darksiderat | 89ca755e300aba35be0fecfafc4ea2d900109264400ab2a83a2556de75738a68

Analysis

max time kernel
151s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 17.8MB
Sample260924-pkrpmsvtbs
SHA256 89ca755e300aba35be0fecfafc4ea2d900109264400ab2a83a2556de75738a68
MD5 252261264df5db520d81970aaf9bec67
SHA1 cd22f7a5db1f40cf175db1e13bf819f2ba3af4f0
SHA512 c8fb4c92c0b7ef951a2fb2c0688a972d3a258c2e518719242acbcba77eb29806ae6a040a5d0100c1334f447cb81941731580f7f299a353dfb932bef6e16c7e3d
SSDEEP 196608:waRf5JCikhg0ONIoKCNFt8J+6sULM2e52eCqU6Tq7lD9kY:w4NL0ONIoKCNFt8J+6sU7gZCGTq7l5J
TLSH
T1B8170921BA6A596CE046C4B4838786729A7130CF0B3579FF44D482393F69BF95F3825E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 4 IoCs

resource	yara_rule
behavioral2/memory/5228-2-0x0000000140000000-0x0000000140013000-memory.dmp	family_darksiderat
behavioral2/memory/5228-1-0x0000000140000000-0x0000000140013000-memory.dmp	family_darksiderat
behavioral2/memory/5608-4-0x0000000140000000-0x0000000140013000-memory.dmp	family_darksiderat
behavioral2/files/0x000d00000001c4d8-35.dat	family_darksiderat

Detects executables Discord URL observed in first stage droppers 2 IoCs

resource	yara_rule
behavioral2/memory/6040-8-0x0000000140000000-0x00000001411E5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL
behavioral2/memory/6040-244-0x0000000140000000-0x00000001411E5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/memory/6040-8-0x0000000140000000-0x00000001411E5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/6040-244-0x0000000140000000-0x00000001411E5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Executes dropped EXE 1 IoCs

pid	Process
2120	ox_1790252631304.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	raw.githubusercontent.com
23	raw.githubusercontent.com
24	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 6040 set thread context of 4240	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 6040 set thread context of 5228	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 6040 set thread context of 5608	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 6040 set thread context of 1148	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1281031349\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1281031349\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1281031349\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1839654228\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1839654228\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1070769036\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1839654228\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1070769036\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1070769036\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1070769036\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6084_1070769036\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\rewindlauncher\shell\open\command	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\rewindlauncher\shell	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\rewindlauncher\shell\open	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\rewindlauncher\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe \"%1\""	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\rewindlauncher	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\rewindlauncher\ = "URL:Rewind"	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\rewindlauncher\URL Protocol	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\rewindlauncher\DefaultIcon	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\rewindlauncher\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe,0"	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5308	msedgewebview2.exe
5308	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6084	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6040 wrote to memory of 4240	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 6040 wrote to memory of 4240	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 6040 wrote to memory of 4240	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 6040 wrote to memory of 4240	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 6040 wrote to memory of 4240	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 6040 wrote to memory of 4240	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 6040 wrote to memory of 4240	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 6040 wrote to memory of 5228	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 6040 wrote to memory of 5228	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 6040 wrote to memory of 5228	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 6040 wrote to memory of 5228	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 6040 wrote to memory of 5228	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 6040 wrote to memory of 5228	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 6040 wrote to memory of 5228	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 6040 wrote to memory of 5228	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 6040 wrote to memory of 5608	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 6040 wrote to memory of 5608	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 6040 wrote to memory of 5608	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 6040 wrote to memory of 5608	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 6040 wrote to memory of 5608	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 6040 wrote to memory of 5608	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 6040 wrote to memory of 5608	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 6040 wrote to memory of 5608	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91
PID 6040 wrote to memory of 1148	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92
PID 6040 wrote to memory of 1148	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92
PID 6040 wrote to memory of 1148	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92
PID 6040 wrote to memory of 1148	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92
PID 6040 wrote to memory of 1148	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92
PID 6040 wrote to memory of 1148	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92
PID 6040 wrote to memory of 1148	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	92
PID 6040 wrote to memory of 6084	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	93
PID 6084 wrote to memory of 4312	6084	msedgewebview2.exe	94
PID 6040 wrote to memory of 1732	6040	2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	95
PID 1732 wrote to memory of 2120	1732	cmd.exe	97
PID 6084 wrote to memory of 5904	6084	msedgewebview2.exe	98
PID 6084 wrote to memory of 5904	6084	msedgewebview2.exe	98
PID 6084 wrote to memory of 5904	6084	msedgewebview2.exe	98
PID 6084 wrote to memory of 5904	6084	msedgewebview2.exe	98
PID 6084 wrote to memory of 4428	6084	msedgewebview2.exe	99
PID 6084 wrote to memory of 208	6084	msedgewebview2.exe	100
PID 6084 wrote to memory of 208	6084	msedgewebview2.exe	100
PID 6084 wrote to memory of 208	6084	msedgewebview2.exe	100
PID 6084 wrote to memory of 3688	6084	msedgewebview2.exe	101
PID 6084 wrote to memory of 3688	6084	msedgewebview2.exe	101
PID 6084 wrote to memory of 3688	6084	msedgewebview2.exe	101
PID 6084 wrote to memory of 3688	6084	msedgewebview2.exe	101
PID 6084 wrote to memory of 3688	6084	msedgewebview2.exe	101
PID 2120 wrote to memory of 3244	2120	ox_1790252631304.exe	102
PID 2120 wrote to memory of 3244	2120	ox_1790252631304.exe	102
PID 2120 wrote to memory of 3244	2120	ox_1790252631304.exe	102
PID 2120 wrote to memory of 3244	2120	ox_1790252631304.exe	102
PID 2120 wrote to memory of 3244	2120	ox_1790252631304.exe	102
PID 2120 wrote to memory of 3244	2120	ox_1790252631304.exe	102
PID 2120 wrote to memory of 3244	2120	ox_1790252631304.exe	102
PID 2120 wrote to memory of 3244	2120	ox_1790252631304.exe	102
PID 2120 wrote to memory of 3244	2120	ox_1790252631304.exe	102
PID 6084 wrote to memory of 2968	6084	msedgewebview2.exe	109
PID 6084 wrote to memory of 2968	6084	msedgewebview2.exe	109
PID 6084 wrote to memory of 2968	6084	msedgewebview2.exe	109
PID 6084 wrote to memory of 3740	6084	msedgewebview2.exe	110
PID 6084 wrote to memory of 3740	6084	msedgewebview2.exe	110
PID 6084 wrote to memory of 3740	6084	msedgewebview2.exe	110
PID 6084 wrote to memory of 5308	6084	msedgewebview2.exe	111
PID 6084 wrote to memory of 2832	6084	msedgewebview2.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
  2⤵
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
  2⤵
  PID:5228
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
  2⤵
  PID:5608
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.2.6 --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6040.988.9823096924741596197 /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\mars\EBWebView /prefetch:4 /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\mars\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe50ba5fd8,0x7ffe50ba5fe4,0x7ffe50ba5ff0
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.2.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1592 --field-trial-handle=1752,i,2920238398434847432,6254163641449329660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.2.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=1752,i,2920238398434847432,6254163641449329660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.2.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1752,i,2920238398434847432,6254163641449329660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.2.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3380 --field-trial-handle=1752,i,2920238398434847432,6254163641449329660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad /prefetch:1
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.2.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1752,i,2920238398434847432,6254163641449329660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.2.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4552 --field-trial-handle=1752,i,2920238398434847432,6254163641449329660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.2.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4544 --field-trial-handle=1752,i,2920238398434847432,6254163641449329660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.2.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4420 --field-trial-handle=1752,i,2920238398434847432,6254163641449329660,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5b725d310117ef0cbf40f72fc374a9828b99ebad
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1790252631304.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\ox_1790252631304.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1790252631304.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\System32\IESettingSync.exe
      "C:\Windows\System32\IESettingSync.exe"
      4⤵
      PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 d53014fe15e67bcade69109456728880534bf9db88be37d120beaae58810870a
MD5 69833b80b3f41d02c897c69c2f37de82
SHA1 3abd9b852e26a6f213931d5d0d57e9baf9466940
SHA512 9219c02d68ff6b970a14b6feba335d0df6c940f7cb5a4bb1f89a4cdabbcdeac1988f90a46f963b371f9dee235ad7a6066604e0b16347bcf0437e3c5dc5d2722e
TLSH
T1D031E69E8FB23490BF405E132AD9D9323DF222829CBD400B5232A8DA2A503517F5BD1A
MD5 SHA1 SHA512 TLSH

Submit Download

425F9F0DB4A6739FCA824D9831E2A9A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\425F9F0DB4A6739FCA824D9831E2A9A6
Size 71KB
SHA256 535ca29da8cd53fad58f526456c336c3d4c4b109b6f2b1761570aa603819216b
MD5 0fd3179b274396cf45723a6b721d2868
SHA1 f5aa7e6b55bd2ce7a713a89ca949eefe86575d07
SHA512 e21ebd2514767eb0c8bce0829beb0902e5e6fc20632703fa51696ac0be73cf354327fd565ae5a5ac94f2b6971415c23e2365cf9a40a612764579f4b363bcad62
SSDEEP 1536:SXsYn/X/CyeB8Fv0RRMmarOa2V+atstw3h:SXhXVFMM/gV+Di3h
TLSH
T1437383A07EBCE5A017CACD3200D497539DF9B5EE24E2391C82366640164268FEF77B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 64fc92565af706096b14e955abe186843afadeebd60797a6e38fc72d027f37fa
MD5 62866226bb379a7223c3467c7cdab507
SHA1 49f8285b5918b0b554b6e7c294702f0177451e50
SHA512 d55f6f7dabeff7923358650458d90592dea268145e30388a863d3ebedaa9f4fca3a885c56d1e1472bfc35176f62d1e3b44282672eef86f237f05f66e98098399
TLSH
T130C08C2C1EA20A17F2A8437C02C13A039B208101E2818F052AF17A08CD96B162C78C2A
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 93b78dd5eb31a5cd59f318b9b051fc33345a5ce4dc1fadc0bb63173acb0b0816
MD5 1b43691430dce5999fcea9f3d6578c8c
SHA1 4111e50d5f64c7fdb0f529114b78daf9f045257b
SHA512 95e07e9ddc59c3efbac625b5256047e33ea14e9dd60c154716432320a9603c34ef7ebe9fbbf3237f738895f2c342ea4b834b8dc511e624f26c606f6e2c107681
TLSH
T146E02004197A513CF430C93947CD76A7076EE215344502F01E949709F74AF517D629B0
MD5 SHA1 SHA512 TLSH

Submit Download

425F9F0DB4A6739FCA824D9831E2A9A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\425F9F0DB4A6739FCA824D9831E2A9A6
Size 192B
SHA256 556e8e3b5a83727735abbd54113493d5a28d5bb4a9b62f20fb840116558890ad
MD5 f0f82d9e46b6b8afcfc6cce1f481271e
SHA1 74394bbe893b798830f4df0747fbcb24b2a2e24a
SHA512 9a6ef849abcf9309c63858d04a97edc506afcd9f5d6ad19beebb0f44ff058b6484eb19244ca3de8c0c04daede31e3f4dc6d8e50c06f9d7f0dbebafe4d305882b
TLSH
T14AC08C052B10D22AF048013ECF80670517F4E749D342FA504BB07019693E9422C60E06
MD5 SHA1 SHA512 TLSH

Submit Download

ox_1790252631304.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1790252631304.exe
Size 56KB
SHA256 0d0a91c58d930d76a2600f1b75965a4edfb63357284c5965fb3b3f08266f0237
MD5 68ddf5f041cc9d80252e243352728396
SHA1 fb5c316bd6f4411aec73516adb311624e707d83b
SHA512 9f9a0bc1bc25f6eea49ed3f9a9e0025562ff6865e06d6c08917b182c8017aa3afecd23ea4a622e713a0430909b8dd992d0a9b33e97c8e4e7b8edba16f7c3463c
SSDEEP 768:Eb9OnCKoatcLZBTjwFrECxGazpOWp54vg5d5YP98yxA1XbXP7kW7rCVr8Z0kP:I9vatZ5tsWp0g5rBSmLYW7rCVoekP
TLSH
T13043F834EA5AB06FD35ED834DD430D16CD12BCCA97A0BB9B57915CD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5d710d8ade596dedf8a9d5ed636d6f593d08f305cb98507fc1247a59db65ee99
MD5 c0547172d0c51d98ce42e93db04668a8
SHA1 f755288831e341779c65e159bea5de6fd84f08fd
SHA512 18c3c8f227f1a768de7c6793509a1923f07a9fb6de7145906df49ad760ac8b4f4db99d92d0a977d21d0fed001c18b8125a790762cf50c6b4b1ce8d20e9aff9f5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5e65946a266b0f1fd6447ecd49a423f1ebb7f4fa06be99ac92c1da9cd578e995
MD5 715a64b7dcee994f9f25f2ee24613602
SHA1 9e810e63016d4154d69de14b0001b963d2bdd9ea
SHA512 f8afbe83602768645b9208a4c2018f374dd77c5ce20095948a18562a73f5fd3ac66116bac8d0fac1db6c9d84c63cbad96f6ede9e9f127ed51c9622cfb0132e33
TLSH
T186D0121377014338C43022B33003650C0404D50B8009D200943C851D1B054902A07441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

90a121d2-1d4d-47e0-8ab9-ba6ba469f24f.tmp

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\90a121d2-1d4d-47e0-8ab9-ba6ba469f24f.tmp
Size 6KB
SHA256 6d38c5bca9df8dfd28555566f686a7396137e14b8e7a7938e045762a5c8e2ebd
MD5 2adcd085702155fa9ab0bc647d80779b
SHA1 c4e5e78beac43e396935be706731fe1eeb8c25d3
SHA512 d4bd68392c12f873882febd6e6f4a3bccc78f265150320ac9f8e41389f265c8b0c9fa80f46910849b111c52f2ba26b06d8b2abc62481ca5ebab7234b914f77ae
SSDEEP 96:st7/d/E85lb9lkhVo5h16Z07s7/x+6MhmuecJap1ejeMcK+gf/Z28XM1C7K:stDFfoon7sV+FdapQjnPG6K
TLSH
T1C6D1A6065E24B9BB4CC6E509FB29BA03E2F6607270D51D58E7FC462C14DB6DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 71e858db0885b9e033369953827edff520354f9e251f85300bae25aed085390f
MD5 d0d97e90fcfa2531d5321258671d579e
SHA1 9585d5219b5d29964d57cdbbdb75911eddc9b212
SHA512 8f6ec13eb64b5a64cfa5a3decdb41d43c2b2ed7a80dee524980844c1e00177ca7f175348481ebdd203b7f67896f1fc09f8a721ea1c4ce9651df2b320abeb4e9c
TLSH
T1EBA002511654080BE1556B7C13C52391323269184A530E0544D19C76CF917D1C361964
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595fd9.TMP

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe595fd9.TMP
Size 48B
SHA256 c311930ba7db05e705c4db289cd742919c3f6d657f11d72acd80c818fad73e4d
MD5 ccc2c5160c3954c69edbbcf4ec822ea4
SHA1 c862045ec68e2ee1857c68ec18a8f3ae4a22d947
SHA512 bd523b2cc5925e2c77f9cc4a2bf6eb0a769c14412a6d891394b813e7676686a0ccd344a4a99c9b334467a8e03fb0455035ac8238b290a9c8e00b7221348dd96a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Network\Network Persistent State
Size 960B
SHA256 1a91a7270e0272f46039708b9ac1d553bad137139770167dbd7e6da6c74d2a04
MD5 5124b59a47af2c009eaba3a4f8f72326
SHA1 95d668c958c89a80b09accbc0cba64d40a0fecac
SHA512 7af850bf2409a1f955304fdeb2971f17a579264ed0f13161e6b0f32844437593e7843729b7af1941e38c702c6f0d6d3a916ff63edb93aaea5b60927348db8633
TLSH
T12211B1A283E4CA7D8B0166E027343C17CD3E051992282E3BDDEEEBE957E1071D12064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a22bc.TMP

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Network\Network Persistent State~RFe5a22bc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Preferences
Size 6KB
SHA256 e7b44bc1abb46807b489fbd0e22fbe51f94819efabfcb7a1d2d5b8853af77758
MD5 0e4e23b2c66c3280fe46cbcb4fc2dc6e
SHA1 83ce6428c9a458a006db96e54b5b6ddcf45d3daf
SHA512 6baf5f07a19b8676e846b18bc9fd5e569a8b513cc7b0f89f709e18eb38c5cb15b16baf11b896ca2c8c24a933e0e21001cd5b636f5685fb9cf7d4ae8c0e744c7c
SSDEEP 96:st7/d/E8QGlb9lkhVo5h16Z07s7/x+6MhmuecJap1ejeMcK+gJ2Z28XM1C7K:stDF9oon7sV+FdapQjnEG6K
TLSH
T117D195065E2479BB8CC6E508FB29BB13E2F6607261D51E58E7FC462C14DB6DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\mars\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\mars\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\mars\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\mars\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Local State
Size 2KB
SHA256 a2c89140219ad32bf1746eef190706092954d6061e0bf410fd34841bc3664b5b
MD5 b78b1c3c214edb4fdb10a2a55c3d62e2
SHA1 7eacbd3af55a60ad931830c7f548e162c3086e3a
SHA512 6fce3977aa185b62776e0e258406bf872a1ef5a029cd1de1a8d747cbda8910f648673710d9167d4d742f1721084e95e2911fece97c70070547b3537156b5055a
TLSH
T1775198336914AA3789F29A08BA8A7F13CF755166EA522F61A9DD0B0C01DB64C3353C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Local State
Size 3KB
SHA256 7ba7e999ae33588eec429ce37ed23bf50126b5cabdf4d728f740397f191989bc
MD5 8ab9542d813732a5b6e0e758d05e1443
SHA1 7bdaa63330a724ce30b3f46fdc2aa2dd9b56fbfc
SHA512 dde59769c15a0350d4560fba3679bcc377338836a89e2bcbe5d54e759005778b3a710984fe8915b5bd9ec5d4b1e2238705ecbd915e020e805995346ff0c8fee0
TLSH
T1CF71963B5964E9378DF29904B9863F13AB955127E9817FA5E9EC0F0C01CB7882352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Local State
Size 16KB
SHA256 4cbf3ef888030e299293fd833c22ab84f369aa0df9dabbc541aa6a122986a122
MD5 f314245d5a3570df48efb5f0ed975ca7
SHA1 5eb77120901597cd092d368e692bf43042d9f742
SHA512 48f69bd3d4d5404913912f717fb44c897f7be8b73c3a5367bad5633bba247187ad954e1fed8946c195b506ed7509d44fb05c62e8b9f7f78105a9ab1d62677973
SSDEEP 384:R+aQikB+z/xvxjg/qhENNBSbZAGVm+9za:c/UxvxjgC+VEpFa
TLSH
T135729D2F95B8BD2385F3E505BA491F8BCBB898B394826EB449ED1F0D06C73881303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590dc2.TMP

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Local State~RFe590dc2.TMP
Size 1KB
SHA256 becef99ef1915f45726668b1a0ffcb42c194eae41f3bc5b948d9318f56abb4e5
MD5 614acb4e516e1d5093c8e21f4a02efa2
SHA1 869b9422d392ed29f47f2381bc18ea90be713f1c
SHA512 b828527b2c49b7dbd3166604f86b34225855782bc9b09021c0fc73f080cdbe75b8e2a94ab66f0d259e0a7283240b052df4bac1b7535729543dd79da2f2889b83
TLSH
T12D3174B79594AB328CA266066382BF939F60016BD1024F5175DE0B0C12DB54C763BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1148-7-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2968-312-0x00007FFE71B40000-0x00007FFE71B41000-memory.dmp

Download

memory/2968-311-0x00007FFE71F40000-0x00007FFE71F41000-memory.dmp

Download

memory/3244-224-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-231-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-234-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-242-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-240-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-245-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-222-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-243-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-241-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-239-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-238-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-237-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-236-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-233-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-230-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-235-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-232-0x00000295FB200000-0x00000295FB919000-memory.dmp

Download

memory/3244-223-0x00000295FB920000-0x00000295FB921000-memory.dmp

Download

memory/3688-115-0x00007FFE71B40000-0x00007FFE71B41000-memory.dmp

Download

memory/4240-0-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4240-5-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5228-1-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/5228-2-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/5308-368-0x000001E90AFB0000-0x000001E90AFB1000-memory.dmp

Download

memory/5308-358-0x000001E90AFB0000-0x000001E90AFB1000-memory.dmp

Download

memory/5308-360-0x000001E90AFB0000-0x000001E90AFB1000-memory.dmp

Download

memory/5308-367-0x000001E90AFB0000-0x000001E90AFB1000-memory.dmp

Download

memory/5308-369-0x000001E90AFB0000-0x000001E90AFB1000-memory.dmp

Download

memory/5308-364-0x000001E90AFB0000-0x000001E90AFB1000-memory.dmp

Download

memory/5308-366-0x000001E90AFB0000-0x000001E90AFB1000-memory.dmp

Download

memory/5308-365-0x000001E90AFB0000-0x000001E90AFB1000-memory.dmp

Download

memory/5608-4-0x0000000140000000-0x0000000140013000-memory.dmp

Download

memory/5904-51-0x00007FFE71B40000-0x00007FFE71B41000-memory.dmp

Download

memory/6040-8-0x0000000140000000-0x00000001411E5000-memory.dmp

Download

memory/6040-244-0x0000000140000000-0x00000001411E5000-memory.dmp

Download