fa6e8f8f2ca2f84cc969c59ece85bdbf2032ecf80d5dd8c023ed484f9742c7e2

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 12.8MB
Sample260820-aeafvayyaz
SHA256 fa6e8f8f2ca2f84cc969c59ece85bdbf2032ecf80d5dd8c023ed484f9742c7e2
MD5 929e2913d5a4d9c4d1954206538f8104
SHA1 38b98c7f030adcbd8a5939823b193631f8617d6c
SHA512 477cbad0eb6a666995dfa7ae7181ab6770674a2b217e44a7ed1452484f417457f32f859e7b14d365415eaa53fb99b071210d443e60b0aafa7eff24ecd4303be2
SSDEEP 98304:WT7Ubv0q2HXxJcFBAwBM6cDP1sc25L6k3ln/FDhHQuFcEjeDBPk0ibz25oP+sppv:ia4DqceRSY1S9iOg
TLSH
T1D2D629116A5A9DADC17AC8F083464A635E2130CB1A36B9FB40E45539FFEABF41F39314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Epic Games\Fortnite\launcher_log.txt	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_656310918\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_922590062\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_922590062\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_656310918\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_656310918\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_922590062\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4836_10802053\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5384	msedgewebview2.exe
5384	msedgewebview2.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4836	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4836	2192	2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 4836 wrote to memory of 4512	4836	msedgewebview2.exe	90
PID 4836 wrote to memory of 5144	4836	msedgewebview2.exe	91
PID 4836 wrote to memory of 5144	4836	msedgewebview2.exe	91
PID 4836 wrote to memory of 5144	4836	msedgewebview2.exe	91
PID 4836 wrote to memory of 5144	4836	msedgewebview2.exe	91
PID 4836 wrote to memory of 2992	4836	msedgewebview2.exe	92
PID 4836 wrote to memory of 1584	4836	msedgewebview2.exe	93
PID 4836 wrote to memory of 1584	4836	msedgewebview2.exe	93
PID 4836 wrote to memory of 1584	4836	msedgewebview2.exe	93
PID 4836 wrote to memory of 4824	4836	msedgewebview2.exe	94
PID 4836 wrote to memory of 4824	4836	msedgewebview2.exe	94
PID 4836 wrote to memory of 4824	4836	msedgewebview2.exe	94
PID 4836 wrote to memory of 4824	4836	msedgewebview2.exe	94
PID 4836 wrote to memory of 4824	4836	msedgewebview2.exe	94
PID 4836 wrote to memory of 6040	4836	msedgewebview2.exe	98
PID 4836 wrote to memory of 6040	4836	msedgewebview2.exe	98
PID 4836 wrote to memory of 6040	4836	msedgewebview2.exe	98
PID 4836 wrote to memory of 4828	4836	msedgewebview2.exe	99
PID 4836 wrote to memory of 4828	4836	msedgewebview2.exe	99
PID 4836 wrote to memory of 4828	4836	msedgewebview2.exe	99
PID 4836 wrote to memory of 5384	4836	msedgewebview2.exe	100
PID 4836 wrote to memory of 4256	4836	msedgewebview2.exe	101
PID 4836 wrote to memory of 4256	4836	msedgewebview2.exe	101
PID 4836 wrote to memory of 4256	4836	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2192.4280.9324871880217924798 /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView /prefetch:4 /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff96a9a5fd8,0x7ff96a9a5fe4,0x7ff96a9a5ff0
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name=2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1792,i,14861508900114366954,5941283589231006235,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name=2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2136 --field-trial-handle=1792,i,14861508900114366954,5941283589231006235,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name=2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1792,i,14861508900114366954,5941283589231006235,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name=2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3396 --field-trial-handle=1792,i,14861508900114366954,5941283589231006235,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name=2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2116 --field-trial-handle=1792,i,14861508900114366954,5941283589231006235,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name=2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1948 --field-trial-handle=1792,i,14861508900114366954,5941283589231006235,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name=2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4576 --field-trial-handle=1792,i,14861508900114366954,5941283589231006235,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView" --webview-exe-name=2026-08-19_929e2913d5a4d9c4d1954206538f8104_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=2.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3416 --field-trial-handle=1792,i,14861508900114366954,5941283589231006235,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:42086691657bf8e51f81f77473c8a3e5fb03cf30
    3⤵
    PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f68dfd43a5820e159cb193ad0f560ed2d39c47fc7030bb99f1f98893198b767f
MD5 8fd7554538de0d31e3c1d83381440745
SHA1 45da2b5e8e5dbf35a9d58569018f4d52d5f00563
SHA512 13bb3c50b83c3fd97603920b622d5994fd8845f50b87895aafa7450c5f2ec2486f242d5d835e623d20cf532df7f9a6094ec6f35f3b143a3a227f371137f93446
TLSH
T11FD0222B33020338C020303330C3B20E0C00C20FC20A8208AC3ECA2FBF880A00E238E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c2d60435e7ea36201dda2b2b3c2d8b96f62a6f66245364369b968f010ba18ac5
MD5 2c61cc72a5e20b6caadbd97bd28bbb87
SHA1 1449b1b2a850d60f1c70a1dd8c9c8c8bdd532c54
SHA512 915466e6a7f44622696b2e376fb8c2d4da36a023e834a7c9a64330f3f2b09d261dddbfff6be437789689809c422ba035f21c184d57ae9851fd4a17eff7b9d002
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 d6eaae06288b2bba1e56ee9d3b04e0e87bbbf7498b9250db9e38f677d5a4f849
MD5 5822b5d164795634595f94576962daf9
SHA1 9f9cc6743404e64e6fb36f7337f5c2c75810ed71
SHA512 d2fdc1e99c886dfeaa56f281ae6c649445df05720ce8a11438ece422f2ab7949ded957e7c1c8e91b8b77424a7eb7e2af60b39598a9755b5b694153bd62554a2a
TLSH
T18FB0015140898687E3A90AB1A2C2A486BDB54E559A933E2541A0667894D9BA16AA2001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c19.TMP

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe591c19.TMP
Size 48B
SHA256 d398f0489a8b5bc8597449c6fe75168900182b74fb58100433ed592e0fd3ce44
MD5 74b95f642c1b671d217a6ef4ddf03325
SHA1 8bfbfaf988bcce87cbd8933042f9bb456b18854e
SHA512 7e17d95841e46c2eeaccc2b1b9d8f21a4a9192c0bb8ad610134507c6bd4e9747ab722904dc1b2d7065d00d57f84b40d8eccb9e4ecc3803681d8d2429b808af18
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Network\Network Persistent State
Size 232B
SHA256 e568397c2f9ef277ec14d4197688323cb062aa185c3343126219cc2dac5d922f
MD5 cccd472afd8499b9de422644f66f9d67
SHA1 d00801f139c1e89945003095f8bc665948f7fcf5
SHA512 583be0c30eb550fa4870321d6909c9c9e86868bb601880e1e889018e004186f0decbc7e60b997379ab028a6c38fcaa16e0e234967faed5b984555af66a2c6fd3
TLSH
T11ED0A7B656F068FE475583E41954681BCFAD0416076C5E6DC5A47B6743A20A8D014847
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 978d8153db565cb96f96162d95bbce413f215b973a69a50ba02951d8bc035324
MD5 e650191e30859476d5a7145578bb9b9d
SHA1 d581c0a58d1044c187f1d46f063b60e1b63d5965
SHA512 44755d6974dc640e4866bfe031b6ff4e710baefa47a0b990c4aff0a852beb13905ca7016efad7dd64541bd2802894337b6163883c7a47aeaee353fb8bd95d8a4
SSDEEP 96:sttV/dW9GfGdb9CkIo5h16ZPCs7/x+6Mhmuecpty1ejeSK+gW28XM1C7K:sttJIijo+CsV+FNtyQjqMG6K
TLSH
T109D194025E247C7B4CC7F159BA29BA07E3F9607261D12E58EBF8452C14EA6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cdacbc7c-7017-4750-bcba-4163d3c098f4.tmp

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Default\cdacbc7c-7017-4750-bcba-4163d3c098f4.tmp
Size 6KB
SHA256 239a5dbf3489d25ae3974c7851a7a59d9c28527d9e9b272e05932dece70f4c99
MD5 f7692a358a828840a64e7755275dceb6
SHA1 e2da43673c498077988bab5e8ba02c07b370e35c
SHA512 b729f0ae67a0ec48102929945f11149b59733ce9f5cbae3d534bb8285faf8ff50d3272293c3cf29c7397134cde987c0dcee46620f6475e5cf41499bd297029a9
SSDEEP 96:sttV/dW9Godb9CkIo5h16ZPCs7/x+6Mhmuecpty1ejeSK+gr28XM1C7K:sttJIgjo+CsV+FNtyQjqhG6K
TLSH
T175D196025E247D7B4CC6F149BA29BA07E3F9607275D12E58EBF8462C14EA6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State
Size 2KB
SHA256 4c0c32ff646f8a24a5a96f959eb451bf8a93d1baa47e3b54d47310691022b9ab
MD5 95d18c22c297f5639fb1fe540b06ebd6
SHA1 6c5b9875fa1554a4c67a99162b48b2f14d0ab55f
SHA512 e9a24342c4b4fe153bb7802161e5ecd1475d09127409fe741a8ba4192e0d8fca927ea0e6d4420f20128576c67d22abf9357dc217be2de13c7aceb870e8f9b1aa
TLSH
T1D051A5737C20AA378AB1AA4A794A7B139BB9D161D7521F10DADD0B0C01DB69C6302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State
Size 3KB
SHA256 89207a07200dd9952c76051056a4bc1f5c368a2d495c2f84c1ea89c8a954fda7
MD5 4aebdb535eedf561dbf81fa3d0a84b84
SHA1 775554b9ce6afb44da9edeac9c3081da668356fe
SHA512 b04ea89b038fd5ce26aa6b42dfb28562632daceef7ee4bd470999d478c5c18826ef0d65bb2ef82f68b8b34fa392508ccecb643987d152a05a94064ad5e9b6005
TLSH
T11D61857B6C70E9374EF2EE06B9862B06A7A59123D6913F55C9EC0F0C01DB3881341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State
Size 15KB
SHA256 6b8f32cf6f72c99d55fd72d16acc1f572495c105783af3ee30dbfcfc1052a5b9
MD5 9a1342056f526e3b3fa04312531110c1
SHA1 af0c57fdedbb22c934541be61536cc9f2b88ce86
SHA512 0e4a551fb774dd407506eee2df339670d3103b20a57d5872b157a1ea9cbb46acbaf2d3dd0cf9ca8cab7a03673ec94bc5ecfec61723e84323c3fd181a04f8894c
SSDEEP 384:G+aQikB+z/xvxjg/qhEwNBSmdkobWHNndET9zL:R/UxvxjgC+60dETFL
TLSH
T19C729E2B99797E23A6F7E9057D494B4BCBB9D8A291826E784DED6F0D02C73D40302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58cabd.TMP

Path C:\Users\Admin\AppData\Local\com.project.launcher\EBWebView\Local State~RFe58cabd.TMP
Size 1KB
SHA256 3dcf7ca6181f050ceefdaa777323697a593b77744dd60dad1d709b0f5178da3c
MD5 fc65d48b5b5f7f0575dd16dee812f9b8
SHA1 87fba7d1ae8d875e49655c36fb74bfea87dc7bcc
SHA512 a1f8fdbdf261cf2bb30799d91de78c5569d6f0a62c6e9604ca32595f7644e30fc2280eb09882c69c5232818a185377aa4b86c70c0e022750fa1f8fe517d42bcc
TLSH
T1032195F3F8609B339E50794B2112AA0B1E75817683114E0094DE0B0C02DB28CD71AC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4824-91-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download

memory/5144-26-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download

memory/5384-313-0x000001F00F6B0000-0x000001F00F6B1000-memory.dmp

Download

memory/5384-305-0x000001F00F6B0000-0x000001F00F6B1000-memory.dmp

Download

memory/5384-307-0x000001F00F6B0000-0x000001F00F6B1000-memory.dmp

Download

memory/5384-316-0x000001F00F6B0000-0x000001F00F6B1000-memory.dmp

Download

memory/5384-315-0x000001F00F6B0000-0x000001F00F6B1000-memory.dmp

Download

memory/5384-314-0x000001F00F6B0000-0x000001F00F6B1000-memory.dmp

Download

memory/5384-312-0x000001F00F6B0000-0x000001F00F6B1000-memory.dmp

Download

memory/5384-311-0x000001F00F6B0000-0x000001F00F6B1000-memory.dmp

Download

memory/6040-247-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download

memory/6040-248-0x00007FF98B160000-0x00007FF98B161000-memory.dmp

Download