-memory.dmp

Download

memory/5552-283-0x000001D581CC0000-0x000001D581CC1000-memory.dmp

Download

memory/5552-291-0x000001D581CC0000-0x000001D581CC1000-memory.dmp

Download

memory/5552-294-0x000001D581CC0000-0x000001D581CC1000-memory.dmp

Download

memory/5552-293-0x000001D581CC0000-0x000001D581CC1000-memory.dmp

Download

memory/5552-292-0x000001D581CC0000-0x000001D581CC1000-memory.dmp

Download

memory/5552-290-0x000001D581CC0000-0x000001D581CC1000-memory.dmp

Download

memory/5552-289-0x000001D581CC0000-0x000001D581CC1000-memory.dmp

Download

memory/5552-285-0x000001D581CC0000-0x000001D581CC1000-memory.dmp

Download