2692ddedd25d9e145bcdad8e5345b9c028e5379817e0b4b6aca096c6c8dd460e

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe
Size 49.1MB
Sample260702-adr99sf15q
SHA256 2692ddedd25d9e145bcdad8e5345b9c028e5379817e0b4b6aca096c6c8dd460e
MD5 7ea134de7c84d1aa643d008b625c0a2b
SHA1 5de917bdb9d6bdf8d95668e79d7d305a7fc6e62f
SHA512 a01e6ff11ac77b2e1ed989f50d499d75f6c0da7f93f961a746d2354bfe30fa7323679b527dbe03a932db5df12395267ab645c39a9ce1df25774357337f6a47a8
SSDEEP 393216:2HwRKWgaXaCWvxRFgCWNy44b/Bw6bJHfAvpLELvGq3y7Aj:xR/hXaCWvxRFgpNy44b/fV/AvpEGN7A
TLSH
T1A9B70721BA5E596DC05AC4B4834B4B725B3130DF0B35B9BF64D892392F7DAF42A38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1338595935\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1658962669\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1658962669\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1658962669\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1338595935\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1658962669\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Part-IT	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1658962669\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1338595935\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1361008174\Part-RU	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	msedgewebview2.exe
1056	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3696	msedgewebview2.exe
3696	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4068	2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe
4068	2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe
4068	2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4068	2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3696	4068	2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe	88
PID 3696 wrote to memory of 3660	3696	msedgewebview2.exe	89
PID 3696 wrote to memory of 4724	3696	msedgewebview2.exe	90
PID 3696 wrote to memory of 4724	3696	msedgewebview2.exe	90
PID 3696 wrote to memory of 4724	3696	msedgewebview2.exe	90
PID 3696 wrote to memory of 4724	3696	msedgewebview2.exe	90
PID 3696 wrote to memory of 4648	3696	msedgewebview2.exe	91
PID 3696 wrote to memory of 4764	3696	msedgewebview2.exe	92
PID 3696 wrote to memory of 4764	3696	msedgewebview2.exe	92
PID 3696 wrote to memory of 4764	3696	msedgewebview2.exe	92
PID 3696 wrote to memory of 4112	3696	msedgewebview2.exe	93
PID 3696 wrote to memory of 4112	3696	msedgewebview2.exe	93
PID 3696 wrote to memory of 4112	3696	msedgewebview2.exe	93
PID 3696 wrote to memory of 4112	3696	msedgewebview2.exe	93
PID 3696 wrote to memory of 4112	3696	msedgewebview2.exe	93
PID 3696 wrote to memory of 5512	3696	msedgewebview2.exe	94
PID 3696 wrote to memory of 5512	3696	msedgewebview2.exe	94
PID 3696 wrote to memory of 5512	3696	msedgewebview2.exe	94
PID 3696 wrote to memory of 5512	3696	msedgewebview2.exe	94
PID 3696 wrote to memory of 5512	3696	msedgewebview2.exe	94
PID 3696 wrote to memory of 3940	3696	msedgewebview2.exe	98
PID 3696 wrote to memory of 3940	3696	msedgewebview2.exe	98
PID 3696 wrote to memory of 3940	3696	msedgewebview2.exe	98
PID 3696 wrote to memory of 5020	3696	msedgewebview2.exe	99
PID 3696 wrote to memory of 5020	3696	msedgewebview2.exe	99
PID 3696 wrote to memory of 5020	3696	msedgewebview2.exe	99
PID 3696 wrote to memory of 1056	3696	msedgewebview2.exe	100
PID 3696 wrote to memory of 484	3696	msedgewebview2.exe	101
PID 3696 wrote to memory of 484	3696	msedgewebview2.exe	101
PID 3696 wrote to memory of 484	3696	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe"
1⤵
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4068.5796.183100768645614521 /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView /prefetch:4 /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7fff50cb5fd8,0x7fff50cb5fe4,0x7fff50cb5ff0
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1708 --field-trial-handle=1712,i,1046565347344287924,5242135753221578326,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2028 --field-trial-handle=1712,i,1046565347344287924,5242135753221578326,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1712,i,1046565347344287924,5242135753221578326,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3376 --field-trial-handle=1712,i,1046565347344287924,5242135753221578326,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699 /prefetch:1
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4056 --field-trial-handle=1712,i,1046565347344287924,5242135753221578326,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699 /prefetch:1
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4716 --field-trial-handle=1712,i,1046565347344287924,5242135753221578326,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=816 --field-trial-handle=1712,i,1046565347344287924,5242135753221578326,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4852 --field-trial-handle=1712,i,1046565347344287924,5242135753221578326,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView" --webview-exe-name=2026-07-01_7ea134de7c84d1aa643d008b625c0a2b_akira_glassworm_quasar-rat_rusty-stealer_zxxz.exe --webview-exe-version=0.20.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=1712,i,1046565347344287924,5242135753221578326,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b0a9c98ad0e3e2cb1e890b18ca87fd7a5885a699
    3⤵
    PID:484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tray_layout.json

Path C:\Users\Admin\.antigravity_cockpit\tray_layout.json
Size 2KB
SHA256 83318f4d290d1d97969fab361c9956249bf308b85e66c9ce032d0bfc9562ebd3
MD5 c492e6767a1fd6abad716cc94eac5b5e
SHA1 9768b280c2df6313fb20349363feb26286795761
SHA512 5c7401762bd1e727675f9793bb0e224a2d415e9ea6a159439d694049a8b85e43b771628314dc78bf1f7a7bce0cc2bd8a55689150d4e75f291a52b595643c75e0
TLSH
T136517D9CDABB8D5A16F9595668D90A11162801EBCEA6FC0C3F4C86EC0F3C11F50B977E
MD5 SHA1 SHA512 TLSH

Submit Download

workbuddy_accounts.json

Path C:\Users\Admin\.antigravity_cockpit\workbuddy_accounts.json
Size 40B
SHA256 596d16f8b09edac2cdf2ec4c7e360cbcfeac93128b9b0e1f0ff7bc70894aec89
MD5 86a2200279cf1e97c8d806aae13ab2f1
SHA1 eaf7d9496b039bd6afdf8e19d92d42b753f7aee6
SHA512 b82f95cebd55d250e038f5cee6c11dd33720b312aa1baa93c99804898725c185b503cbac33c2b1551f5e26569b948a3ed14cab01011dbfde10eb3e62311a225c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0b81ab2c816eb4ebc7d04a44144a6c279d2fb3ae4f6c70a2db2c6d8dc4b6fcfd
MD5 050709f89b7619e90c81d5cd2dad6fde
SHA1 c45578ffba7b31054c02433fdf2e0ccb5c30009c
SHA512 8a662510e399ca58d1d7b7555a826a0cf6ca7afe170ca917fc69d25ae97434201aa961e6a5170bb73a895fc06338697d84c2096422db70b802ccbd38de4a4a8e
TLSH
T1A9D01236B3410338C41425330142B6590500C92B50454045983CC51D5A4C0500B12C41
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 97a140393ca95c1f27bb28908c5c4d9d92a7327ad8426aefc12c029470e51408
MD5 8abcf4a1319419a5d57f32bcf8a8624c
SHA1 db7e8b6148fb4e2d2d5052826f4406a236132423
SHA512 15331eeb96a9b0c36c0d02d4e28f914184dbbc443dc5746805e10d5845fe069a88bfb16f7045343e4b513dcf62df7118a60ba225a90c8bd1757f755a4563d7c4
TLSH
T130D00434D3441304C44D15374150D7710310CC30345111554434C00444CC0004351C04
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 fada45d7ddbe569923497b3ea8ed04776eedcfefa748e1b98dc3ec882e9c03cb
MD5 6a0d802ef5078675a1836a16618deb7e
SHA1 127567d8173f45edc0aa76ca15670773f0514bf4
SHA512 3d5504f648dfc3283f8b77c14d3fade81e67211e48dd92be2c0bfebfaf2f1e38e8cda926dd3654133717421645679a3ed63687677220785b0e6b40c7ac57e899
TLSH
T158F0DF51833114D6CB91223002D330D07EB6591103475F09C4548B77F7997F992D65E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590352.TMP

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe590352.TMP
Size 48B
SHA256 e2c5fce8c129c8226d70e2be24b1d29abd671f82e5f9af23f721bc2ec8bb0984
MD5 6905dad8d23cacf8a443adae05527ec1
SHA1 cdc5767c05ac5305d7b5141f99454a0b363d4d67
SHA512 739527b56a6effe2a326f77733301c742f4608296e0ddc2e6781376a8f5747836d9ef756ec6ba5b05d62d3487d2fae7ac3976c5fda2d78c8226d916ba27d6027
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

603657eb-d1e9-4af9-9567-8191eef395ca.tmp

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Default\Network\603657eb-d1e9-4af9-9567-8191eef395ca.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 6731c109e9dda6c5607a9983aa7c9360a6cc7efb03a3dba97098f8f7cca39202
MD5 db92c6efc1a5a0a963c4ffacee09f721
SHA1 eb32b3cd4621dce472c93c010fd348a0fdf176d9
SHA512 b1460b07bf9e48e19d4466793295b59bb826ef5525cfcb83e17cf6e3eb2a53fd0278281d5200780803b08fcb8cd413c5b22e6297dff8688d2e73fcaec2c24e82
TLSH
T16E016BA6C3D4C67E8A4526E02B343C13CD2E051992282E36DDEAEBEA97E1471D11050F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59c327.TMP

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Default\Network\Network Persistent State~RFe59c327.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Default\Preferences
Size 6KB
SHA256 8a9ee5f90cc55027ff78b845a5ae815792d7a1e5f14e320366754adca83c8a4d
MD5 27380ad027422751f77d426d6db4d418
SHA1 e5e726a2aea80b88f364e8de88220d3aed30709b
SHA512 1859d4be0216f2240a63ced6d73bb75a4e058d3fc25cf49efba8d3683a6c9f4bdbaf63746ea8fc07df248d5edfe3538cf4d2c0c345827f6e83f3e2c6287a5ac3
SSDEEP 96:stf/d+T+jG0b9xk/o5h16Z0Hs7/x+6MhmuecJQfMkkjeOK+g2sA28XM1C7K:stnsTu8onHsV+FdQfwjecG6K
TLSH
T194D1B7035E2869BB4CCBE118BA297B13E2F9607261E41E58E7FC461C05DB6DD6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3124d1b-f1c9-497a-9993-534237110261.tmp

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Default\f3124d1b-f1c9-497a-9993-534237110261.tmp
Size 6KB
SHA256 6ade9b04633d4dc5c7d5c1ac1692e81063bad45f8ebf00e44cc08002cdcf18ff
MD5 5d7c7abd8588fff8876383b35c6d64c6
SHA1 1b3a5148915e886124405e182baaab639b73830d
SHA512 87e87ca2cd5b6d1bc2563910ab94b79c6dffc0bc4f2b6b06a8519533f3b1d1014aed6969d8d99cb06af04d02b0b20edb02149be2e1c9c5f9e8e9e6a6a19b2918
SSDEEP 96:stf/d+T+s0b9xk/o5h16Z0Hs7/x+6MhmuecJQfMkkjeOK+grd28XM1C7K:stnsTs8onHsV+FdQfwjevG6K
TLSH
T1E4D1A6025E2869BB4CCBE108BA29BA07E2F9607271D51E58E7FC461C05DB5DD6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Local State
Size 2KB
SHA256 a66d7f4d03b3d497dc8b48af088465c8d1ed1bda5ac398eb7ccc2b50a2e4dac9
MD5 f6db7479271ae2a0bf0101eb6eade6e0
SHA1 7bbbab3999caa245bc933d0c634bfe7566552e73
SHA512 f486f580f3df7d932dd9af098c0b9a0698341d2b7f740495ea1970c551435fe276d9639e8eb8e4d380900b94ecbabedcfed57f18cecd02cc968ccc81bd8f357c
TLSH
T1135186736C506E3784F39608798ABA12DE7941B65B662F5096EC4B0C03DB45E1307C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Local State
Size 3KB
SHA256 e1352af9141c57a47719200dddf6afd130e5d88a36a125ec5bfbc51a55f6df4e
MD5 96e3a04324a6389d3568d0e1b357b92c
SHA1 030e66abae0a8f2591704fbd32ebadb261002f5c
SHA512 cb0155ea4258a026384b083446a9d5ec3fbbd684069df6e35c5c0c7020cb1a338f0890d1bbe5da231955964f2338f185df3f021a69ebb178d65de8398989b226
TLSH
T18771967B6DA0A9378DF3DA0879866A16E7A54077A6953F94D5FC0F0C02DB2991303C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58adbf.TMP

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\Local State~RFe58adbf.TMP
Size 1KB
SHA256 d90e6ee4ef58f3ac90fd56227f259da39864a3f28cfe4590dd4cb0699b4b3504
MD5 bca352c4c76681b45e824d3b2e24e80b
SHA1 da1d18697253503523981a21cc23270b606dbc02
SHA512 4a611d4f8e01f2dd61265979a7de87994f39eedf611942779117d9afc8d9c5e5ded304d1ad59e5de04ad029fb4a1b1b16b1d963beced91621cdbcaee5e3b63f6
TLSH
T1713154B3AD906E329CA2911A3546E9979E7140BB53564F04A1ED870C07EB04E972FC32
MD5 SHA1 SHA512 TLSH

Submit Download

dcb23747-ffdf-4853-8766-5df4dba46a37.tmp

Path C:\Users\Admin\AppData\Local\com.jlcodes.cockpit-tools\EBWebView\dcb23747-ffdf-4853-8766-5df4dba46a37.tmp
Size 15KB
SHA256 cea0efdab73ad38c5f37bb11b459e73007a18c6c9b2280eeb347e45113304d14
MD5 c076eaee91f692ab267f6192d655486e
SHA1 757c34f383c23f438ae7b476956c35a6df28975f
SHA512 c1011c007a29a607f3b64287e8dd3fb7095e48a3c1d5358d46703376916f615416730abe7b77ee6699e75771416626f46588a82018e30fcbf3be5d7c47964482
SSDEEP 384:wsrv+89zHqlDNP9oidBNBSAqTgiKNXisdsoNO:7rv+4UNbdQdoXisyoNO
TLSH
T13272AF33E83876338DB7D809B486BA077B7C50A766C24FA4D5AC4B8D429B0DA2307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-447-0x000002C01BD10000-0x000002C01BD11000-memory.dmp

Download

memory/1056-443-0x000002C01BD10000-0x000002C01BD11000-memory.dmp

Download

memory/1056-446-0x000002C01BD10000-0x000002C01BD11000-memory.dmp

Download

memory/1056-437-0x000002C01BD10000-0x000002C01BD11000-memory.dmp

Download

memory/1056-439-0x000002C01BD10000-0x000002C01BD11000-memory.dmp

Download

memory/1056-444-0x000002C01BD10000-0x000002C01BD11000-memory.dmp

Download

memory/1056-445-0x000002C01BD10000-0x000002C01BD11000-memory.dmp

Download

memory/1056-448-0x000002C01BD10000-0x000002C01BD11000-memory.dmp

Download

memory/3940-360-0x00007FFF734F0000-0x00007FFF734F1000-memory.dmp

Download

memory/3940-359-0x00007FFF722D0000-0x00007FFF722D1000-memory.dmp

Download

memory/4112-103-0x00007FFF71880000-0x00007FFF71881000-memory.dmp

Download

memory/4724-25-0x00007FFF71880000-0x00007FFF71881000-memory.dmp

Download