fd00c7218df0e84eb9870001348769ee2ea5954031c3c38713b8144735274ad2

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe
Size 11.8MB
Sample260729-bepffadq3v
SHA256 fd00c7218df0e84eb9870001348769ee2ea5954031c3c38713b8144735274ad2
MD5 67d6ab1f187b83b0703938781fe56348
SHA1 18aed23305f3c8b0c374a1712a47ffada457c771
SHA512 5872b4d6c1e62f4a310eaacadd9e01a4b072d1cd0cefd4abf568007ebbc68b98bc9b3cbcd9b3d84bb0567c11b0290d7755e0b76ad7e712e3e334b1bd1770174d
SSDEEP 98304:h1rWTF1pK2JI4ZlCJ03N0Y1YAWigxw8ItVNn8D5efIe5+4AjgYA/Qzd:z8F1pK2JI4ZlCJ03N0Y1Y/JxwDVBNq
TLSH
T111C6E7257B5B996CD09BC47483478A720A7130DB0B39B9FF448496382F79BF56F38229
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 48 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_2030389017\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-la.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	msedgewebview2.exe
2860	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3000	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1324	2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 3000	1324	2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe	89
PID 3000 wrote to memory of 1468	3000	msedgewebview2.exe	90
PID 3000 wrote to memory of 980	3000	msedgewebview2.exe	91
PID 3000 wrote to memory of 980	3000	msedgewebview2.exe	91
PID 3000 wrote to memory of 980	3000	msedgewebview2.exe	91
PID 3000 wrote to memory of 980	3000	msedgewebview2.exe	91
PID 3000 wrote to memory of 956	3000	msedgewebview2.exe	92
PID 3000 wrote to memory of 5964	3000	msedgewebview2.exe	93
PID 3000 wrote to memory of 5964	3000	msedgewebview2.exe	93
PID 3000 wrote to memory of 5964	3000	msedgewebview2.exe	93
PID 3000 wrote to memory of 2580	3000	msedgewebview2.exe	94
PID 3000 wrote to memory of 2580	3000	msedgewebview2.exe	94
PID 3000 wrote to memory of 2580	3000	msedgewebview2.exe	94
PID 3000 wrote to memory of 2580	3000	msedgewebview2.exe	94
PID 3000 wrote to memory of 2580	3000	msedgewebview2.exe	94
PID 3000 wrote to memory of 2140	3000	msedgewebview2.exe	98
PID 3000 wrote to memory of 2140	3000	msedgewebview2.exe	98
PID 3000 wrote to memory of 2140	3000	msedgewebview2.exe	98
PID 3000 wrote to memory of 2860	3000	msedgewebview2.exe	99
PID 3000 wrote to memory of 3720	3000	msedgewebview2.exe	100
PID 3000 wrote to memory of 3720	3000	msedgewebview2.exe	100
PID 3000 wrote to memory of 3720	3000	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.1.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1324.4816.16163748885320039486 /pfhostedapp:da9ab54476911e7ff14423b8c6163bbf198ed8c2
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView /prefetch:4 /pfhostedapp:da9ab54476911e7ff14423b8c6163bbf198ed8c2 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9cf355fd8,0x7ff9cf355fe4,0x7ff9cf355ff0
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView" --webview-exe-name=2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,15093547564301321025,972983612390773385,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:da9ab54476911e7ff14423b8c6163bbf198ed8c2
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView" --webview-exe-name=2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2108 --field-trial-handle=1756,i,15093547564301321025,972983612390773385,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:da9ab54476911e7ff14423b8c6163bbf198ed8c2
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView" --webview-exe-name=2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1756,i,15093547564301321025,972983612390773385,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:da9ab54476911e7ff14423b8c6163bbf198ed8c2
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView" --webview-exe-name=2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3376 --field-trial-handle=1756,i,15093547564301321025,972983612390773385,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:da9ab54476911e7ff14423b8c6163bbf198ed8c2 /prefetch:1
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView" --webview-exe-name=2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=1756,i,15093547564301321025,972983612390773385,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:da9ab54476911e7ff14423b8c6163bbf198ed8c2
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView" --webview-exe-name=2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4444 --field-trial-handle=1756,i,15093547564301321025,972983612390773385,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:da9ab54476911e7ff14423b8c6163bbf198ed8c2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView" --webview-exe-name=2026-07-28_67d6ab1f187b83b0703938781fe56348_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=1756,i,15093547564301321025,972983612390773385,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:da9ab54476911e7ff14423b8c6163bbf198ed8c2
    3⤵
    PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6c71000c-968c-4214-a59c-a1b7a421945a.tmp

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\6c71000c-968c-4214-a59c-a1b7a421945a.tmp
Size 3KB
SHA256 f96496a26d56134ea780d75d85bdbbc3d0b720e8d7b95b321db8162322cf253d
MD5 ac9364a68a2bb119e189ed47f94acb7a
SHA1 ee84c41bd311e03f71da9693c5d0517778f3fef3
SHA512 e9d2decae919922a8cc0b3f640d2980b61f813421d89e9aa62ee8dd7809a577ae3f4779d3e10834ac1ae413f4ba4dbc7613594471dd58beb302f644805db8fde
TLSH
T1A06196776974997B9DF29A05BD862B17A7A45023D9853FA5DAEC0F0C01D73CC2341C2B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 36716186a80a96576000a2b53ff3123ea5c0b3b3f7504daf75406b33df75b7ea
MD5 c8ad5892ac28182574e61557f474efb0
SHA1 de80e766110ae9ccf1fdfc2108ff27b419abe512
SHA512 9b4a65a25127862e9b301a74d0549cb709d386bff9e493e6c3c00cb6b11f1f8aef5b90d6ab63e9b72f341fa6377acd84489f2b3fc410cc818741bde3753ebe38
TLSH
T1FAD012133B410634C02024333102E12C0480C10B805944905439856D1F080601D1AC43
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 05c2414001d0e46857039acc723f3d389cdd3fe5945d70ae8fa14835a78fbe4c
MD5 4d15acbc9d8907bc08575c9fb1adbeb2
SHA1 34e953a9364b127b7ae7972bc74f6e14015babd0
SHA512 9370410fc989b6ad7826077eb04406247eeb13d63fbcdeb2b0e67a588db1d201bf3d9140bde2c2e62b6aed83682c3f1abb96a0fc7df1b23309176fe3f659c322
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

14450de3-19ee-484d-a06c-b72f0f340623.tmp

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Default\14450de3-19ee-484d-a06c-b72f0f340623.tmp
Size 6KB
SHA256 d079e9add926f1ea397736dbf1cc8672adb8d5cfbe6bcab9c13d1c26194decab
MD5 2afd1df6a4e9709102441f2ee405005a
SHA1 133588403b9f3229eb2d44bada8ecc93d7488977
SHA512 50eb5485d3c17cff693df33c38e671a66d61d2974248146bf2e6548f71c99c875d260b6cd2910d080b1dd07cf0e0f7e9b0b2ca1922183cabe7b319654bddc0d8
SSDEEP 96:st2/d4X3ob9UkMo5h16Z0/s7/x+6MhmuecJNN1ejefK+gn28XM1C7K:stuyNPon/sV+FdNNQjtNG6K
TLSH
T103D1B7065E28A9BB4CCAF109FA35BB07E2F9647271D51E58EBF8465C04DB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 88efd37c85edecb367d4bd88bd068edb56e2d4f12e7fcb28f2bf9c179d3db649
MD5 8f51d586003972e7d6f564eb3ea71106
SHA1 a905b4b36d46d6fb8e62e01c826e573f2727f5ed
SHA512 7b7fdeb8d1edc9f0115a9b82a7208e0dc3a7960406c0b72ac9c81a54e0ef93cb4475ca1d9e0940489042cb0f2a7bbd91958f588ec704a9590719c941e306dab6
TLSH
T11DA0025586A41403D15157B150D13654BF3268B686135745C5D604ACE9B2346D371450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59522d.TMP

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59522d.TMP
Size 48B
SHA256 867c274830af521eb0eb5f29da222a4dda8b727b6d6a39ade81dcfa1cb6a9078
MD5 e5b1676071cc7dab9634d6fc0df3deaf
SHA1 c8f095cd6a786ff4dc932f4ae5c6da6603e4b082
SHA512 ec37142016cd5ccb8539a26a3fd6c8010d8f8758b9711969642dadcb26faea9872166a09202e8291786deffd31c0f3a86de549b0450f72b8832f059d6641f7d0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2869.TMP

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Default\Network\Network Persistent State~RFe5a2869.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

a671be86-92b6-4826-b3bb-890bdce3bd3d.tmp

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Default\Network\a671be86-92b6-4826-b3bb-890bdce3bd3d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Default\Preferences
Size 6KB
SHA256 462b94b9e29bcb5ab83754bc38cfe809eebcf502950b171838cfb9d54d4352d2
MD5 3dd1607f56724177f25a5e3c86edb1d9
SHA1 5ad0517a3eda45de0fa1f23ddf154fec2cbe9199
SHA512 870f2a9279c37db4bc66e968a30348af996a94a2e09dad6714e5010fa7490cdefd335196a3dac01bea1e70ecaac6be36e3c46caef37b5b3834f4048886feff07
SSDEEP 96:st2/d4XmGob9UkMo5h16Z0/s7/x+6MhmuecJNN1ejefK+g328XM1C7K:stuyHPon/sV+FdNNQjtFG6K
TLSH
T1C5D1B6065E2869BB8CCAF109FA397B17D2F96472A1D11E58EBFC465C04DB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Local State
Size 2KB
SHA256 6e0b5eee97b7e98ac507592ec9a0c213fd67b6214d686e47fa5c12d101e7fce2
MD5 525259d1ca21faf8e319b100fe7725a7
SHA1 79a87cf906e07a9aa736da0e869015ee6121d716
SHA512 0115e666691dd53df9fbc425780095bb123da15f5c33986e5fba9ad4f46cb94415171f37a6ed9bd65e371af2bb9d4028fc59c44e0c1b2ddd2081e072cffa9dac
TLSH
T18951B57368245BBB99F21709BD4A3F238E749062DA561F61AAEC0B0C01DB29C2341C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Local State
Size 15KB
SHA256 bd80aa1ae2133f5c7390ad84ac5cf111a987c235dd51b232a6187c42ad74b4d6
MD5 f5b71cc1339e405a8cef9fff8d5adecf
SHA1 4368c203f66b96344781b4351c67b52dbed16741
SHA512 facced423e836be56ab5835434980e806a62b4a453766571555ddc7a95466c73c436e317901d6bf6c5b1a25c63c746d442716f7a56a8e7e26ff8b894bad23c30
SSDEEP 384:d+aQikB+z/xvxjg/qhEwNBSEtBiB6oIbf9zz:o/UxvxjgC+l4oIrFz
TLSH
T1A7729E2B54382E67A5B6FA057D4D074BCBB898B29182AEB84DFD5F0D06C72E80342D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590110.TMP

Path C:\Users\Admin\AppData\Local\com.lukas.showri\EBWebView\Local State~RFe590110.TMP
Size 1KB
SHA256 5e05d6b93eb6268c0a1a504d54299f1a385010c054e83f1f8cc508a5ea93de54
MD5 438d440b66e35cff1d3bc168874c8918
SHA1 c55d6a86ddebe0c49a2eed77338f700b841e010a
SHA512 21199b4033ce7248f95ded0f92cf446c4af12b905cd7fa8583852d6394402fdf78c1afda1b78040d46af2336d89e82236538b9a434db9ddff4346556ff213391
TLSH
T1CB2192F3E4700FB7B891220A7616AA574E209063C2068F50A6EC4B0C02E21CCB629C3B
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3000_871909073\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/980-26-0x00007FF9F01B0000-0x00007FF9F01B1000-memory.dmp

Download

memory/2140-251-0x00007FF9F1310000-0x00007FF9F1311000-memory.dmp

Download

memory/2140-252-0x00007FF9EFF80000-0x00007FF9EFF81000-memory.dmp

Download

memory/2580-102-0x00007FF9F01B0000-0x00007FF9F01B1000-memory.dmp

Download

memory/2860-295-0x000002636BFE0000-0x000002636BFE1000-memory.dmp

Download

memory/2860-297-0x000002636BFE0000-0x000002636BFE1000-memory.dmp

Download

memory/2860-302-0x000002636BFE0000-0x000002636BFE1000-memory.dmp

Download

memory/2860-306-0x000002636BFE0000-0x000002636BFE1000-memory.dmp

Download

memory/2860-305-0x000002636BFE0000-0x000002636BFE1000-memory.dmp

Download

memory/2860-304-0x000002636BFE0000-0x000002636BFE1000-memory.dmp

Download

memory/2860-303-0x000002636BFE0000-0x000002636BFE1000-memory.dmp

Download

memory/2860-301-0x000002636BFE0000-0x000002636BFE1000-memory.dmp

Download