a369178600db931ba584b63ed3a88c5e9dec4f2eed1f87ca4450f2b1c4951091

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Size 20.2MB
Sample261030-14s8cssshz
SHA256 a369178600db931ba584b63ed3a88c5e9dec4f2eed1f87ca4450f2b1c4951091
MD5 910460a6c8ddd2e9ef314e3d74d24ae7
SHA1 8663568aec59716595e558fc83b6b6245c4d443f
SHA512 d5888e48008e342356297e4723dad7b304fc56da5e6d86f71fff0ccf023e19700f4cec24437d43654d6cc0d8528138102a70cb765faee4ad2654dc5a5dbb1034
SSDEEP 98304:gfDG3PePLiEJsjsFQx6eWEhqloNtLOM1kILrDo5/caSwXwL99ylbf+ZNNVS0i+WZ:YfJsSo6eRx1kUS/caSwX8ZNNVSrF
TLSH
T17127F6217A5B99ACD19AC87083468A721E6130DB1B36B9FF44D452393F6DBF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
5	raw.githubusercontent.com
11	discord.com
12	discord.com
14	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_329758228\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_935667648\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_935667648\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_666322331\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_666322331\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_666322331\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_666322331\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_329758228\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_329758228\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_329758228\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_935667648\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_666322331\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_329758228\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_935667648\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_935667648\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_329758228\LICENSE	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{9F5D123A-ADAE-4AC2-8D88-609CD5EF7BDA}	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	msedgewebview2.exe
4812	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3608	msedgewebview2.exe
3608	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4104	2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4104	2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4104	2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
4104	2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3608	4104	2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe	91
PID 3608 wrote to memory of 4000	3608	msedgewebview2.exe	92
PID 3608 wrote to memory of 4320	3608	msedgewebview2.exe	93
PID 3608 wrote to memory of 4320	3608	msedgewebview2.exe	93
PID 3608 wrote to memory of 4320	3608	msedgewebview2.exe	93
PID 3608 wrote to memory of 4320	3608	msedgewebview2.exe	93
PID 3608 wrote to memory of 3692	3608	msedgewebview2.exe	94
PID 3608 wrote to memory of 5912	3608	msedgewebview2.exe	95
PID 3608 wrote to memory of 5912	3608	msedgewebview2.exe	95
PID 3608 wrote to memory of 5912	3608	msedgewebview2.exe	95
PID 3608 wrote to memory of 620	3608	msedgewebview2.exe	96
PID 3608 wrote to memory of 620	3608	msedgewebview2.exe	96
PID 3608 wrote to memory of 620	3608	msedgewebview2.exe	96
PID 3608 wrote to memory of 620	3608	msedgewebview2.exe	96
PID 3608 wrote to memory of 620	3608	msedgewebview2.exe	96
PID 3608 wrote to memory of 5712	3608	msedgewebview2.exe	97
PID 3608 wrote to memory of 5712	3608	msedgewebview2.exe	97
PID 3608 wrote to memory of 5712	3608	msedgewebview2.exe	97
PID 3608 wrote to memory of 5712	3608	msedgewebview2.exe	97
PID 3608 wrote to memory of 5712	3608	msedgewebview2.exe	97
PID 3608 wrote to memory of 3924	3608	msedgewebview2.exe	98
PID 3608 wrote to memory of 3924	3608	msedgewebview2.exe	98
PID 3608 wrote to memory of 3924	3608	msedgewebview2.exe	98
PID 3608 wrote to memory of 5368	3608	msedgewebview2.exe	99
PID 3608 wrote to memory of 772	3608	msedgewebview2.exe	104
PID 3608 wrote to memory of 772	3608	msedgewebview2.exe	104
PID 3608 wrote to memory of 772	3608	msedgewebview2.exe	104
PID 3608 wrote to memory of 2480	3608	msedgewebview2.exe	105
PID 3608 wrote to memory of 2480	3608	msedgewebview2.exe	105
PID 3608 wrote to memory of 2480	3608	msedgewebview2.exe	105
PID 3608 wrote to memory of 4812	3608	msedgewebview2.exe	106
PID 3608 wrote to memory of 5928	3608	msedgewebview2.exe	107
PID 3608 wrote to memory of 5928	3608	msedgewebview2.exe	107
PID 3608 wrote to memory of 5928	3608	msedgewebview2.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --embedded-browser-webview-enable-extension --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4104.1672.2535497817478285341 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView /prefetch:4 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x124,0x194,0x7ffdc6f15fd8,0x7ffdc6f15fe4,0x7ffdc6f15ff0
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3528 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224 /prefetch:1
    3⤵
    PID:620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4020 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224 /prefetch:1
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=6112 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=6028 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    - Modifies registry class
    PID:5368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2060 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4396 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView" --webview-exe-name=2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom.exe --webview-exe-version=7.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3800 --field-trial-handle=1772,i,14668354398675754538,5285330756589259910,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:db8f6a65259db1e3ed0d8233c63f15b111ace224
    3⤵
    PID:5928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004AC
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f8a0c4b2b27161bc2c67fb6ff80e0199cef8cb00a4559ec385e8ec6f7b18ccda
MD5 8d0968c0754289f58b804d2043986069
SHA1 332c5d21b60301fdc26f5f0867f15cbe55e17321
SHA512 849d9e4dee719f0fb007c32ed95f949e9d89a34416796146bb9f192fa1d0535beca6c146bbc80a61ab47fac105d3c128f4007688bc2f455f74d8e6e9e47cd422
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b6bd23be925afcb46086c034d34f0f3cd479151ad57bf8b0a666e895a7291751
MD5 f944987e00cd4322efdc155ce63e600d
SHA1 2d8d1f82fce1062489f05e9a4d2337f7cb4e60c2
SHA512 31c699d1f9061e031fbc42f1851561fbf5df0650e84c7f5f10b81444ca3676360935d21d751b99c19485f278d48b08dc5e8907f7b74880138ab5e52c3662b616
TLSH
T14ED01212324102F4C0202133001362081500C20B41064104A428895E5A5805019068D1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000001
Size 21KB
SHA256 eae72a5d3d304bb8061974ca1450ab8ec37f97d442c8a8cce14a12e17e1e6fc5
MD5 c4e12949af43c33d5776c6c7ccdc466e
SHA1 326cb6c4d1a228f64e04b18af1160683772947d5
SHA512 e4d2dfe9da844a775d7254c70631c53203e7799c0f77c672cefe385d5acbe81b0c6c9c9afdfc8ad29ad77f862849cfea48f9d60694f2b40928e3e6c05311b43a
SSDEEP 384:3pz5mzApNHJSnUo/l4GMfvRRTndujOGge7dURO8Su9auevSm2Lo:3LmkfkUo94GYjdpEx7+auevSbLo
TLSH
T1F1A2C07D5C3ED3229E491637937187F24B973AF9A30C5A61768CAF87B604C90A13700E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000002
Size 35KB
SHA256 d207d65ed3e9f8dcd5f9de4d54f9d7ea1284aefb40d2ca27744d844e0d401faf
MD5 f653cc329fdfe51522dfdf7b2408a29f
SHA1 6366a3d339fa034afca9ddd38cf8cd5cc583cf43
SHA512 1711b82862bc3f329c9951e082d1d4455665ed7c9f748747b51f8ffa4eb1a15b2f861a0ecb269d948a6f8ed50b2aec0e0f07d9ccbe59af3fdc2bcf156158a451
SSDEEP 768:tpSYQDMO9bbke36LyPMac2xwXcoCarW7EkBJ+o8Ob/Q:t0BDDhgeHS2aXcoCg1
TLSH
T129F2F229A1778A97BF98A805573B9A77E49893073C9D6D80B1EDFC4A27FC3430F80564
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000003
Size 24KB
SHA256 235313ef832f3f903eb5088d220186ea29334b6ad05e775583293b51c4c361db
MD5 38fc6ae728df7fb786bffdef2e52621e
SHA1 3b8c7bfac364e2a648599cea524a1a7127adf091
SHA512 7cf0fb3b3654454b37b26555a3b6b783a349c54fc4b0856439ca3fd58212d3f18b567e1a26cff9a7ef8c4d7b9a9e7a60dc11a2096a6f23b9beefb67432706098
SSDEEP 384:Z9xs0TxSAs2jOMAg+1HHOYjGVYGtrw3PumceaKuFfVlV7QJLCTPWhnLv5hm:psOoAs+OMAX1nQimmcJKUnViLCTe1m
TLSH
T1ABB2E138134F9932D9321749E393CD6A2A6DF986D41918353EF8928B8B5FF0127AD890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000004
Size 38KB
SHA256 b8230b4a4a6579c4cb2077cea88f48194ffba67ec09c64509ac5547a1ebd9274
MD5 3bbc9419db2a19e11c551997fc552f50
SHA1 1669688cb30f3cc81538e53bd3f556eaf18e3733
SHA512 75b615a91fa91d04a581df043539e99863ee6ef9254e6455dac814c038320e893c708023540e294bcb68226e4acd264db76e76aaae403c94d88d247ccb514529
SSDEEP 768:BjHHilVTzrwEt6KqxF75ThoiQg94NVRtRNrCLvVS1ifz0zPhGWWzmEZFCQyP:RHqTzrw+MFBhoid9UVR7UVhfGPhk3ZFI
TLSH
T1CD03F1A840A37337BCFD220C670ACF76D9E5FBB6C9191012B1517A6D91EA3CDC688647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000005
Size 58KB
SHA256 4bc4724180993ceceea8cd79ec204f5a3b6c7cfcc7bac4f53b71cd86d02d7f08
MD5 3bcb9816f74cbccf5160ce8d027c3ec7
SHA1 9d4287bfacc202c71b7f1f9157e592848566c4e2
SHA512 ddd2afe1843c345fb1aa4129bf56bfc52a8d854c886e523b57c696191585dcd5f0aa7b82303f7c618adba4d19b665a621cbc7f4d4a6dc0b23c868926851bbf67
SSDEEP 1536:Tung1m7C+8K3qWC48GYogW2ur+wq0lyyYi:T4g87CO3qWEGYLWBr+N0l2i
TLSH
T15B4302A6C5564B81D2DBD7EF000749FA3105C539480FAE538C17A04E97F4FE56621A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000006
Size 36KB
SHA256 a647f7925e9611d88f2193e27c3ad279cad8b226d29183ec46fa05932b8f81e0
MD5 10f9e08c9bf1e968451f0a52b25cab89
SHA1 093d1fd2b11e113b18aae49bd13ee3931a154681
SHA512 19a9cca5894cb73b72da65063df591f5f604b93771c23015d2d504265ec581da4b79ddc2b91cd6a7679e673bc5d72a08303bbb8e68bb2af6c17a5094abe3a194
SSDEEP 768:d70Sy4Dt+KCQyg5o3Elk47UQ1hp0gCx8BuQQv0tXZyWTRz7AttMf6Ile100I:d7xLweyt3p47pDp0gg8RQstXXT5AttD4
TLSH
T133F2F172A84EF1B6C5450AE377483A008FAE6D9F694814FD7FEB42E45C173B409899B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Cache\Cache_Data\f_000007
Size 198KB
SHA256 d75814c1163cd21ae7288e96446448fc423a5fd8412967d43f67a0d9d897ff3f
MD5 dfdcb062e7e4b9873cbd8c0ac4b1e9f2
SHA1 c8c60caba6b854b3c3ad4dd5d98918940a940cc3
SHA512 2617d6e5eee138ccf886269f11d36d0fca6044708bfde0d12e65ce9012ba14f8b3e368f1be7156a91af4cf3821b37f598f00b9f4ea087b61804da14435c68fd9
SSDEEP 6144:GQBxSo3YjKbNDJoYJa14Tk5jPfD/El6Rfg:GQBxBoQDmYQ2o3AlL
TLSH
T1131413B5DE4F36C06E5F9ADEC5CE012617229E351F840EE64BD120A620C6E8B71D8DBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 c5b905ab764f27a9888459c09999a275b887ecafac955f49d26a65fa35ed2535
MD5 e0122f0068fec21c879e3068028bd114
SHA1 8a08bc59b00af8710ef39a5890e69f17f54fb061
SHA512 42271b601006ceb779c50d768a36ca04c0bf08f6b786f6333d5065a2408de8e2023f0bd69de42ef10efd1e9224e10c969f872deb163b3396a4323460e452b4cb
SSDEEP 96:HUlcC7ILGDlz3Ifb/zUlXwXpptay0yZhNLgUv3uJ3daoeVzXG3VTjfWEY+8:HUlnSiNezRppVhNLf3ekUFGHb
TLSH
T16EF1193364CF15AAC79400F29AE31DE2B93442659C03BDAA53ACB1B8CD197E274C2D8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f21bc5457aacbc8ed5b7e9afdb3c32bf0e434bbf558ecf4e96dd7ab96bd6006f
MD5 101239e65b81572d5da0e32dc6880ba1
SHA1 04b0b60570126f91f630c7b89e1b69f27ec951c0
SHA512 3bca924168b3ebccba7625077419a02cdf0395816e7cbbb0efc6d4696ecc3068641f26af127b5f64ed717239b4c6c3cd1f63b23f5fb1404e51d314be8f9a02d0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

124488bd-7ec5-45f6-8ba6-c139bf7b2f52.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\124488bd-7ec5-45f6-8ba6-c139bf7b2f52.tmp
Size 689B
SHA256 8319f484ac4d5b31b9a6ac39979115d165a9f31f836bea6b6ab4bebe5be8f922
MD5 1c6f9ebc8fe4db5754c522455ecb7ba0
SHA1 56af43d3c0d089a7bb2abb4004f52fedca789dfa
SHA512 ea3a2fee28cb90f3dec4ca969a16313dbe86b26bf41ec46d5efa10a63f7e505acf101aad5ca9c83bd39c00c7f1b0b081f29e5be1991c668be2a362d402384402
TLSH
T148017B53A53EE4AB503809770EC8B905AEBBF4390145E0F9CA97C37D70961B39742827
MD5 SHA1 SHA512 TLSH

Submit Download

1d109c08-e435-41ff-934f-d38594532f35.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\1d109c08-e435-41ff-934f-d38594532f35.tmp
Size 1KB
SHA256 2a2273cc79c16256a9c1164a6eb40c269b4be4b57f5266f68c7d46041abb7911
MD5 8eb6a6209b145ebf82b96d299c2ca519
SHA1 4ba7988efbc5c8cfd261a1f86a3ba3fdd312f4b4
SHA512 ab84cf3f61b98d46e1b4ce2fd01181ac6165782f5b3976ba3eb6f6bb064ab0ec6dd922ac5e61288bbe19739b4298b2e76fd371b7124fbebd572d2d3f69cb9e38
TLSH
T1102156B3C6D8836CD96503F41B68391BCA2D1C1843182D3EC9D69F8F97E11B1F285A4E
MD5 SHA1 SHA512 TLSH

Submit Download

27cee3a8-53b5-4302-a6cf-d4df69dac5e2.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\27cee3a8-53b5-4302-a6cf-d4df69dac5e2.tmp
Size 689B
SHA256 c1726bb209b7b92825bdc63114510b4004e8a59f7166923046f23d92da99f4a1
MD5 4ccc2a719133c79855728d8abf97ec84
SHA1 cf8e4a738b49fbdb14d7dcfe04d787df44c22894
SHA512 75bc30d9d39f466626acf22bafb55ea77b236a1b13aaf9abb5653ed6ea9768a13f0983ab990514cd3cdde0e6699bdbc058ddc6ab5c51404d3ee5167a6d4b3739
TLSH
T1DD017662A57EE4BB503809770EC87905AEBAF43A0141A0F9DA93C3BD70850B79B83427
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\TransportSecurity
Size 689B
SHA256 969bfdfaf1823d311959a2ecfc769421a6ed6684d5c4d361f39533a57696ffff
MD5 427d11e1682a91c9785c92a7674f5778
SHA1 afa679ab129179dda2e659a93c07162d97b6e492
SHA512 df1399346e3f8401e7b3434070ed75fe7fa1c41f799fee3332a0bed2543860cbbda3d4f6e2d6bd69c28aa8aa8cce2a0cfd753e31fb6fe5c39f3519f0a2afa27a
TLSH
T1D7017B13A97ED4AB503909770EC8B905AABAB4350145A0F9CA97C37E30951B38742827
MD5 SHA1 SHA512 TLSH

Submit Download

b4d72d19-d66d-4c18-a6d8-d08fd689d99d.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Network\b4d72d19-d66d-4c18-a6d8-d08fd689d99d.tmp
Size 982B
SHA256 0205fcaf2c408ea0bea8434429036b6cef5cc02659479a4566da12f93a99204c
MD5 f64bd1629818eaad1092b386a73ea905
SHA1 408d6c12e100254d22735146e87fe8a11fd60e8a
SHA512 90d9199e9632ec746e548e1901e177c7b82bb2dd3c75bfa5586e7bc04baeaf2f94d181f861d70923775830c57893351bf3be3df9fd508ca1f39397bdeb4e95f4
TLSH
T1BE1178B3C6D8876CCA6503F81B24391BCA2D1C1843182D2EC8D59F8B87E11A5F28494F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Preferences
Size 6KB
SHA256 29f1d1b4be93ae991c82babc948ffbffd5acc2d337720b4313c7eabd3b8def8f
MD5 d5e91dbf7f7a31e8f62a13357b5cb5c5
SHA1 f75e3c183cd45addc9187c7a9372faac498b246d
SHA512 50003c3d5e34ca8e7c42e7f0f9eff5ab6d45f6c2e50c21799d0aebeec564614a55d695a7bf7ab8caa295f05169ba8e2164c43f85a32c51eceee23c0cbec63b8a
SSDEEP 96:r3/d4QURb95kudo616ZE8s7/x+6Mhbxmuec6r41ejevK+gb28XM1C7K:rPy31om8sV+Fhb+r4QjlBG6K
TLSH
T14AD1C7129A24B97B8CCAE219FA25BA17E3F9543165D91D58EBFC452C08DB5CC2227C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\a898dfc7-3c99-4d85-8cf8-966addae0601\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 114B
SHA256 1048ca56a3fb03b7b0f7a8cb17739f33e460849e5385493e2be74fa55100d90a
MD5 a50b603408e2fc62dfd9fad3771b7974
SHA1 4c5dfce7a62b93189d6d1b654925dacc74cb9165
SHA512 2fd52b413ba501c3e0eca3917f61adaee83d3d91f1a6131a424f52a6eee87cb8af38ac75721a973393c1580ccd2dfe78ea752e56bc251f57fbcada888b900fd7
TLSH
T15AB0929BC4100E211B2A02A24602A02EC7824FC88847A48A604B70963874B537202DE7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 177B
SHA256 55c1da6eb65ece5967fd986fd8feae5283cac2194bb8acc78ace39ed1ab3fc3d
MD5 b3a9d0b1c5b5daff56909e0505d22a52
SHA1 e77170280feca533bc6abec8311ca5ab617ac0f4
SHA512 184c2c3205df560160831539dafe77cdb4d6009ba4bf6e1d3b90456aba73b8cdf8851a8e362b22f6539a3e78591a09de804ac14e22393000ad4370ddbe7693da
TLSH
T10EC0128FC6210EF0672901D35601542EC6024E84454BE4C5B60BB0567C34B43B312EAB
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 170B
SHA256 08c0444982ddcea3207fe6e28174d4ba49fcbc8d2e82363f9f65c8b1b804f290
MD5 9b49ec08778cb8d6459148cce23e5824
SHA1 a6c99d29c0707b1b034202cee4a7c490f5262c5d
SHA512 8146e756ca80599d7a15dabd26ee1d27611d9b89ba422b6685b123adc267c8ad728a72665116bba61f72012a60c85eb6916ba55ed3e5c9e329c818c15cc5c762
TLSH
T1D9C0128FC6114EF0572D03D21601642EC6024684414BE4C6B60680666C04B537213DAB
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

aae7b736-05d9-4cac-bcb3-86fa969e9a35.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\aae7b736-05d9-4cac-bcb3-86fa969e9a35.tmp
Size 6KB
SHA256 cb26e98ae94fb54d9f193f76dc6cea314ef23dbb803094e55761c772b97e6aa7
MD5 f536a3ca2bdfe61ec24b624eb5f95dcb
SHA1 e3516aec0aabb43a9588531a8c3f16ab79ff70eb
SHA512 2dee293f29b35ce17ad533277c5c722858849cff75541c7cf97de87f7f3a51c9b8bbc02683d1badb5a870d115d5def830cf50d3f047074c95a01344b0de7c856
SSDEEP 96:st3/d4QURb95kco5h16ZE8s7/x+6Mhbxmuec6r41ejevK+gb28XM1C7K:stPy3ro58sV+Fhb+r4QjlBG6K
TLSH
T1C9D1C7129E24B97B8CCAE219FA25BA07E3F9543165D51D58EBFC452C08EB6DC2327C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf5e720f-a4cd-49ea-b00c-a5a7bef6215a.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Default\cf5e720f-a4cd-49ea-b00c-a5a7bef6215a.tmp
Size 6KB
SHA256 9b77fdba88bb0aab0a3e7aa1bbf2d3a3ba44ed9b6d6345977dc9f1f873340f44
MD5 c81ddd828b3e5cd2b182c893e772b712
SHA1 47abc078b8150e79299418c46fd576a59bb1ead4
SHA512 5cc1bd2a8194751c0ab1ee18a741b8290941a25c3f33ae703bbc708d86b6df3c26a4f3a2cfcddfacdecf6b4a8f68c77247481f103817d2e22a2dd8c858d02787
SSDEEP 96:st3/d4QbGRb95kco5h16ZE8s7/x+6Mhbxmuec6r41ejevK+gyG28XM1C7K:stPyRro58sV+Fhb+r4QjlDG6K
TLSH
T110D1C8129A2479BB8CCBE219FA25BA17E3F9543265D41D58EBFC452C04EB6DC2223C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\Local State
Size 1KB
SHA256 1c33667160852a59088b52b831d72ea3bff24841d319c357423f11901b9d49ff
MD5 22550e0d247d91077c39fa2cf5bf7d1b
SHA1 12eb6b04d7894b0b2fabe5ee8ec42979c7c8b20f
SHA512 be8470a28e2427a3cedd2e835f95e45e06cfbc172904d78e3765a0048276a777defd10540c23a7c85f984b1e2d5dcb1ed3e66995a7d4e8a2292e24041bd987dd
TLSH
T101219572F8649776BC8A834B300A7F079E326467A1028F04A1DD8B6D02D619D6636833
MD5 SHA1 SHA512 TLSH

Submit Download

a05ac800-93b2-40fd-b41c-25c7fb974a85.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\a05ac800-93b2-40fd-b41c-25c7fb974a85.tmp
Size 3KB
SHA256 55f19cd8e277e2599976bb91a4560305528b76ecbec742489f2751f138741883
MD5 dc15517ae106182dfd2fc752bc967aa9
SHA1 95ac3e0385851dbdbd57fe20da627fbb56ad7de8
SHA512 67dc446154d17be3199b14f0a615fbdde5e7fca28934c92b8cc22c4c4b2e27491a65387c51e696823d8aa8e3dd6df84fe9094be49e0c1dc1811a1ba16d6d0d82
TLSH
T156619632A974E67B8DE6CA05B84A3B06E7A55023E5813F95D6EC0F1C01D729C1352C23
MD5 SHA1 SHA512 TLSH

Submit Download

abdd0075-0e9e-46b9-affa-094e81aac8a7.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\abdd0075-0e9e-46b9-affa-094e81aac8a7.tmp
Size 3KB
SHA256 9f9287669dab35b3b7a659f9bfea388fa41b261203cac7e5e2a476b4e06afdff
MD5 36c899b76037160f41e4025dd9018a53
SHA1 3062b445b1697a4e2bda809c91acd0df18a2b408
SHA512 cf1d96a24b7fd59c55fdad8436b98817fd7754b0bb4f61e764326eee012d61961681afb58900530ac0315f1b22bfd68d9ccb7ffe483d638c78645dadc0c6ad07
TLSH
T153819622B974E97B5DF6C60AB8453F07E6659063E4857F99D5EC0F1C02D729D1342C13
MD5 SHA1 SHA512 TLSH

Submit Download

c49425d8-0953-49ad-9e72-6483bb3e0bf7.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\c49425d8-0953-49ad-9e72-6483bb3e0bf7.tmp
Size 2KB
SHA256 c78d0c1ec40bea9d556e28463f67534e28a0ee7882ff88385f5c735451fd099a
MD5 9a69e8cc20be85f60b0faae9f3b6e316
SHA1 034747b67db32d6b63ef56a6e942e2836c589895
SHA512 15ac267e40775347c2002149fc82470e990cb7732de83ec0554a68a250834b1791a1ea29623e64b90eaa616ccb573f1f0e96ed81da5dc0876969425a5c4b48ba
TLSH
T1AB519533F824E77B95E68749780A3F13DE36A0A2AA021F5096DD1B1C01D755D1312C33
MD5 SHA1 SHA512 TLSH

Submit Download

d1116c4c-3256-47ca-94af-8736facd173a.tmp

Path C:\Users\Admin\AppData\Roaming\dorion\profiles\default\webdata\EBWebView\d1116c4c-3256-47ca-94af-8736facd173a.tmp
Size 15KB
SHA256 79ab65e5ac3b718a5f02a128bbbc4f982f2ed8e428929344e0cd6064d5196d1d
MD5 6416fa6b617276138ad70318fd0195f5
SHA1 a49bad3dcdafe0cbf50f754e7da5c11a393bb8d0
SHA512 6110c9bc17c0f45c1eed4c53967eb364d8f76307c2b0d14d18f7cf10ab360a42dfec8c1c0fc493c5b5b571e78aaaf438652cae8093e2e8216007ecf7d464af77
SSDEEP 384:J+OBqImmJvGBLx3NaFMJFY3NBS9ibtqcxdoVg6rc:kcvGtlNY5fdYw
TLSH
T16D72BE762C65AA772CFBC60ABE8D7707CB75A293C4847BD4DCECAF0E012B4541352812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugins.json

Path C:\Users\Admin\dorion\plugins\plugins.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_329758228\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_666322331\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3608_935667648\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

memory/620-118-0x00007FFDE6310000-0x00007FFDE6311000-memory.dmp

Download

memory/772-694-0x00007FFDE5EA0000-0x00007FFDE5EA1000-memory.dmp

Download

memory/772-693-0x00007FFDE4DB0000-0x00007FFDE4DB1000-memory.dmp

Download

memory/4320-602-0x000001FC00DF0000-0x000001FC00E1F000-memory.dmp

Download

memory/4320-33-0x00007FFDE6310000-0x00007FFDE6311000-memory.dmp

Download

memory/4812-755-0x000001A971A20000-0x000001A971A21000-memory.dmp

Download

memory/4812-765-0x000001A971A20000-0x000001A971A21000-memory.dmp

Download

memory/4812-764-0x000001A971A20000-0x000001A971A21000-memory.dmp

Download

memory/4812-763-0x000001A971A20000-0x000001A971A21000-memory.dmp

Download

memory/4812-761-0x000001A971A20000-0x000001A971A21000-memory.dmp

Download

memory/4812-766-0x000001A971A20000-0x000001A971A21000-memory.dmp

Download

memory/4812-762-0x000001A971A20000-0x000001A971A21000-memory.dmp

Download

memory/4812-757-0x000001A971A20000-0x000001A971A21000-memory.dmp

Download

memory/5368-612-0x0000024B44870000-0x0000024B44903000-memory.dmp

Download