darksiderat | 9e9227cd18ae952a7b95a1dc8f3587f3728d9717ed3aa3912f9d850ff8f09e94

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe
Size 14.5MB
Sample261027-nma91add35
SHA256 9e9227cd18ae952a7b95a1dc8f3587f3728d9717ed3aa3912f9d850ff8f09e94
MD5 952501994c439db1c5095aa66f7dc37a
SHA1 607bbe05b724dd527b7e263d00823be4fc1e364e
SHA512 25abdd439b9bb6e27dac8c75512ab83ec1aff50c6639061bbdcf16a9cc182712640cedaef15824c2cb7fcca13ce02f49a16f149fcbff37c28cb85c58e5af19a0
SSDEEP 393216:sVzFvL4xH2ihKKnbaOlYJ5URvLLjZWsE+:EpShKkaOlYJa1LLFWsE+
TLSH
T154E6AE03F39581E8C0AEC5B8C31AA637EB72B88D4521B29B5BE45F112F26F506F1D359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/1564-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1564-0-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 1564	1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe	89

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1254267026\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1254267026\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1433007839\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1254267026\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1254267026\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1254267026\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1433007839\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1433007839\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1433007839\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_2138178793\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_2138178793\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_587750227\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_587750227\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_587750227\manifest.fingerprint	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2308	msedgewebview2.exe
2308	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1784	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1564	1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe	89
PID 1304 wrote to memory of 1564	1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe	89
PID 1304 wrote to memory of 1564	1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe	89
PID 1304 wrote to memory of 1564	1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe	89
PID 1304 wrote to memory of 1564	1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe	89
PID 1304 wrote to memory of 1564	1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe	89
PID 1304 wrote to memory of 1564	1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe	89
PID 1304 wrote to memory of 1784	1304	2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe	90
PID 1784 wrote to memory of 5868	1784	msedgewebview2.exe	91
PID 1784 wrote to memory of 2720	1784	msedgewebview2.exe	92
PID 1784 wrote to memory of 2720	1784	msedgewebview2.exe	92
PID 1784 wrote to memory of 2720	1784	msedgewebview2.exe	92
PID 1784 wrote to memory of 2720	1784	msedgewebview2.exe	92
PID 1784 wrote to memory of 1268	1784	msedgewebview2.exe	93
PID 1784 wrote to memory of 5952	1784	msedgewebview2.exe	94
PID 1784 wrote to memory of 5952	1784	msedgewebview2.exe	94
PID 1784 wrote to memory of 5952	1784	msedgewebview2.exe	94
PID 1784 wrote to memory of 4264	1784	msedgewebview2.exe	95
PID 1784 wrote to memory of 4264	1784	msedgewebview2.exe	95
PID 1784 wrote to memory of 4264	1784	msedgewebview2.exe	95
PID 1784 wrote to memory of 4264	1784	msedgewebview2.exe	95
PID 1784 wrote to memory of 4264	1784	msedgewebview2.exe	95
PID 1784 wrote to memory of 2304	1784	msedgewebview2.exe	99
PID 1784 wrote to memory of 2304	1784	msedgewebview2.exe	99
PID 1784 wrote to memory of 2304	1784	msedgewebview2.exe	99
PID 1784 wrote to memory of 4152	1784	msedgewebview2.exe	100
PID 1784 wrote to memory of 4152	1784	msedgewebview2.exe	100
PID 1784 wrote to memory of 4152	1784	msedgewebview2.exe	100
PID 1784 wrote to memory of 6044	1784	msedgewebview2.exe	101
PID 1784 wrote to memory of 6044	1784	msedgewebview2.exe	101
PID 1784 wrote to memory of 6044	1784	msedgewebview2.exe	101
PID 1784 wrote to memory of 2308	1784	msedgewebview2.exe	102
PID 1784 wrote to memory of 3416	1784	msedgewebview2.exe	103
PID 1784 wrote to memory of 3416	1784	msedgewebview2.exe	103
PID 1784 wrote to memory of 3416	1784	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe"
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1304.5620.1681442582935230244 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView /prefetch:4 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff863f25fd8,0x7ff863f25fe4,0x7ff863f25ff0
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1732,i,9543084651424406596,14754576640465502887,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2092 --field-trial-handle=1732,i,9543084651424406596,14754576640465502887,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:1268
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2432 --field-trial-handle=1732,i,9543084651424406596,14754576640465502887,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3328 --field-trial-handle=1732,i,9543084651424406596,14754576640465502887,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4424 --field-trial-handle=1732,i,9543084651424406596,14754576640465502887,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4568 --field-trial-handle=1732,i,9543084651424406596,14754576640465502887,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=1732,i,9543084651424406596,14754576640465502887,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4568 --field-trial-handle=1732,i,9543084651424406596,14754576640465502887,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView" --webview-exe-name=2026-10-26_952501994c439db1c5095aa66f7dc37a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=1732,i,9543084651424406596,14754576640465502887,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0eb6f02d520c420b4f0494caf0125a55d2f7b684
    3⤵
    PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

state.db

Path C:\Users\Admin\AppData\Local\Volt\state.db
Size 8KB
SHA256 36e1537d6daa4977d21290c0c39d23b18ffd8790d4c2dde1e6f2aa38d0027102
MD5 a9e5d788a23352842fbe043a134e2b58
SHA1 da7f0aa2691ce7db47c137c38c2f513477865d01
SHA512 6856cfc309de660cee97a544fb0298361afc3659914a8f7d5d526298f4425ded60e9913eac224eea8d11b9b1c80075217046cf7d90fb92074267ff0c6286e139
SSDEEP 6:l9bNFlE9Yksm/0ur9FXGLux4v/YqFOnqfUbQdr:TLiukD/TrD+4qFgq8Er
TLSH
T11AF1226A47007098C8C02CF2A8628B731E3AD70BC6232DC3311C0000EF8AD08682DE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64631f96-16c1-4251-a0f3-7f1f0539692d.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\64631f96-16c1-4251-a0f3-7f1f0539692d.tmp
Size 2KB
SHA256 2314f345c0b01e161904c99263cc1a41b088ca285e53bbd17149aca8baa21783
MD5 d4c4b305d84c1b27192132d79e5e8741
SHA1 8cf1259ec5db0c1a2dc4a713df788ef52619f362
SHA512 a9df091483657686f82e619a73f87ab5aa19f6ee4d3cc969711d0cef2e28e93045433408da7848a5119a52b46aecde08a7626305487a2f63c1dec561d7aed4c6
TLSH
T1D6519433BC24B73B96E68B046D4A7B23DB7590A1DA921F1085EE0B0C00DB16C2346C3B
MD5 SHA1 SHA512 TLSH

Submit Download

6ba4bbe2-1af9-4eed-949d-4099a89b0fc3.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\6ba4bbe2-1af9-4eed-949d-4099a89b0fc3.tmp
Size 15KB
SHA256 131362b790700b87870d2bb52009a1b202db4667a0cc1ff68e56cf82fb49efff
MD5 fe3db869236671561d68fe702d3b5c77
SHA1 42ed7cdec4266fe32ca540997c19e0409aabfdb3
SHA512 e51c02d0decdd165ac5d0e8493ce3652cec63f623eb6de3202c08c877dc2e62e903ad47e9e3d2bdbf576210ff5934b4ab725d95318ebed30a23c4a640739c516
SSDEEP 384:B+OBqImmJvGBLx3NaFMJFNNBSUWklm2SQSEg6rV:McvGtlNBhmXQTB
TLSH
T1C072AE762CA56A372CEBC609BE8A2747CBA16293C0D5BBD4DDFC9F0F106B0541352C59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78553215-9295-4187-bfdd-7f6553eacb44.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\78553215-9295-4187-bfdd-7f6553eacb44.tmp
Size 3KB
SHA256 b2b7c8a4265604551cd73abefe5c80d48ec961fadea9d43cf910b017bb393b7c
MD5 e4e3bd146a2b22cff38ee43ed7619bb4
SHA1 d25b71a4158a42628c04e0ad7416f8df13ffd457
SHA512 66fe550614c9d233e97818685124f26a9a8aee5e9ab074625362fa14eba30c4c54bfac11ddb4d212a0a5549ecee1f1048c30a4795b7bba4c6954d03457a3bc7d
TLSH
T12D619336A974E63B8EE6CA01BD863B16E7A59023E5823F54C5FD0F0C00D72982342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4bc45ca5f1fadec910dc62f7de9cde339f553afadf38e531cf38dee5a00d3b35
MD5 952dada50a182d80ccf0ad4277620a6a
SHA1 abcd1f937c21dbd87cb0b57535ec21c13775cf72
SHA512 0f356465ca011fcb811ddce89a69cc11c42c15ba95bb0c64bfdd1725f0a51bc4e8e71e4013ab495d44f389ab8ec37b3c9f7f1580900c96bbfcf58a2ef9d0d45a
TLSH
T1A8D0121672050134C4102033141267092800CA0B800E80405528865E1B984600B0A441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0c4a39066307766e214e08db152dbca9d16022963706571829fb06059a5b7868
MD5 e2978217a50da57bd44766e3fab7f3b1
SHA1 c51efb670635331c8ae529b283e15a835ffa90cf
SHA512 314b8d0674aaaea7b114903e0b0ef8c11de9b781a746fb46baf96bb726440642265698a3c472bdf5aafcde0607eb966b81d679284f39b563ff15c337fcf1fbe5
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

146cba37-89ce-4e45-85e6-a16b705de6fb.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\146cba37-89ce-4e45-85e6-a16b705de6fb.tmp
Size 6KB
SHA256 2356e3c03b98640aff525b34845d18529b9c5095d1560f2c1bb7747b9e801fe7
MD5 76c178ef734a114fa5459b6fc91d8e81
SHA1 88caea36fb8a44745ac2cf3a096883fe70f7ccd8
SHA512 a75d73b4b7c13cd9770f249c58db2e9d55e31d4200ff0e5ba01ab789e47d2431baf69997fb0f0370b5481acbdb7c413c2b7a4b2db2fd8c50762170c892ba6d00
SSDEEP 96:st1/dbcZ10b9Gkybo5h16Z0Os7/x+6MhmuecJCe41eje2K+gP0528XM1C7K:stpB4rXonOsV+FdCe4QjCAG6K
TLSH
T1D7D186025E24B97B4CCAE209BE297A17E3F5A07265D51E58E7FC462C04DA6DC231BD0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e6b20d6-74cc-47e8-aac5-9988f169a9ce.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\7e6b20d6-74cc-47e8-aac5-9988f169a9ce.tmp
Size 6KB
SHA256 8b07bc120efd1a1d81f6c89fd46174972ea6f2cee6e9f088a1da296312b04549
MD5 02c229323fb32f650a8efdf3b3dce558
SHA1 0b281ca3eb9ba5552ab9ce7f58959ba359366cdd
SHA512 d59073486e54e0906dceaec1326bfab5b7790558687de655446014e04cbb77311587d4c5a543e67b3f5cbaed920c65e2aff5166f8cf2e4f7dd9d4de60f2b9212
SSDEEP 96:st1/dbcwG10b9Gkybo5h16Z0Os7/x+6MhmuecJCe41eje2K+gPSYf28XM1C7K:stpB+rXonOsV+FdCe4QjCbG6K
TLSH
T1C9D195025E24B97B4CCAE219BE297A17E3F5A07265D51E58E7FC462C04DA6DC231780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 c4ca08947cd6bd9a95346f64409abe9ed3bf0b50d4c0d64634cd6a166666a63c
MD5 16e35678a74e38c2c6104cd1b45eb991
SHA1 a70221eb0e92fa6906d75f2827b6f43299475ebb
SHA512 806243a8d477c838a235682ad12a49ed2a0769b01fe2bc26056c8965e8b4578f758a2072f2a2f9d9179d507602503fc6afe49b9e6154cdfaa5a225a23c5bf7a5
TLSH
T119A002244194C002D340577016F60B4076F4889682572B0286B80479DC94F86D60A046
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b1c0ae47d6e87d5dd64aa2b904f5cca8e3d281526ff65c528c02b87c353fb5c5
MD5 581a5e22344e1cb0581289edba4d8f29
SHA1 aef960dedca5ca64fb9012742eb38b5ab3ed259d
SHA512 7b1b96b6dd515b2c234053ebdeb98d752c1f20562879bc807ec2fe703ca125c537d7df0ae947fa6b47f9c69765cbb63e66ec47089ee5f7b09a30b5e2336f61da
MD5 SHA1 SHA512

Submit Download

430606d2-ed1a-4ef8-87c3-2c05a60883eb.tmp

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\430606d2-ed1a-4ef8-87c3-2c05a60883eb.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.volt.editor\EBWebView\Local State
Size 1KB
SHA256 5aaf70d0601257c122904e763b88f9169aa11238520aa0a1b93e0e128273fd7d
MD5 1ac34821453cb0df4d22589b8d282662
SHA1 b6440b6fcb6d10b4a8da348602aec1fcb2e77f7f
SHA512 b683a239be4486227ec6e60b45bb67bf34ae14e773561aff91e2ddbf7e896e3b796117396aae8bcdd2066fe29dbdd0fc836b79af3f588e959cdad68a6ec447c9
TLSH
T1562165B2E4F4B732A9D856161A46BA57AF70906AC1418F0051EF470C15E706CA37AC36
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1254267026\manifest.json
Size 102B
SHA256 4a918873dddefc4e395c8a9f8580c8f03c9a37512eb7da6e6454730be756fdac
MD5 bbd743ed25bbba94c85d6d7310c4fd45
SHA1 d19550c1895576761ab76f3ba9bb813511002bd8
SHA512 070aad3473150ba7388e2305f3d5dff14c69a4b468609fa38e1411e575d271d63cc1bf4083d63372b4d244ee5031bd40933f5f68f041c9650999509666e219e1
TLSH
T1B0B01220EC10B4B30004436C0C6CC3C073272F032C4079180DE59F84E90E9DBE071529
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_1433007839\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_2138178793\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1784_587750227\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1304-213-0x0000000140000000-0x0000000140E94000-memory.dmp

Download

memory/1304-2-0x0000000140000000-0x0000000140E94000-memory.dmp

Download

memory/1564-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1564-0-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2304-255-0x00007FF8867F0000-0x00007FF8867F1000-memory.dmp

Download

memory/2304-254-0x00007FF8853C0000-0x00007FF8853C1000-memory.dmp

Download

memory/2304-263-0x00000136AFB90000-0x00000136AFBBF000-memory.dmp

Download

memory/2308-343-0x0000019147930000-0x0000019147931000-memory.dmp

Download

memory/2308-332-0x0000019147930000-0x0000019147931000-memory.dmp

Download

memory/2308-334-0x0000019147930000-0x0000019147931000-memory.dmp

Download

memory/2308-339-0x0000019147930000-0x0000019147931000-memory.dmp

Download

memory/2308-340-0x0000019147930000-0x0000019147931000-memory.dmp

Download

memory/2308-341-0x0000019147930000-0x0000019147931000-memory.dmp

Download

memory/2308-338-0x0000019147930000-0x0000019147931000-memory.dmp

Download

memory/2308-342-0x0000019147930000-0x0000019147931000-memory.dmp

Download

memory/2720-116-0x00007FF8855A0000-0x00007FF8855A1000-memory.dmp

Download

memory/3416-376-0x0000014A50E60000-0x0000014A50E8F000-memory.dmp

Download

memory/4152-302-0x000001E002ED0000-0x000001E002EFF000-memory.dmp

Download

memory/4264-68-0x00007FF8855A0000-0x00007FF8855A1000-memory.dmp

Download

memory/6044-331-0x00000162113B0000-0x00000162113DF000-memory.dmp

Download