33cc8584366025a743d83f66c4bbd2a99189659d0554f9ee172a45f92ffdc026

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 18.7MB
Sample260825-s9azzavepe
SHA256 33cc8584366025a743d83f66c4bbd2a99189659d0554f9ee172a45f92ffdc026
MD5 33d5f995df958708712236129bfcfdb7
SHA1 82732054058912bcd866c30b9d9b9d06b65b5c4d
SHA512 a18e224b4d1572e4a4d6de3dcd4d50fd1bb3cb391b1e35a6a9af81b62039ce9db5d8212703265d6d89e77f2fbe8bd17d9f7c82b921119bd941906c04581ecd94
SSDEEP 196608:1M/Jw96JYyqRU0JKlz4XsCz1rHNpgrzjRFfSB:u/Jw96JYyqRU0JKGXsorHDyzjLfSB
TLSH
T149171921BA5B996CD09BC47083478A734A3030DB0B35B9BF55C496382F6EBF56F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution ransomware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Pulse\launcher.exe	msiexec.exe
File created	C:\Program Files\Pulse\Uninstall Pulse.lnk	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{02B8593B-8AD6-4557-9419-6BCE34ECC52B}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{02B8593B-8AD6-4557-9419-6BCE34ECC52B}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2792_1452870106\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF1C518F2A55ACBD66.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59d2f6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4A1354527D237861.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{02B8593B-8AD6-4557-9419-6BCE34ECC52B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8B3.tmp	msiexec.exe
File created	C:\Windows\Installer\e59d2fa.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF22A3AB31E7F09F84.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2792_446418577\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF638C9D0229BB33E3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB753B3764E39A94B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2792_446418577\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2792_446418577\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2792_1452870106\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2792_1452870106\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2792_1452870106\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\Installer\e59d2f6.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5102F7FAFD1FDC98.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCFC50F1529A2C033.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2792_1452870106\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4660	cmd.exe
3316	cmd.exe
1276	cmd.exe
1232	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5548	PING.EXE
1168	PING.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\ProductName = "Pulse"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E27E984F7E76A235A9EB1140EE330E3B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E27E984F7E76A235A9EB1140EE330E3B\B3958B206DA875544991B6EC43CE5CB2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\PackageCode = "C37A4F80B9F48074DAB008CC9EFF8802"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B3958B206DA875544991B6EC43CE5CB2\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B3958B206DA875544991B6EC43CE5CB2\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B3958B206DA875544991B6EC43CE5CB2\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\Version = "134742016"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B3958B206DA875544991B6EC43CE5CB2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B3958B206DA875544991B6EC43CE5CB2\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\ProductIcon = "C:\\Windows\\Installer\\{02B8593B-8AD6-4557-9419-6BCE34ECC52B}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3958B206DA875544991B6EC43CE5CB2\SourceList\PackageName = "Pulse_update.msi"	msiexec.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1168	PING.EXE
5548	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1124	msiexec.exe
1124	msiexec.exe
1124	msiexec.exe
1124	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5416	msedgewebview2.exe
5996	msedgewebview2.exe
2792	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3220	msiexec.exe
Token: SeSecurityPrivilege	1124	msiexec.exe
Token: SeCreateTokenPrivilege	3220	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3220	msiexec.exe
Token: SeLockMemoryPrivilege	3220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3220	msiexec.exe
Token: SeMachineAccountPrivilege	3220	msiexec.exe
Token: SeTcbPrivilege	3220	msiexec.exe
Token: SeSecurityPrivilege	3220	msiexec.exe
Token: SeTakeOwnershipPrivilege	3220	msiexec.exe
Token: SeLoadDriverPrivilege	3220	msiexec.exe
Token: SeSystemProfilePrivilege	3220	msiexec.exe
Token: SeSystemtimePrivilege	3220	msiexec.exe
Token: SeProfSingleProcessPrivilege	3220	msiexec.exe
Token: SeIncBasePriorityPrivilege	3220	msiexec.exe
Token: SeCreatePagefilePrivilege	3220	msiexec.exe
Token: SeCreatePermanentPrivilege	3220	msiexec.exe
Token: SeBackupPrivilege	3220	msiexec.exe
Token: SeRestorePrivilege	3220	msiexec.exe
Token: SeShutdownPrivilege	3220	msiexec.exe
Token: SeDebugPrivilege	3220	msiexec.exe
Token: SeAuditPrivilege	3220	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3220	msiexec.exe
Token: SeChangeNotifyPrivilege	3220	msiexec.exe
Token: SeRemoteShutdownPrivilege	3220	msiexec.exe
Token: SeUndockPrivilege	3220	msiexec.exe
Token: SeSyncAgentPrivilege	3220	msiexec.exe
Token: SeEnableDelegationPrivilege	3220	msiexec.exe
Token: SeManageVolumePrivilege	3220	msiexec.exe
Token: SeImpersonatePrivilege	3220	msiexec.exe
Token: SeCreateGlobalPrivilege	3220	msiexec.exe
Token: SeBackupPrivilege	4656	vssvc.exe
Token: SeRestorePrivilege	4656	vssvc.exe
Token: SeAuditPrivilege	4656	vssvc.exe
Token: SeBackupPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3756	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3220	msiexec.exe
3220	msiexec.exe
4764	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
5960	msiexec.exe
5960	msiexec.exe
2084	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3220	msiexec.exe
1124	msiexec.exe
5960	msiexec.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 5416	3756	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 5416 wrote to memory of 4688	5416	msedgewebview2.exe	90
PID 5416 wrote to memory of 4640	5416	msedgewebview2.exe	91
PID 5416 wrote to memory of 4640	5416	msedgewebview2.exe	91
PID 5416 wrote to memory of 4640	5416	msedgewebview2.exe	91
PID 5416 wrote to memory of 4640	5416	msedgewebview2.exe	91
PID 5416 wrote to memory of 2592	5416	msedgewebview2.exe	92
PID 5416 wrote to memory of 2600	5416	msedgewebview2.exe	93
PID 5416 wrote to memory of 2600	5416	msedgewebview2.exe	93
PID 5416 wrote to memory of 2600	5416	msedgewebview2.exe	93
PID 5416 wrote to memory of 1576	5416	msedgewebview2.exe	94
PID 5416 wrote to memory of 1576	5416	msedgewebview2.exe	94
PID 5416 wrote to memory of 1576	5416	msedgewebview2.exe	94
PID 5416 wrote to memory of 1576	5416	msedgewebview2.exe	94
PID 5416 wrote to memory of 1576	5416	msedgewebview2.exe	94
PID 3756 wrote to memory of 1276	3756	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	95
PID 1276 wrote to memory of 1232	1276	cmd.exe	97
PID 1232 wrote to memory of 5548	1232	cmd.exe	99
PID 1232 wrote to memory of 3220	1232	cmd.exe	100
PID 1124 wrote to memory of 2644	1124	msiexec.exe	106
PID 1232 wrote to memory of 4764	1232	cmd.exe	109
PID 4764 wrote to memory of 5996	4764	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	110
PID 5996 wrote to memory of 2628	5996	msedgewebview2.exe	112
PID 5996 wrote to memory of 3312	5996	msedgewebview2.exe	113
PID 5996 wrote to memory of 3312	5996	msedgewebview2.exe	113
PID 5996 wrote to memory of 3312	5996	msedgewebview2.exe	113
PID 5996 wrote to memory of 3312	5996	msedgewebview2.exe	113
PID 5996 wrote to memory of 3148	5996	msedgewebview2.exe	114
PID 5996 wrote to memory of 5860	5996	msedgewebview2.exe	115
PID 5996 wrote to memory of 5860	5996	msedgewebview2.exe	115
PID 5996 wrote to memory of 5860	5996	msedgewebview2.exe	115
PID 5996 wrote to memory of 2848	5996	msedgewebview2.exe	116
PID 5996 wrote to memory of 2848	5996	msedgewebview2.exe	116
PID 5996 wrote to memory of 2848	5996	msedgewebview2.exe	116
PID 5996 wrote to memory of 2848	5996	msedgewebview2.exe	116
PID 5996 wrote to memory of 2848	5996	msedgewebview2.exe	116
PID 4764 wrote to memory of 4660	4764	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	117
PID 4660 wrote to memory of 3316	4660	cmd.exe	119
PID 3316 wrote to memory of 1168	3316	cmd.exe	121
PID 3316 wrote to memory of 5960	3316	cmd.exe	122
PID 3316 wrote to memory of 2084	3316	cmd.exe	123
PID 2084 wrote to memory of 2792	2084	2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	124
PID 2792 wrote to memory of 3416	2792	msedgewebview2.exe	125
PID 2792 wrote to memory of 4080	2792	msedgewebview2.exe	126
PID 2792 wrote to memory of 4080	2792	msedgewebview2.exe	126
PID 2792 wrote to memory of 4080	2792	msedgewebview2.exe	126
PID 2792 wrote to memory of 4080	2792	msedgewebview2.exe	126
PID 2792 wrote to memory of 3340	2792	msedgewebview2.exe	127
PID 2792 wrote to memory of 2416	2792	msedgewebview2.exe	128
PID 2792 wrote to memory of 2416	2792	msedgewebview2.exe	128
PID 2792 wrote to memory of 2416	2792	msedgewebview2.exe	128
PID 2792 wrote to memory of 864	2792	msedgewebview2.exe	129
PID 2792 wrote to memory of 864	2792	msedgewebview2.exe	129
PID 2792 wrote to memory of 864	2792	msedgewebview2.exe	129
PID 2792 wrote to memory of 864	2792	msedgewebview2.exe	129
PID 2792 wrote to memory of 864	2792	msedgewebview2.exe	129
PID 2792 wrote to memory of 5932	2792	msedgewebview2.exe	132
PID 2792 wrote to memory of 5932	2792	msedgewebview2.exe	132
PID 2792 wrote to memory of 5932	2792	msedgewebview2.exe	132
PID 2792 wrote to memory of 5936	2792	msedgewebview2.exe	133
PID 2792 wrote to memory of 5936	2792	msedgewebview2.exe	133
PID 2792 wrote to memory of 5936	2792	msedgewebview2.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3756.2620.13712154629221227539 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Pulse\EBWebView /prefetch:4 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd60cb5fd8,0x7ffd60cb5fe4,0x7ffd60cb5ff0
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1764,i,11165517887833371913,3185264849736432321,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1764,i,11165517887833371913,3185264849736432321,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1764,i,11165517887833371913,3185264849736432321,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3372 --field-trial-handle=1764,i,11165517887833371913,3185264849736432321,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65 /prefetch:1
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  "cmd" /C start "" /min C:\Users\Admin\AppData\Local\Temp\pulse_update.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\pulse_update.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 4
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5548
  - - C:\Windows\system32\msiexec.exe
      msiexec /i "C:\Users\Admin\AppData\Local\Temp\Pulse_update.msi" /passive /norestart
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
      4⤵
      Checks whether UAC is enabled
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4764.1180.4551332228584678675 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:5996
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Pulse\EBWebView /prefetch:4 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7ffd60cb5fd8,0x7ffd60cb5fe4,0x7ffd60cb5ff0
        6⤵
        
        PID:2628
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,12923312106677802552,16447980635236156603,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        6⤵
        
        PID:3312
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1752,i,12923312106677802552,16447980635236156603,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        6⤵
        
        PID:3148
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2564 --field-trial-handle=1752,i,12923312106677802552,16447980635236156603,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        6⤵
        
        PID:5860
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3336 --field-trial-handle=1752,i,12923312106677802552,16447980635236156603,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65 /prefetch:1
        6⤵
        
        PID:2848
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /C start "" /min C:\Users\Admin\AppData\Local\Temp\pulse_update.bat
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\pulse_update.bat
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 4
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1168
        
        C:\Windows\system32\msiexec.exe
        
        msiexec /i "C:\Users\Admin\AppData\Local\Temp\Pulse_update.msi" /passive /norestart
        7⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
        7⤵
        Checks whether UAC is enabled
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2084.2308.16529913853231619582 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        8⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Pulse\EBWebView /prefetch:4 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x194,0x198,0x19c,0x170,0x1c8,0x7ffd60cb5fd8,0x7ffd60cb5fe4,0x7ffd60cb5ff0
        9⤵
        
        PID:3416
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1872 --field-trial-handle=1892,i,15002277257741010655,10956703773713148431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        9⤵
        
        PID:4080
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3032 --field-trial-handle=1892,i,15002277257741010655,10956703773713148431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        9⤵
        
        PID:3340
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2888 --field-trial-handle=1892,i,15002277257741010655,10956703773713148431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        9⤵
        
        PID:2416
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=1892,i,15002277257741010655,10956703773713148431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65 /prefetch:1
        9⤵
        
        PID:864
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=1892,i,15002277257741010655,10956703773713148431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        9⤵
        
        PID:5932
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Pulse\EBWebView" --webview-exe-name=2026-08-24_33d5f995df958708712236129bfcfdb7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4556 --field-trial-handle=1892,i,15002277257741010655,10956703773713148431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7faa624aa97e1fbd34d0c242a6003254cd704b65
        9⤵
        
        PID:5936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59d2f9.rbs

Path C:\Config.Msi\e59d2f9.rbs
Size 9KB
SHA256 9120f2959cd682e6be878ff66a3a19ef1412ab721279a7704b2d03c63d1a4c66
MD5 8849c466e05943dbca7acd7339e4f074
SHA1 c68feb56578c878285f8e644a54972f6d035f5e3
SHA512 c8bc095cba997bb2adb6995e2e4046daed03f6c5ebf8f70b96be79e18e70650fdd11f14b50fa3240ec89b2b4ad58c0f768015882acd48a827280e1185396c41f
SSDEEP 192:gFbGfCfCRRPcGkPcbeoNXuW9iHSzmaapIM:gFbGfCIPcPkyHSzLM
TLSH
T197223102F64192D2F9AB4734C70727623BB3CAC89395635708CD64649E4339A5EBB38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59d2fd.rbs

Path C:\Config.Msi\e59d2fd.rbs
Size 3KB
SHA256 94d6d5ef354c69f6bc3f91382ce07bf2cb8c72311290249c3ea4add3e02986cf
MD5 57c66c756d5593182d5e9b839af1a4db
SHA1 c132eda75069669b18e01cb0ee1280337d0ed0d8
SHA512 9a2bf3246dad7a2358c0c085c34e1670651b61bc682fea48c621c5e64ccb76cef6d1c6354f92c265e087530a88983a5b0094fc3cf7dd75ecfc84ce4739e07fb4
TLSH
T17E713E03EA4496C3ECA75B30CE175B5137B7C6E9C365434704CCA1B04E4779AAFE624A
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.exe

Path C:\Program Files\Pulse\launcher.exe
Size 18.9MB
SHA256 eaf4164937f9a9d6ebd1046250c135c58b5acf95f5941aa54dea41aa16cfa7a9
MD5 bbc7ed25a0f4dec102c2ad6d4f12ef7a
SHA1 8c59f954d97424fde85dcedd15499f0bbdb568c1
SHA512 da3570c0ffac0667add55fd7010292a77bf8acaa974ca5207bcc2b20155a21935363728f7dca1b20aa79ef3f18b76ca8abce0d349f8559330c41ef9616195de8
SSDEEP 196608:TWxMPGJes40Sfi4vPKQwaIcJCoXavPr3rH+1s0idy:qxMPGJes40Sfi4qQwLcJPcj3rHEs0iA
TLSH
T1AD171920BA5B996CD08BC47083478A674A3034DB1B39B9BF55C496382F7EBF45F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pulse.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pulse\Pulse.lnk
Size 1KB
SHA256 14126856ffbff5566fe205c6c72d436f8c9cdbf262692bf8f18db36220f90cf2
MD5 014c6f706455f805702e52c945f3b9e8
SHA1 67f55a733a2ebbe7873aaf60f7666c9a13d1ec65
SHA512 0eb48d6294c249718b5803da2132bcbc34915e6b34b3ac2c97e6f6a2e6c4c7483fa03844220086edfef92593492d8b9ca3b3ec8179872e1edcbc649a99f864cb
TLSH
T1AD41AD501AE6072AE33646766EB10B619B33FC06BB744F2E028942C51AB5101A968F3A
MD5 SHA1 SHA512 TLSH

Submit Download

Pulse.lnk~RFe59dad6.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pulse\Pulse.lnk~RFe59dad6.TMP
Size 1KB
SHA256 ea7c4fe800acb965c0229884b17b692ba2fcc631fc9bc3a40e71dcbf92a3e7c4
MD5 70d192c7705e4c52461d78f05e7cfaaa
SHA1 1b58290de6f6b0bd9929f15ba075d2c9b071c295
SHA512 871b16a747f5c757c3cb2b49ece413c3c1d1620b3305adbc719dbc1122ed298f5e93dd0a7ca7910c91635259e2addf3ff5420a01ecc4f7105b5bfeaad018fb10
TLSH
T13441AF5016E6072AE33246766EB10B60DB33FC06FB744F2E028941C51AB4101B968F3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eec60233e9efb26cb7eb813e31e302f66ae8cd2d8d1067da3cc4bac903ce2576
MD5 0bebea3313b8b07929ecf741046519f2
SHA1 935c1a57ab4ff478c39f837982df7bc362b1ce11
SHA512 7a5ebf02ebe3ccc9ddb960c344c7f06bc7979aa0e3291934d17eb4aef17f3f3c2df334407946cc2be62b6777084ef5bd1240439f35d107b81b242411d90d7644
TLSH
T107D011223B020A38C02020338082B20A0802C2AB800A8008E82CAA2E2F080A22A0388A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0898b62fff539c442e1a1c8ca301893178610197b01cec1e874276b79ae61673
MD5 7f7ce40eac07391a55ff72c1d94e5863
SHA1 1c6be81fd715597fd052de3137057d72a406f95f
SHA512 ed812195949fc322f40a9b25e9c0a777eae505d42880f7394b2cc72adea07e54a15a79ea89af958a7abc06a5bb21dcf23ef0f3a3b3b7a9b299f6e234d747bbac
TLSH
T120D024133F01053CC03031334001710D0501C15F4107C104DC3CCF3D1F040511D0344D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 df9745eb0e7c07f9bab4b72513b57688f5640f3ee3482c36ed7483bcb15c0397
MD5 023a81135f88b5a91ec3328d275184ea
SHA1 139de672b7f2c0f2875a03b5a616e8222b812323
SHA512 7f6f35cbcb9ebe956ec95cde2cbb07cd1227ee41787ec1c7253243d59f6e29f09d8e632ef8398e60de1251c985f4ecb67dd54d307260fc780c00ab17a9a8d394
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8bb6378d85c2c971136fd6a671d3b1171bc147ed1874fdd64bbd701555fe3f25
MD5 e611a0ab4ce053209051d3402334fa56
SHA1 81a4a485263786d497fb3aafd8af16fb433d6287
SHA512 70ce70a33b1971001de17513141aa5ad2c64d8e49f299a349af8cb4e9225dce983ae2328f0653045ef352189d08a8eb6da887c91d073c288176004d178c4e8e2
TLSH
T146D02BA227150935C3243232C080F1585101C12E010781049E39FE3C0F410E30CC2849
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8b8c2191eda7cf6d36decfbce7e2ee6ca048e3e570078dec13f390c3fe0cdd44
MD5 5063cba7fe582e85cc072d82e20f403d
SHA1 518039b862c81c64a0e20640bc0a10523b615712
SHA512 7e95c4ac75009de181d3a851267cde44405393227b364c329ccbe1a298a6b66c8957472509fa0fe161813c5f0570e4bf3ed6738c2fdc3aacdeea7cb0b7966433
TLSH
T18BD0226122020D34C22422318991E1A82200D62E0406C284993AF62C8B4609309C2C8A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b216a7d6576db9775b7928482aa460fb0b2a70315ce362270cecb6c3cf1ede07
MD5 2849e57a1193c53f57fc80212869a06f
SHA1 14e4aacc86853433586db8d84b822b8833568ac0
SHA512 459f6526b31f63a07554d9cf9e48e2cec2e6b2d45def64e89e725ff50ee55a1aa0da69fdb05f733887c8853ab49ce601184f858ad81d1747e5aba5058d74a1eb
TLSH
T1BAD0126162160D35D26562759991E1A96500D62F4806C584993EF62C8B454A31986D8A
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 87516f5a17882191601d2d5cb8b4d774b3d13fb90afc327893635ff3c3e76cca
MD5 51521f7d5b8c68a153944899799ca9ea
SHA1 30fddb15ceda947e4cb99420e1c6f364fdfc39e7
SHA512 ef872d33322b3dc41650185fe823c10d2beaa99987fa657020f2b23f8c806ccb95ae8de101a08939f00355bcbd5b7256a44c18d29a69cdd560c2fd4080a625f2
SSDEEP 6:/F3XGu3lbxSIlCkM/l6OuUvJ2u+i8N8l:d3XnE6tUlz
TLSH
T16113927CFAD8098FDB451BF81146A2B0473A8704D605A3D314E92433899830D8A2A509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 be94d260beea46eee29da66e23a4cbd7c057e7a43ca4f41ed4a62f0a20360643
MD5 3d0738c359ac0f0ed0f27a987e673045
SHA1 c35037273c0866fb434772c90e9a918ffdd155f3
SHA512 9bf6cdc144cb8d1f7f6b2832f31a802a6881db2d952c61c3a38e92ec58dde1d21ac4952f5483a304ba9f3094166882c0541b575e2c507941ddba01e7a80661fd
SSDEEP 24:30AhGhV11bh6b82WW3rOQUlbI89lAAXPLpq4nHSAGEWLSMO304:EVhV1n6J3qQ+889akN7nH8EWLda
TLSH
T13244B8CD678388D6D21083B662E95F3F993B06E749E782D6B9605C6859CA38D0116348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 95b2f0b20dd078aa99071a7e4d1f06abd0944f47174f898fc2ad9f0d9d72db74
MD5 11a9a66b15652ad1bb5497a307ba7e65
SHA1 d20b7674404e5fc35e9b2b2d711a45a7d3f750e7
SHA512 1a9837b563414e9238c9a663421131a09e583931cdd330464208d8d6c0364ce59da01357b31fb72cfd0b6f9cf0b307fd465a2123c2432fcb015af8f087eeba04
SSDEEP 192:1uTRyJCjmkZPl7VAu+ayEY3/g9gF9nvPl7VAu+ayEY:1IAJMZQu+JEY38gfvQu+JEY
TLSH
T1E7163BE74F64A506EE46DF30A7C8DD3C3CB067A77C82D893A41A81E958E0BC1178A45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Cache\Cache_Data\f_000001
Size 32KB
SHA256 fa26406eeda9a3c6ec3d9ea8813c3045d6dc755e30c716d5c094e8ef43be5a7f
MD5 0d0e5e4d2f9fef29f3aff5e8e0e659c4
SHA1 93f322133a56cd58cb13fd9d3e3555426875e255
SHA512 5b62778ffd0054b895ddb493ff46f760f96d0dcbc6e171466ea5497c02ce02c7a12238ebde1e73c7e95530634a0eab7fe1c4f1ca9d24f6f54cf6a9e9d9bab9f2
SSDEEP 768:ROxePX1Sw4LXk9Hj8lO1W87tUx7HfPrKF5:RBdS7jk48W86xL0
TLSH
T164E2F15D7D932490C4B41899C6E20E56EAC508E1BAD5EAD3FF1B0D0EB71A4F4CE4E1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 8a6d137beec534c62c2f111b58ffbb303cfa4e89b85c13c4444ac2d777772c38
MD5 06755e5648ea00486721ce43da707dfb
SHA1 9df46718cdf559d146f7227c8bc3681b0d5a700b
SHA512 0154482c4b1506b32cab098477f415e0c8ea89d88c8dba07839ef1860ae99a7363d2dcffd7243f39d94d68252ce2efd12b05f260cc6fed5065653906c26010d2
SSDEEP 3:LsfltlNllkll/l6Sv011nMsl/cNl/lzl:Lsf13lEtDfsl0N
TLSH
T18344027D63C04D0ECB8017B98442A7360339C502DA4FE3C30284012D1D837D40F5A191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc57b8a8ada98b1b_0

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Code Cache\js\dc57b8a8ada98b1b_0
Size 256B
SHA256 7ec5bd7c271e5a8059230544f75ea79a2ba8481f4a8c998f28d812d556b45a71
MD5 61cea755cadc1dd8169f4d038a1c7e74
SHA1 1f821da09a5e2c5970d98f06b3cd5a598e5ea7bc
SHA512 2a2d8c8af355fe8ea7fc6da77d714b81f7c8bb796829d83b3a574dc228c776bc9884eb4a62e3ccc876e0657c2b4fe0acbe6c5063ade39825ea9162a56616db2f
TLSH
T1F5D0A78E4991250DC393BEF1DFF7CD8AA34343D21089A5635119E49321E067C762C721
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 0f66f27bc8da8894f35f013a5fdb75e7e23ccfcd2ca1e2bf6d782aa3b838ea1b
MD5 1f29a2c9f3275093503058d35b470819
SHA1 ebee12891964a264cddaa4c1b0ea9236ab4ccb5e
SHA512 f4d59791bbdfd6f7d928acfa3c43037aaff59fa2c8a56b7d27cf66d69a8920c9ddb612080a202b7e2ba35ab7c95090f4431c80aecc6a6dc9e2d6b1be4fe6cf32
TLSH
T10FB01261C4C14544C3004274209210A0A139CEC840060EC876982434551025486D5400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1ae7c056961964155467bf0d736b2475a61489bc0bc499d89bd01373da06936b
MD5 27093b604da4e5eb5cc5ddb9e74b6771
SHA1 bdfc2c7891ec9e1820cbf960621a62d155c44ee7
SHA512 61c1aab95220fe4829b02812e441b2b6dab048539cea7687b4c4c501ec310495d1619f825b144d81c2c5efd4d2a8a177002acc645c5d8ef05ca2f4da17597fa7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 7a89744d76c81eb4c56f399adbcfb2883b8c402a08ebd371326bc3bef7f32011
MD5 e45959e615cf68de45d2ead6ac9df836
SHA1 a6635dcb82d1070f33668494da4810a5a80d460f
SHA512 6f780c54d900daaf5de894676a12e262cb38e80a235f4ca49fd632717d895d9bf15477f4ef7c930a012593e70c0859b04c867fe96a78571a4329bf3fb02cc6e7
TLSH
T195A0025101C40441D24546B4509612903334CE1546160BC576950179BC553485769550
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 7d366b67224bd054edcb2178d8c8aa673b2ab4d82d3b47af2cca8b225a073ff2
MD5 fa975b00c4cef5063cc7454aec9c2828
SHA1 c938a16f7b0be603056d02c91af12638ffc30337
SHA512 0b7999d85014e4c73bd774c4b3761e0a176e5004775f2dcafbd93d6502dad4a26ef86ac1d0cb689520777bce5fd7ebe1d5abf48ae94ac3ce64e1cc535a092e48
TLSH
T1FCB01260C4014452C301037028F21060B1348DC8810B0DC072A90438951071481DD405
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 ff7323060cfdaa904f4ae8df48b994bc81e7114d208b40f301753c0edb273b98
MD5 d72e8c00ec0a57e356d95fb50de22b25
SHA1 874e4b6e208e24920262d8746402fdab03daa2bf
SHA512 e81dc745d5ff2aa3b8c76b2c5c8c890f59fef14b040b1bf7e559f04e3937671181ce5acd5c5d27e628b6d59cbec3fc81ca29bb2cb8a9c5b88df1753d00585873
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Favicons
Size 24KB
SHA256 4fb62d980e6ae1340488ef7023402ba18b51981683ac14a662fbe6784d6a32c9
MD5 e683aba5c2eb25ad3cfd14d38f07fd5d
SHA1 5830d251a435e969082ba0d450d39e55b38a0dc1
SHA512 bcc0761cbc0e52aeabb7b29be204c08593506bf70c82e37321a71165c3cef25fdc3de49af512b7012100a69ba0442531a81347d99860f7226ad5ad3148e095a0
SSDEEP 48:QBmw6fU1zBuziR9q8pj8ZUHaQDmSo0C8dtupPzjv0PcrRmlBSTkikUe51nbC:QBCyuziimdaQmSoJeGzz0SRNTtMo
TLSH
T17DB2E81F6F387002CBD15E7E2A6A5C3A8D3FC35DAEA50C287C2894605CB458585355BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\History
Size 164KB
SHA256 c1f424067b11cd208e1a4a376a09d39962efa3ef1c30a49a0db8fb26fcb5fa59
MD5 a98b8d3f026024167fe35d962be50c2f
SHA1 1ba016d1f29e56a694351a20b3bc8e1b4fa7c8f8
SHA512 da00dd7d09c666700dfcc3395f812dac3dc274846b4fe5d14b723d926d5db7fcc681240bb89b18e908ce978fc425d3f9c5c12f31b16542ae58c037ad9fc64fb5
SSDEEP 96:8BN6aj5LqL/uejzH+bF+UIYysX0fxQp97CPXEHt/DfLVVVN6zRk/E00mV:8BNF5qL/tH+bF+UI3iWGVCPWNVVV63QV
TLSH
T1ACF3F95E5F243312CDBD923668E745E3587DF03F87236A866C6154B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Login Data
Size 42KB
SHA256 0c1c2e0223f73fea44686ae44f4e78411de421f7aef7d89617be3837d3fdbc11
MD5 cec405af1bb4df2029eacdcbc7e05fd6
SHA1 835e45888f49095a184a62a229a437399c9c62cd
SHA512 4ce266cc942447ac963f4652c058a28d7641e37a06a5cfa4b290e70d77efb80e00312363ee5adb9e502fa32ad1cf661c18ac9581d1fcb2f83e7cb6429325458e
SSDEEP 96:klpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:klrAG7Iw9ftFqidn
TLSH
T1B213350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB104259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 0466f4bfdcd562ae6eb2e543f4c7902a7a46da64cc9c6ddeb2223eb7cfbd316b
MD5 f8ca5380bff5defeec98c500400e9220
SHA1 1f833582ee7ad7df1abf0850625f84d04c298ac3
SHA512 da6bf47e93f897d1055b86e5531ebde5096a08d53845bf9ef8f2b482cf46ac2ec61bcd3e7400ff6e08fabf15a74a962186e9ca279372cc4640dccdf867936960
TLSH
T1EF016BA6C3E4C67D8A4116E066347817CD2E051A92283D37CDEAFBDA57E2071D11164F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 4816a2c841e304064287acbf15238d93caf08e581d2e727875f3d0ec53f55e3c
MD5 d7619584c21ea18be444c2b197d2f12c
SHA1 3ae43a10d98ab7036b97ba8d4373c2c5da7c4ba5
SHA512 76b7925160e0b0849f2efe9c1f6c8cfb95c15a3f8eadebf12aea4f8c035e66ac2fc5c489ff07ad6da483b52821bdeb6fb4e4d4e1c35975434ce161a908e0eb9c
SSDEEP 48:T0IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB/K:YIEumQv8m1ccnvS6i
TLSH
T139F26CDE0B18B614C4E49578E6D409C7BD3E142D8B96AFC59EEC06F1FF821B2A538115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 e63acbe758a48be6711f5de3f2c23ad8c7f3d55f906263062e67a90bf48ada3d
MD5 7cba527fbb7606a3ab0fe7a976803a34
SHA1 990b6ef5238c861369e057938e4fd5e01eec57dd
SHA512 af81bcd390c091cab98f6b4e939486f220f8da8a209c957109ce3ed697c2b0b3aaf5f6636e4970c67d8dec09397403974327114211dfaf8230603d58555a0a8f
TLSH
T173E068AB803EE46B10685A671980BC822F3AB234414094E8C59380ECA0804B25A13422
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Network\TransportSecurity
Size 354B
SHA256 bb32de63d3df1a08e7c5e7afbfc9ac09842ef3c3df8e70654fc28d81059517e7
MD5 3db8906f2622aed0d0a3979c07dedd04
SHA1 25326b54d5564c5e100075967550564ed7200443
SHA512 e8c054f4729580219510ca94833f17a2997a381587f4c39d85a233498f0df886db6cd024693d20120a6e02674c11cec3540175413b2e2b5d0b32ed0fd8794a77
TLSH
T18FE0C0F7803FE47F10681A670A84BC967F36B2305241ACF8C55340ACA0809F35E02833
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 4b637937fba0531e24b69def2e6e90dcba7eb94626eb61dea873182f18132f3a
MD5 3ef92c98af2edd527418e4cf6b770da3
SHA1 72b6c874f3e9a9669b1488586662ec12aaa3e741
SHA512 3f45e3ba03017160bea42c74a50b848527599b46eef9c58dc87ac90193dc50dbad3915acfdd20ac399edc940307b3b75462fb1b01a406f2d108bd9f6fa66a715
TLSH
T1F1E0D8B7907EF96B10685E7B4984BD426E3AB636815098E8D95390ACA0815A69A12422
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Preferences
Size 6KB
SHA256 31360369367441682983c2fb46c2ed385e0a573d10d3fef8f50a1e175d19851a
MD5 a8715830ec504b277c61d55f8aeb2aea
SHA1 d7a7a15aace6dc924bf6f652060cc18d15a4e3cd
SHA512 3f892b36c08ae91a3dc89ef503eee0d8194cc6f68f5a1269d1e9583410a9d8a0eccbb35d2f2f00806e29ba4a62a29bad7d9d48d6480eb628a4df317283443121
SSDEEP 96:staS/dy5+ybD2k+0do5h16Z0Es7/x+6MhmuecJawOdjeSK+g+T28XM1C7K:sthMcWonEsV+Fdaw2juYG6K
TLSH
T1FEE184055F28B97B4C86E518FB39BA17E3F9506274D51E48EBF8896C08DB6CC6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Preferences
Size 6KB
SHA256 cc3d317015a341533b2f983ac88540ea7aeb5531e6063d5956f86ba4b3699e8f
MD5 30e3e0747009a18007bb905a4caea9b5
SHA1 53e98435ca9bbfbdc1301623f0f72d8d644ef0bc
SHA512 7e637cec2f178f933a9b41374546bbffd9202af29fb05a9463ae8963e9b2146462fcc58a8a079644d0f7a7bfab0bd470cb6e28695df4f282ca59d119ca94d82a
SSDEEP 96:raS/dy5+Nb92k+7do616Z0Rs7/x+6MhmuecJVS1ejeSK+g1NI8XM1C7K:rhMNto6RsV+FdVSQjuFg6K
TLSH
T190D197055B28A97F4CC6E508FA397B17D3F9506175D61D48E7F8896C08D76CC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Preferences
Size 6KB
SHA256 1741786b89df50dbf5b720c0abf2cabcdfb015f7cd94cf1039ccb1de5b91f872
MD5 963990ea8ab2072e78ca0717f22336f2
SHA1 44cfb9dbec9e24296b5e22f11055d0dcbb33ae12
SHA512 f35ba3337ada45e603c08f24578eaccdb77496452a545698d5d5aedb21f8869e044a94a6e71c430340926cafa2f7077070c77743797f6d0f8d3d85de18192a95
SSDEEP 96:staS/dy5+TbD2k+0do5h16Z0Es7/x+6MhmuecJEtMkkjeSK+gkQI8XM1C7K:sthMlWonEsV+FdEtwjuhg6K
TLSH
T1D5D175065F28B97B4CC7E518FA36BA17E3F9506275851E48E7F8896C08D76CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 a51bd732a81fef9d9f87d7c1b379e6b3620f5c005e4047aae0670fc0fbaf2b6d
MD5 1fe00ddefb89d60ebeaead6afb299935
SHA1 2cb6c49388364d44e0576e2c5965a07928c6adac
SHA512 7268388b83b92dcef757c0b964d163ab42c88249b8ecf82f0a60255eaea0c0ba4ecf31ec76049ce6e250390cb41bb89469361e9fee9227467c70d2b92bc261fa
SSDEEP 96:v6iGPlf/ROo1pkF5d16DinZ7VaTEv9V5h5pg5+e02VUTvHG7jcXUPGOJ:/qvQ/9lWVUTv3XU7
TLSH
T10BC1C5A7462DC574AF444AEFDC397ECF9DA600DF88CA4C0A92E2C5880AC1EFD11DA495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 6c88aaf0b1869332345daacd409d1d2872fce17e3ebac0d09e94b779c3a2ba5e
MD5 f893c85251d875faecd75da79e1eefd1
SHA1 4e17181b239fabae1e86daa4add086f65c227b37
SHA512 876d6b05a0384776aa868ca272bbe74320740dc0aa937a46b6ce09b3bc7c00a3d5e502b36b8798b0dc0d0bf1bc35227eefceabd8f5dab72fa8f323646c19406d
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Site Characteristics Database\LOG
Size 289B
SHA256 97ba26a3de156d35385448699b076dfe54a7709365f246b75498a80dc957a241
MD5 09ed4fe4d27872e5f349c5b39a7b3e2f
SHA1 4d912b58653af2e5ee8ee0a9b05ec42c3168c6b5
SHA512 3b6da16c6bba5e247a8a79ad04df4eee2537979b90720c1dbe7fbe6a2deaa060d28878f0b058b9b35fceff181a5cfef647081f21b5e32323e9a7e693d2d725c6
TLSH
T12AD0CD201AC9C67B56C544FF617BE30DC7697004E9D959362E15FE48211754C7442681
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Sync Data\LevelDB\LOG
Size 267B
SHA256 cc1a945e242a7195304f19881c2c38c793ab0b008d01b9d6d53b50440827d1d6
MD5 77f91eaabcc7e4ec39d3c125bbd8e984
SHA1 6c6ea594a683c0661650c71590e0e7bdfd5e7a95
SHA512 4ccbe540204fddecac7839c694fbecfa7215142081c3d199400ed06f3d0e2e76f68ea49d96fac8a85dcd9cb129e1aa1ad9b01d82159c52fd00a97e0ca1bc2f8d
TLSH
T1FDD02B3049C5C13A09C484E741BB631FC7BCB805E7C67A095F04AD08380710D78206C2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Visited Links
Size 128KB
SHA256 e2340fe24315d3622b0352dc24a386c04571bcc7c1c53514fd17b534e056f7d1
MD5 ae1b9ad25979c1f5bd05686cdc067ec4
SHA1 ac66c30e648021e940b5c848863aede0737d5a96
SHA512 873d429f6d63e48918ad391f7c80b0579592aba21c374a1f9d69cfe0ae4a0a5dd9acf7b2eb9fa1b939cea05fc4218967046b90e18ccfedab0da4e0456a3a7f51
SSDEEP 3:ImtVuCEiwFw/:IiVuC7wG/
TLSH
T148D3041455433C13C04C01304544FDFDDC30C0470011001713F5457545440174F3743C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\shared_proto_db\metadata\000003.log
Size 392B
SHA256 2e33fce241d68f833cb53355f0cf6c0198ec539f7e2242fac69ace74da9a5431
MD5 75857115a54ba3c29175c92af0ce9918
SHA1 2d8c6a749bddd9288fffa7d32423c5676e159781
SHA512 09417ec8f8fa274bf3dc7074efcf9a4a747519a35d5bb317c206534cdd96a1f38b1e15ecf1dad80185ef962bb7dde4a0e6be19fbc7236faf1ebcce13af27c562
TLSH
T12FE0C206F320D000D109D23AA435A7226334D4819FB8DD0F483A54152F715051DCB7E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Default\shared_proto_db\metadata\LOG
Size 281B
SHA256 e58e1b32d0d7b5c412e579099c070bcaefb93f74781031bc42e2abf2e9f74513
MD5 ab4838a6fc96df9c5d585b180e8b4a75
SHA1 c1feec1475eec286280d91d5a85632a80f235ba8
SHA512 f878532f000a06e0e7bb01a7d1f1a1c470dbaae995c6ca71eff898992640b3cf0b4c90ed79d750ace1f125a6a8dbcc319b3c41ea6c4c8afb931017e596d821c4
TLSH
T146D02B00FC99C0EF459444F710FB938DC72D3845FE846E0A0E41CD0C181710EBC09283
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Local State
Size 16KB
SHA256 60281687fdb0fe3bf9cc4a0b0016165b4f7cd4008cd275518c630e6c37048dc5
MD5 604445399b824c00a82943d214251cc2
SHA1 94a0d5d55ada4d755db712a92cfaabb8c60784a0
SHA512 865a5abcd19d5c59ebf97b9f67e07dfc50d888b4f0698cb0450fee9cb1b7f48e47317e73005c7fdf4110db754b02dc255aa1fd6efd0034736c4b7d020dc479ed
SSDEEP 384:J+aQikB+z/xvxjg/qhE+NBSOXW5JC4L+qj1uEB:0/UxvxjgC+omjCQ+qT
TLSH
T1C7728D2B19796E2799F3E941B95E074BCBF89472D4C26EA48AFC4F0D06C739C0346C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Local State
Size 2KB
SHA256 e285f765e00b8a8d99f9703f84a70120d2955a7633d280685c8ef6c9415ee288
MD5 14298f255e7cff5121f1165c54a2275b
SHA1 cb7b82944a8e7e140e2f2410a90f2bf9a4c7ddd1
SHA512 08e6f753d1ecf579b4c6ac64ea67aa4cdea6bddab2200edb947c4480f19a6a8b7accbf514c58f3ef8927d98fc0f5833ef12fb00250ce796a26806660261bdc79
TLSH
T1945175337928AA3789E29E45B94E2A179F7550A2EE532F1096FC0F1801C614C5756C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Local State
Size 3KB
SHA256 c18bf8fcd5dd8ae51fb83efb73053c23423e89d3631db7a2defbf92f2d1ce545
MD5 3d7bffe8260f3c2fadbf2d35f9655ee2
SHA1 a2ab3706382ecd84bfb88a0e47ec07fda6a9bac3
SHA512 1b8b0a714fe5c87fca9866bdeea6ea50fb07aacc88d57f24d76a263be9fe1fbd7fb888807ec67d1494b8ba94c9ee3df49f2f004e9cc90672b6e9ac755273448c
TLSH
T1DD6154376A38A93B4DE2DE45B98A2B17BBA55063E9863F54D6FC0F1C01D728C1352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Local State
Size 3KB
SHA256 a66dd8dbc46698a20b02214505f9a48f5290670219a692e27247dfe9d94f395b
MD5 671b19a9a2e923f71b5ad7b38e2f4fef
SHA1 8e7c0ac04bad0a8714140a7d4d358d34b2c51b23
SHA512 c3e6f28b6f7d15fa47c2299d5cc38eaf45bbd9e9f0472c4641826a498c8713a48629854e2fa114dd4788b32e12521baa0c51eedc242c5a1ca99801bf07c77c18
TLSH
T1B98194337A78A93B4DF2D90AB9862B17BB645023E9867F94D6FC4F1C01C728D1346C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Local State
Size 3KB
SHA256 022af4e9d36b8c863b079fe58ff4f983931705825c66e31d89a14d50219ba9eb
MD5 8494d40f5e10c31906e6a0febbdea68b
SHA1 58169580f0255aa5723bede3fdd0593c9620498f
SHA512 89d92b15e8777b3f26ceaae8d0fedb2d0f5b6d3c6c6da82827c4713bf4498aaa84efa073554161a3cefdabc7eb6c1d13447314fd179e1a16a90fed7b1d1e8944
TLSH
T1E58184377978A93B4CF2D905B9863B07ABA49063EA856F94D6FC0F1C42C728D1346C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Local State
Size 16KB
SHA256 77a1299b4298d16e4839abc0ee85390ab20f452839316641e55dcb8a415d907f
MD5 83ed3621d696102a40bb5b7cf0440367
SHA1 c47ea93ee6910d92690f383b197ee28770ae0bdc
SHA512 35c8f6535c63c5950be59c49a62947c9c12e12a181209a3bc6d982557f5916b5ae37ef939e6beb4932050a3087517ff4639e502f538abdcf3fa6a9ac660db2c0
SSDEEP 384:x+aQikB+z/xvxjg/qhE4NBSOC0n52W4L+qPuuDzs1uEU:8/UxvxjgC++1UWQ+qb
TLSH
T105729E2B29696E2799F3E945BA6D074BDBF45473D4826DB48AFC5F0E02C72980343C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5969cc.TMP

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Local State~RFe5969cc.TMP
Size 1KB
SHA256 ace5efea0bd96288b15c902feb5e3c93f0bc28fe82d59475b3a2d2c50a9a52b3
MD5 95158a90797f52826d27ca7c2492cb40
SHA1 ead55a94dadcdb80faaf2744e18e4cbefb968f02
SHA512 9cc235d0f03edac66c0a6824ae79f351c7839e1949f1d0189944359b37d2096e8cdc1a912a5f55442ba6533151049fb445582fdae0e9617460e9ce5b63d06905
TLSH
T144216573A6285B329C91BA86714A6A5B6F304077C6414E0462FC8F2902D614DD57FC3A
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\ShaderCache\index
Size 256KB
SHA256 00ad9de1e1b7cc043692125e51ae1163c7a11731b60249bcfd163efff512258e
MD5 042367caabdc629e7e49c30d4f6c8ecb
SHA1 36eb3b229704d3b871339cf4e2ed0f4d913d6813
SHA512 a4c731dcfb3fc55c593df2325564b7647cfa92dd954d8904aa9c0a2d9d6fa71113724b4f1924e789174196961f9edad6ad4406568d609b8af030323f4381eea7
SSDEEP 3:LsOllllklkXlx2Sd:LsUlPwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Pulse\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Pulse_update.msi

Path C:\Users\Admin\AppData\Local\Temp\Pulse_update.msi
Size 7.6MB
SHA256 0b7079edcb7a9025d8adedb15fa966add6809338df02cdb5d5ee2bec2292a512
MD5 0047bb030baefac9c40692308403fa6a
SHA1 df920e45116d74be9a9c16b1b5249e32d5066dcf
SHA512 f1fb131aa9283ca0c584288c529a41b19da9ecd8c4815148fb5fe9fc49a5e84b45c4abfcb6f1188bb973620105b8d70429190676407eb295753916f6765fbb98
SSDEEP 196608:miqC0PwupB+bV+zkMxGKAAevJnVkHWVwIcmBc9x:IDPwED12AwVVkHWeAc9x
TLSH
T126863303BC046B31D96B0C3A4A7387A28F38FD609A0195476359B54DEEF21E1DDB6CE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pulse_update.bat

Path C:\Users\Admin\AppData\Local\Temp\pulse_update.bat
Size 280B
SHA256 e572b129279676eab749330c4447e3fab610097e0c35bc0a0c8f62ff44a36ee1
MD5 b4bd44910fcaff38aac1c2152063fbb4
SHA1 1a21922af54365e01fb64cf61c586f9409a2f51c
SHA512 d7e0ed871e1682848817b504227308209407599fcd9fc196cdd1e095a92d0e4490e29bf8e7ace839408ed31e822eb0e2d46f0bf9d8345e195d1ee0ca681cd4a9
TLSH
T1C1D02B03C686875D5E27B00B04B92ACDA057248CAF0167D09365C55E3A9745DFAD5B89
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1124-418-0x0000014F74810000-0x0000014F751B4000-memory.dmp

Download

memory/1124-524-0x0000014F74810000-0x0000014F751B4000-memory.dmp

Download

memory/1576-101-0x00007FFD82E20000-0x00007FFD82E21000-memory.dmp

Download

memory/4640-26-0x00007FFD82E20000-0x00007FFD82E21000-memory.dmp

Download

memory/5932-625-0x00007FFD81B00000-0x00007FFD81B01000-memory.dmp

Download

memory/5932-624-0x00007FFD82700000-0x00007FFD82701000-memory.dmp

Download