0e3e80160ffc5223e40d7f15ceba7804d4f354f6740454f74d7ea88f941f7e73

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe
Size 8.6MB
Sample260726-2m4s7sel41
SHA256 0e3e80160ffc5223e40d7f15ceba7804d4f354f6740454f74d7ea88f941f7e73
MD5 ac34c19f9cb7097079a10a1365a62208
SHA1 abe39fbe318feeff4a47703a457a3b8a16d92e4d
SHA512 4827523129b7291af42550757edf7413d2141ba7ff8221814c46b19fd7b8bbda771f7f529b502abb7e422a3942580dc25be6ed6472cbe546aead1df6ea54e00a
SSDEEP 98304:heCe+b5zY9Ldvhr0/n4VRdh3OL4XQ3yWla6uEBOadK4xCBfZ+ALhb:helo4rala6uEoadK4gBxXFb
TLSH
T17E966B56F27940E8C86AC179C2566233FB71B85903707ADB5BA44AB52F66FD02F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_375701514\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_375701514\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1124582956\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1124582956\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1124582956\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_375701514\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1698805681\Part-DE	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2784	msedgewebview2.exe
2784	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3196	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4144	2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3196	4144	2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe	89
PID 3196 wrote to memory of 4896	3196	msedgewebview2.exe	90
PID 3196 wrote to memory of 5652	3196	msedgewebview2.exe	91
PID 3196 wrote to memory of 5652	3196	msedgewebview2.exe	91
PID 3196 wrote to memory of 5652	3196	msedgewebview2.exe	91
PID 3196 wrote to memory of 5652	3196	msedgewebview2.exe	91
PID 3196 wrote to memory of 5812	3196	msedgewebview2.exe	92
PID 3196 wrote to memory of 2516	3196	msedgewebview2.exe	93
PID 3196 wrote to memory of 2516	3196	msedgewebview2.exe	93
PID 3196 wrote to memory of 2516	3196	msedgewebview2.exe	93
PID 3196 wrote to memory of 2836	3196	msedgewebview2.exe	94
PID 3196 wrote to memory of 2836	3196	msedgewebview2.exe	94
PID 3196 wrote to memory of 2836	3196	msedgewebview2.exe	94
PID 3196 wrote to memory of 2836	3196	msedgewebview2.exe	94
PID 3196 wrote to memory of 2836	3196	msedgewebview2.exe	94
PID 3196 wrote to memory of 440	3196	msedgewebview2.exe	98
PID 3196 wrote to memory of 440	3196	msedgewebview2.exe	98
PID 3196 wrote to memory of 440	3196	msedgewebview2.exe	98
PID 3196 wrote to memory of 2208	3196	msedgewebview2.exe	99
PID 3196 wrote to memory of 2208	3196	msedgewebview2.exe	99
PID 3196 wrote to memory of 2208	3196	msedgewebview2.exe	99
PID 3196 wrote to memory of 4964	3196	msedgewebview2.exe	100
PID 3196 wrote to memory of 4964	3196	msedgewebview2.exe	100
PID 3196 wrote to memory of 4964	3196	msedgewebview2.exe	100
PID 3196 wrote to memory of 2784	3196	msedgewebview2.exe	101
PID 3196 wrote to memory of 5040	3196	msedgewebview2.exe	102
PID 3196 wrote to memory of 5040	3196	msedgewebview2.exe	102
PID 3196 wrote to memory of 5040	3196	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4144.2900.8907397243014899807 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView /prefetch:4 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7fff1d7b5fd8,0x7fff1d7b5fe4,0x7fff1d7b5ff0
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1744,i,4629215843620488413,3604798337959825009,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1744,i,4629215843620488413,3604798337959825009,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1744,i,4629215843620488413,3604798337959825009,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3488 --field-trial-handle=1744,i,4629215843620488413,3604798337959825009,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=1744,i,4629215843620488413,3604798337959825009,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4512 --field-trial-handle=1744,i,4629215843620488413,3604798337959825009,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1744,i,4629215843620488413,3604798337959825009,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4528 --field-trial-handle=1744,i,4629215843620488413,3604798337959825009,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView" --webview-exe-name=2026-07-26_ac34c19f9cb7097079a10a1365a62208_akira_coinminer_glassworm_rusty-stealer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=1744,i,4629215843620488413,3604798337959825009,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5b96385dd7635e889dda88f6f6fa5bc2bb2fbfe
    3⤵
    PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 201d7812aafd84f70e4b7dd2808598df0ab9d6a0d3f556b35bc290538aa25cc0
MD5 1f1e9f3cd3426aaf78ad3f29ab96dc2e
SHA1 df2d6ab3565053c4a496e7d723106786005d7ec2
SHA512 3ca3eddce167077957d61d697b25d87ccbefb71586fce82d416ec103c17e1de9defaddf949b7a71b9c55c6540169f34fb11b3b4263a14838071e0c04dc6f6405
TLSH
T1ECD024133303C134C03034F31003F10C05C0C50F4005D041543CCF1D5F144540F03541
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 82aea5196b6e8ecd9a0f5212ca3c8002bae7824d32b6f8077b7c2cf4af338ffb
MD5 a03f94c21e3decf11d22a741bde7cca2
SHA1 0bd8845586d5301fccaea80ba65f10ced615220c
SHA512 6263f0718cc07d62a8901634d5b3011368b7feebacf7ed752d80658105944d987c44930f40065d3df264ebc4f41f383045a0a7ae9ddabbffd261dd9f269aaa88
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

9aab1e4a-e528-4a10-8676-6b6786edd9f7.tmp

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\9aab1e4a-e528-4a10-8676-6b6786edd9f7.tmp
Size 6KB
SHA256 034c514d1b72b3484026bcea39784677e9859aefa673606ed72c3cc16187e516
MD5 a17e1ad8dcc11bf0142c7f6f4ff7fc3c
SHA1 603a3c5c08813c4e75edf1ee303e61deff3845c7
SHA512 f53154c5dc8945013507d7d1ddd0f20793b6183c90bb7455415b9f3a27c35447d19585243fcd474ad3122b116af1855deb17d047421ecac4f12ebebd66f4a169
SSDEEP 96:stR+/dcawLMhARqb94JkTao5h16Z/RCs7/x+6MhmuecFRTa1ehRwRweYj0K+geO6:stE2aWJpoC0sV+FRFaQhCCdnTG6K
TLSH
T184D1A4076E24697F4CCAE119FA39BE16E2F65062A5D11E58EBF8461C04DA6CC730782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 bd259f11dbf12da525ae9d69bfde9840e1a1e34198a840058c9efc700c73a053
MD5 66b23e6f18409a9799399ef9d84dba21
SHA1 711d5050d66dc06129898a43d8378b51d83e39fc
SHA512 8f3091e68b0df09da022fa2a349107cd6f4fde453fe163a89fa6984fe9a45fd3ea36fdd5a0fc62d11be227990f223d7722efcf5a4668fa22fd47ca9a1f2127bf
TLSH
T17C11F0C00AD2A05ACB050673C0EA099E75B51327EBA70FF34D701835486ABD88B98042
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59765f.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59765f.TMP
Size 48B
SHA256 190dec7da3cbea1024d0d9cbd7693c469103b4d1151e36bff6e84098860c9f4c
MD5 bea2ba696794ec7bbbce0391a4151f5a
SHA1 aa2e1e785c45881754e459f018234a9730b3fedf
SHA512 29f3392200b651f312c94a69f451d52aa918887e0dbc7746548a59aadf2d3f31e7c426c1ea0db9d6521e1150f2ec41826e385738d7a832892faf574d0c949801
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 35abd390fa1529066c8b2d7e350ea02c0ce4248ea320a25ad6ba6016288afa2b
MD5 3eb57e88ac00294d06048759da66f036
SHA1 e0da64e91b67898438e4a91873889f42a76b5493
SHA512 cfc011ca89037cb9d541be16193a6efb654cd45d9b4102beb162af4fa9f95078f162e2266e66b9eb9bec5efb123e0234ca017ad5f1c7e71de7f2cc7825e5e9d4
TLSH
T1782170F7C3B445AD9E5292FC3B2C2A2B8E1D451503AC295BCED8DB4FD3F1860D24564A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a30f4.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a30f4.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 0afc5417a5e4b9fd651f1bcf80fa585506cd7be788505f1f64695da7a9d9e12f
MD5 bcb22b1c07769ab61fdc1d717d92b7f6
SHA1 110d3a0a1994a828607599bc0759b86daf161514
SHA512 a0bcaebcbf5ca1a81d0be408a50515be3f86a6ca05a22e2c7495ffaf29bb0eeeee7a5c36c515d22226206a967e36f264533acc9142de47921d519999cc3c52c1
TLSH
T100014E57D6BAB87B6018196A5D40FB051A76F534C3C3B4F4DA6A406CB0C14F70657823
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 032ab775ef71854f3fcb30a7f44c73f876e71d11ce578e93639763d0e6cb2134
MD5 c594cce862fbf65227a76f4d46b24e9f
SHA1 1d298682fd58ebb31601f848b085b443e7588da0
SHA512 0c5827c1f3acfa4663902698cdc028b7cdf827c7ada1fda4a03da31ba9ce00f339b670244e78b57416b50d01aa1e991836eb87d6e08aab7b9057309caae4befe
TLSH
T10D014E5BD6BAB87B10181A6A0D40FB056AB6F93083C374F4CA6A406CB0C18FB0647423
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5989b8.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Network\TransportSecurity~RFe5989b8.TMP
Size 691B
SHA256 cc9d3e02ad5eb55a4a81a0b04d7c94cc4222939f733bf9349b3a6ea2932f6bf5
MD5 7d4324a0b8c8295f9869df85faa804d1
SHA1 86fd5629037b059cf6531a39e7d47650e88fcd97
SHA512 11889758029aa06923ed2583449c18ca38245a8a42b8e01a328dd90c11e4fad95a49b37d9e9c819f241ca3d82b7794efafc5c04959ec1dd2a5727eaa1e4e04a0
TLSH
T138014E5BD9BAB87B50181D6F0D40FB051A75F53583C374F5C66A416CB0D14F70647413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 3f733699868adf5102d879eab24b938e7399d0c92b3fbd9939479fdd95da0daa
MD5 4e1221bbfc5546a83a1908c4c3198717
SHA1 d6f50a168319ec26ab8b04a6a57c8dea0095f792
SHA512 422ffcb3db186ad0a85fdf488171d312941e3ab08809da278311824fd3005f9f24b0df26c478eb1e5e09a15810e282cd994245096d37930745cfd863af185670
SSDEEP 96:stR+/dcawLMhHGRqb94JkTao5h16Z/RCs7/x+6MhmuecFRTa1ehRwRweYj0K+geb:stE2a4JpoC0sV+FRFaQhCCdnhG6K
TLSH
T1E7D1A5076E24697B4CC6E119FA39BF17E2F65072A5D01E48EBF8461C04DA6DC730782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c1e24f280b19dcfb570d71353489b7bfddde6acd4268720700d83fbc645daeab
MD5 e794ebe44f5612552869c2fafe4cdeff
SHA1 ce59c106df1a10019600a22d611ea68042d9af53
SHA512 be99f6eec0c5ce342fa43dec2b753a8690a86377378e39dc21985555f9104679e477554f6ed025bbdd4730d8ec2346df08bbfd9f9d0cbd9aa1b3af8e3751c2fc
TLSH
T1A5A00291D2500552C08002B5544B11C466116B35D16116534AD8C2D59CD035C551D280
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5972f4.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5972f4.TMP
Size 48B
SHA256 651c02ef6ccccf4060ce0f3d33af3ba04b74f200a69e24eec56b7c2d8781d355
MD5 e76107e8ca2f6bfa4b77840cf5c4562f
SHA1 b14c4948d1d4b846a51080587989aace8b1a32a1
SHA512 78ed3ddb05c9f2c5da6e0f201f54fc11238145bf6cb22cd47b2bda9a66ec263ba2545ba60ce06c4aeea577e77e8f57346ca46928d65546c405474c26352708bb
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 15KB
SHA256 17421e21d324d81f960715253a020923cafa359b7d64c086e8d2965fd34ae785
MD5 75164f61741d415445a72b16f3254014
SHA1 44cb95eaecb9bece1a6ce496acd453ffe8619a09
SHA512 9f6442177322514fed2a28a1787ce3176a61ec19fe2185e3cba97fdc0a8efa7d67190d043c3363bc40544360a1486885b3bc6304351b5755cb652f3da298a2d9
SSDEEP 384:l+aQikB+z/xvxjg/qhE6NBSXjSYEIV3q/9zl:w/UxvxjgC+J+OV3q/Fl
TLSH
T1C3729D3B95782D3795F3E605794D4F8BCFB884B291C23AA84EED5F0D06C76A81342827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 2KB
SHA256 82026638133add0350e17391f485ca4b73d05632e82102faaee11572f8b94413
MD5 15d1506271b86924bc708e79406ac204
SHA1 6d474792cace127848d51a40104af51bb406bb0f
SHA512 96b730e0a9ee011ccecc93981e7444802ff02ca2083acb9ee7431b21ebed610a3de909e7616a8af4ecc0ca8d6dd77888440cd7a77587ac180d46db98c31c08bb
TLSH
T1F051A73379245A3BC9E29684B9DABF135F7590A69B522F545EDD0F0C00D6A2C2742C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State
Size 3KB
SHA256 3acdea03e0e55ac2e89c8ebe9bd938b13e2c3f350fa141e3be759ce440f99592
MD5 442b88fb4d2ff5cd5cf606585968ed87
SHA1 c8a9908a76fdcb80d636ccd6399a647be3367143
SHA512 f33d3526540e2c43ec1a7429ac5294a49b2fb679c1836a0c074e895bcae069cf9025befdf0ec0fedb56bb23c8d99dbf406b070c622a841054570f6326781411e
TLSH
T1F06173376974993B8DE29A45B8CA7F027BA55067E5853F98CAEC0F0C00D769C2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe591c48.TMP

Path C:\Users\Admin\AppData\Local\su.orion-security.launcher\EBWebView\Local State~RFe591c48.TMP
Size 1KB
SHA256 68af3666538cf1669e7a7177e299ba3756efb7e5dc58f66d957a10af8d52076e
MD5 49d6efeb02401855681a28937f4e9a08
SHA1 c0ca6257b613ca98ff52061ea78c3a29c6a243fe
SHA512 a0ac7edba6965d2b9d7aae6d6734dd3b09340e2ad0d96c4d9addce14cb24500141a5e52bbacff63f0ad22942910162b6310567f6e2cf761808782437889d84d5
TLSH
T1672195B3E5A40E3AEDC1668230D6EF032F7150AA82410F4419DD8F5D01E6A2C262BC37
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3196_1284610822\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/440-363-0x00007FFF3ED00000-0x00007FFF3ED01000-memory.dmp

Download

memory/440-364-0x00007FFF3F390000-0x00007FFF3F391000-memory.dmp

Download

memory/2784-464-0x0000023A1E520000-0x0000023A1E521000-memory.dmp

Download

memory/2784-458-0x0000023A1E520000-0x0000023A1E521000-memory.dmp

Download

memory/2784-460-0x0000023A1E520000-0x0000023A1E521000-memory.dmp

Download

memory/2784-469-0x0000023A1E520000-0x0000023A1E521000-memory.dmp

Download

memory/2784-468-0x0000023A1E520000-0x0000023A1E521000-memory.dmp

Download

memory/2784-467-0x0000023A1E520000-0x0000023A1E521000-memory.dmp

Download

memory/2784-466-0x0000023A1E520000-0x0000023A1E521000-memory.dmp

Download

memory/2784-465-0x0000023A1E520000-0x0000023A1E521000-memory.dmp

Download

memory/2836-103-0x00007FFF3F360000-0x00007FFF3F361000-memory.dmp

Download

memory/4144-0-0x00007FF6B5240000-0x00007FF6B5AD7000-memory.dmp

Download

memory/5652-289-0x0000025B64940000-0x0000025B6496A000-memory.dmp

Download

memory/5652-44-0x00007FFF3F360000-0x00007FFF3F361000-memory.dmp

Download