b2ed20ee299afef2946104c58b45fbe65530a2c1072e42022d36e857149284cb

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
Size 7.7MB
Sample260804-n1evcayhkf
SHA256 b2ed20ee299afef2946104c58b45fbe65530a2c1072e42022d36e857149284cb
MD5 58ec117ab037fcbd8ef4e504d48f129f
SHA1 b01cbc27b8c0711b724c0fab511bd7ad5f33f37d
SHA512 ddde74cd533bac057e25a4d396fe8ba5b659251c53c3b90a8fe77edf43532f1b50ed32c1489bc5d806bf4e10cda67c2faa694f2176344043495281b2afeb6568
SSDEEP 98304:eyLijAY5XekPh8gz+5KNxzCUICSl4h19B6CJbmVp9MIRpwWn+pr:/W5ukzaujSM8z0
TLSH
T1EE867D03F6A281E8D06DC1B4835AA633FB32B88D0934B2AB5BD44B312F56F506F5D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\recycle\URL Protocol	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\recycle\DefaultIcon	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\recycle\shell\open\command	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\recycle\shell	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\recycle\shell\open	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\recycle	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\recycle\ = "URL:recycle-launcher protocol"	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\recycle\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe,0"	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\recycle\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe\" \"%1\""	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5020	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4344	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 5020	4344	2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe	89
PID 5020 wrote to memory of 3528	5020	msedgewebview2.exe	90
PID 5020 wrote to memory of 4320	5020	msedgewebview2.exe	91
PID 5020 wrote to memory of 4320	5020	msedgewebview2.exe	91
PID 5020 wrote to memory of 4320	5020	msedgewebview2.exe	91
PID 5020 wrote to memory of 4320	5020	msedgewebview2.exe	91
PID 5020 wrote to memory of 6104	5020	msedgewebview2.exe	92
PID 5020 wrote to memory of 2044	5020	msedgewebview2.exe	93
PID 5020 wrote to memory of 2044	5020	msedgewebview2.exe	93
PID 5020 wrote to memory of 2044	5020	msedgewebview2.exe	93
PID 5020 wrote to memory of 1916	5020	msedgewebview2.exe	94
PID 5020 wrote to memory of 1916	5020	msedgewebview2.exe	94
PID 5020 wrote to memory of 1916	5020	msedgewebview2.exe	94
PID 5020 wrote to memory of 1916	5020	msedgewebview2.exe	94
PID 5020 wrote to memory of 1916	5020	msedgewebview2.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.6.34 --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4344.4524.18137892220206790671 /pfhostedapp:4c829350940203b86e9a222c9c57a09686d932f9
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView /prefetch:4 /pfhostedapp:4c829350940203b86e9a222c9c57a09686d932f9 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ff897915fd8,0x7ff897915fe4,0x7ff897915ff0
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.6.34 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1732,i,14210721524734064054,15531848308323527413,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4c829350940203b86e9a222c9c57a09686d932f9
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.6.34 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1732,i,14210721524734064054,15531848308323527413,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4c829350940203b86e9a222c9c57a09686d932f9
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.6.34 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2420 --field-trial-handle=1732,i,14210721524734064054,15531848308323527413,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4c829350940203b86e9a222c9c57a09686d932f9
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView" --webview-exe-name=2026-08-03_58ec117ab037fcbd8ef4e504d48f129f_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.6.34 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1732,i,14210721524734064054,15531848308323527413,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4c829350940203b86e9a222c9c57a09686d932f9 /prefetch:1
    3⤵
    PID:1916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cd1e59beb8e8ff62de3b5e3145ee5c6b55528c6fdd7a7e925a464ccd59b0cbaa
MD5 68ad5c5619ebe233886fe72b02fd00b5
SHA1 f45a404a58ae801f1ecbf3b9732e578e82c2b62c
SHA512 7c1af40bba8bf266ef44a8afa70400d3fe75e0ff78886ab83916f5acf2112bb768fdb86d4f898a82788c809b5c51d092b4048159f67194958e2f0309e8fb10f0
TLSH
T1E0D012167A2206F4C0102C330003710C0440CA2B400B81415829951D1A040640E03881
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e80e13bf02e6feabbd60ff990cf2fc3e0214ddf2642be9767ec7e77102ffd522
MD5 8048e51b4b71db82b70c7c8c40d93205
SHA1 bed6781fe2ab5e164b4aee18d36f86412eac940e
SHA512 65da4d0424150a7f22dfd08a127f86e92a3f9b62ea4e8dac114a23a1a51b3ab8d1e87e435a816342801d707cafa82dccbd2a27dfa66f7e226ce73fe49942999c
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 737aaa0e8c3a5189f602aa79f588d2723b83551690990e1214d6981d4bcc3c02
MD5 55713cd2a092890ad9e92104ecd176b3
SHA1 ce94a74e0652ababdc5fed96a3ff86f36d80452a
SHA512 dc1bf3709da9cbae8044aa8536ccf55c3973b3ae83e38e031ba7d15aab5b645265302197ff4e74ef1d197aae8880d7c0cbd20ef83f876b4c9dbffe95ce9115ab
TLSH
T113C09209C50C4024FF03A7B8A9E7007931BA0C7D45533DFAC0CC017D8A66BB1CE60382
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59206f.TMP

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59206f.TMP
Size 48B
SHA256 c2bd6b9a667d7cda87fc246a9bb2392683dfc5ff496525bce59e8d4de2786a1e
MD5 9ebf12dc1ad364aee83be483a8487caa
SHA1 9f607ff6cb358c73f43059ffa92c3409e8f77898
SHA512 c2a0ee20d5df3f2bd7739fa01e1107b5ebf31e73945f51ead1851de24fb88ed81861f0eeebc9915900995b4d548cf9eb81f3d5e49e1dcd53adb9533578baa4e3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

172a50dd-6140-44ab-abc6-6784d2702277.tmp

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Default\Network\172a50dd-6140-44ab-abc6-6784d2702277.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State
Size 2KB
SHA256 e96f7861911dfe8b8268dc5b1cd5eb9f341d503fdc9a7be52731e9818601d069
MD5 b112f4d20637beae2d91f0c01177085d
SHA1 2aa0e3417ab4ca419459efd3b6b37b15d4aff9bf
SHA512 f7e404426964d93e4026154bcd01da868d0f50fe3de8cea4c423f885aaf21b100f29c09d94144c49caa23830477765b0089d30707dc219cc54e9214a9e1f51e0
TLSH
T1765184737D149B778AF686447C4B3B738F7690A19A521F20AADE1F18018719C2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State
Size 3KB
SHA256 507bdc9e8dee7900cb50f705efc63ca03ba3208761f762330000640f14391a3e
MD5 3a7afb41791508db3a15a5d8e858ec95
SHA1 43ef0fda41038ba49bcca27a177f97a2bbbf3a64
SHA512 fe656e02b858675e8933577030e8bf73c67b999e5e5081a1d166777cc85dcf0935491db1bc03f1585dee12e2962f7747d66784ffb0b95968cda21e43c7ff403f
TLSH
T19061A7726D34AA374EF6DA44BC863B26A7A25063D5813F64DAED0F0C01D729C2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State
Size 3KB
SHA256 ad8709dd41cb2f5b84b82601dfc7a6dd4ab6f5fa4e58b935d404141cf3e01e0a
MD5 2aca47c6b942396055f89ff903489742
SHA1 62520e437c0abffe28242f40dc2d17c499b75dd8
SHA512 b2ad47e2bcf209f8ef10b93abc854fbdf163baa5eda1ad58fbd8590a55d0c7ddd63a85c8bb96d7f81b67130327e7380a4ca15b1378af8037cefe079c71c53335
TLSH
T10D81A5266970A9374EF7DA49B8463B13A7A29063D5856FA4EAEC0F0C42972CC1342827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59195a.TMP

Path C:\Users\Admin\AppData\Local\recycle-launcher\EBWebView\Local State~RFe59195a.TMP
Size 1KB
SHA256 d2e7010d9edbd2b48a3e38691bd86b443566616ee68f720d4c9333a3688aa5c3
MD5 046894a8288fdeb67294b0b199e50723
SHA1 78fa8cea00ad72373bac0ff65d8f65fe964bec1a
SHA512 6bc24fc9f6c53d16192d8af98f6fe077b04f626cf53c50c5f3004a4b1c8b3ae431c962cf4fa833ebf9e24bcf9d20cd290582db5df3587476d5e3716fe4f83163
TLSH
T10F2192B2E9244F739EEA9385240B7BA38F22606681518E00A2CF4F2C029B09C6213C37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1916-98-0x00007FF8B73D0000-0x00007FF8B73D1000-memory.dmp

Download

memory/4320-29-0x00007FF8B73D0000-0x00007FF8B73D1000-memory.dmp

Download

memory/4320-293-0x000001D213CB0000-0x000001D213CDA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads