6c1f17b7a523930a7cf8d91d6adc292393736f4908227665be11dbdc30980eca

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe
Size 12.4MB
Sample260804-v9bydaar7x
SHA256 6c1f17b7a523930a7cf8d91d6adc292393736f4908227665be11dbdc30980eca
MD5 e85fb42dac6d227974a90977693c28cb
SHA1 225af6fe863cee69d75dfa037339899fff826048
SHA512 963d6af0bca9b1a2f630e2a25fa24861c5525ad96d567177ccaa586762251c26c0c62e145c5866983b538ff3a9c8a52f8a91bd02216c0d9de8ac13933253ae03
SSDEEP 196608:1Ym+S9H8OHtSudwlii5+ID/u4UfWa5k5+HQtRNw:NN8UttGL+ID/u4Uft5rHQtRN
TLSH
T14BD6AE1AA7E901E8D077C17CCA9B8A43E3B234551B7197EB0150862F9F37AE15E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
5040	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe
5040	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe
5040	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe
5040	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe
5040	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe = "11000"	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 47 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5600310000000000e95c317212004170704461746100400009000400efbee95c3172045d238d2e0000005e0000000000020000000000000000000000000000003eeb7d004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0\0 = 6c00310000000000045d3b8d100046494e414c5f7e310000540009000400efbe045d3b8d045d3b8d2e00000099c6010000000c00000000000000000000000000000039306d00460069006e0061006c005f005a00690070005f0054006f005f00530065006e006400000018000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0\0\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c31721100557365727300640009000400efbe8158a93a045d238d2e000000880600000000010000000000000000003a00000000003ef0970055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 = 5c00310000000000045d248d10004155544f4b527e310000440009000400efbe045d248d045d3b8d2e000000aac5010000000d000000000000000000000000000000183728014100750074006f006b0072006f006d006100000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95cd080100041646d696e003c0009000400efbee95c3172045d238d2e0000005300000000000200000000000000000000000000000022771a00410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 5600310000000000045d248d1000526f616d696e6700400009000400efbee95c3172045d3b8d2e0000005f0000000000020000000000000000000000000000001837280152006f0061006d0069006e006700000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0 = 5400310000000000045d3b8d1000496e666c757800003e0009000400efbe045d248d045d3b8d2e000000aec5010000000c00000000000000000000000000000039306d0049006e0066006c0075007800000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4508	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4508	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6036	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4508	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5040	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe
5040	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe
4508	explorer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 6036	5040	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe	89
PID 6036 wrote to memory of 5512	6036	msedgewebview2.exe	90
PID 6036 wrote to memory of 4800	6036	msedgewebview2.exe	91
PID 6036 wrote to memory of 4800	6036	msedgewebview2.exe	91
PID 6036 wrote to memory of 4800	6036	msedgewebview2.exe	91
PID 6036 wrote to memory of 4800	6036	msedgewebview2.exe	91
PID 6036 wrote to memory of 1128	6036	msedgewebview2.exe	92
PID 6036 wrote to memory of 3496	6036	msedgewebview2.exe	93
PID 6036 wrote to memory of 3496	6036	msedgewebview2.exe	93
PID 6036 wrote to memory of 3496	6036	msedgewebview2.exe	93
PID 6036 wrote to memory of 4720	6036	msedgewebview2.exe	94
PID 6036 wrote to memory of 4720	6036	msedgewebview2.exe	94
PID 6036 wrote to memory of 4720	6036	msedgewebview2.exe	94
PID 6036 wrote to memory of 4720	6036	msedgewebview2.exe	94
PID 6036 wrote to memory of 4720	6036	msedgewebview2.exe	94
PID 5040 wrote to memory of 3712	5040	2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe --webview-exe-version="1.6.0 build 108" --user-data-dir="C:\Users\Admin\AppData\Local\Autokroma\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebView2DirectConnection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5040.1216.15018980713628452356 /pfhostedapp:5ecb7a3ec58eb007e9f3a5ca337e616ea91fb2ec
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Autokroma\EBWebView /prefetch:4 /pfhostedapp:5ecb7a3ec58eb007e9f3a5ca337e616ea91fb2ec --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff917b45fd8,0x7ff917b45fe4,0x7ff917b45ff0
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Autokroma\EBWebView" --webview-exe-name=2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe --webview-exe-version="1.6.0 build 108" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,2792475894084994793,16877220006062011310,262144 --enable-features=MojoIpcz --disable-features=msWebView2DirectConnection --variations-seed-version /prefetch:2 /pfhostedapp:5ecb7a3ec58eb007e9f3a5ca337e616ea91fb2ec
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Autokroma\EBWebView" --webview-exe-name=2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe --webview-exe-version="1.6.0 build 108" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1728,i,2792475894084994793,16877220006062011310,262144 --enable-features=MojoIpcz --disable-features=msWebView2DirectConnection --variations-seed-version /prefetch:3 /pfhostedapp:5ecb7a3ec58eb007e9f3a5ca337e616ea91fb2ec
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Autokroma\EBWebView" --webview-exe-name=2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe --webview-exe-version="1.6.0 build 108" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1728,i,2792475894084994793,16877220006062011310,262144 --enable-features=MojoIpcz --disable-features=msWebView2DirectConnection --variations-seed-version /prefetch:8 /pfhostedapp:5ecb7a3ec58eb007e9f3a5ca337e616ea91fb2ec
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Autokroma\EBWebView" --webview-exe-name=2026-08-04_e85fb42dac6d227974a90977693c28cb_akira_glassworm_poet-rat.exe --webview-exe-version="1.6.0 build 108" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3436 --field-trial-handle=1728,i,2792475894084994793,16877220006062011310,262144 --enable-features=MojoIpcz --disable-features=msWebView2DirectConnection --variations-seed-version /pfhostedapp:5ecb7a3ec58eb007e9f3a5ca337e616ea91fb2ec /prefetch:1
    3⤵
    PID:4720
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select,"C:\Users\Admin\AppData\Roaming\Autokroma\Influx\Final_Zip_To_Send\Influx_logs_TO_SEND_2026-08-04_18-41-53.zip"
  2⤵
  PID:3712

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 32d2b34986a905d3e94dcf1884fcd4c8283bdc0f0eec210e8faed53cfa0e65a5
MD5 77b770977cb88efc82960e23599b2634
SHA1 252f78222e40119e9e808762837524099bed4e8b
SHA512 37f779bc2959552a8c9d71d817120e1a8eea7ee6b37b981f77115e8a4df30e4ed915d1f13013ace357335240c1995f2ffb19d97ea4c0b9f7c6bbd46c91639570
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5d95e87c750db07f3a236ffe08ae207a136b345317ce695fc7a0c07c93caa9c6
MD5 30c189c9f9d3f62c5ac3cd883b64fea0
SHA1 d80358a9500d21de1e2335d46f0b49d0fc51e874
SHA512 379b6d4042488993a3647dd8d73d2f21d8de2e6d729939d9f842fba16c01516c2792f4deaaa8b4804f10bc64a92a304accbdf9a3b608f41b56a0d6cbe5f7485f
TLSH
T1ECD01222370141B8D41021731103B2084440C24B41054082553CC56D1A442E10D16461
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\DawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\Network\Network Persistent State
Size 276B
SHA256 bd6a72671edb5a52291c48b6846250fc823429124b3bf06f207e573a0ebcfe86
MD5 df59ce6b0edecbd31f8a212580a75f61
SHA1 3e1e61d06a023ec7fca6f5fafb0866b672a3e22b
SHA512 746d0398967b1c991377284b408ac73d377de4d31b02beda3409734c26241c8f82ff909e64c1b1abf2243406479144155cd518eee69dde5e15b6fd3157fbe796
TLSH
T141D0EBA6922028FEAB8683E00928B8238FBE0005832C5D5DC220B7258761458810CC12
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a22ac.TMP

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\Network\Network Persistent State~RFe5a22ac.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\Preferences
Size 6KB
SHA256 06b5667d4684e2787a6622cd6789b896765afba2483fa2d2fb426eb83781f529
MD5 3466cf0655fbd84569bca979e9c104e4
SHA1 115d773cfd927eca652e45858d1b1e4c01424de2
SHA512 e643e1f72940cc7231c55d1df9f0e2917c6d535f71b8d62195f2875721a2c56e9b72979e109f335ac1a15488534294b2e71d76dc93252a2926ff7eacc80893d2
SSDEEP 96:st5/digGBZkPEb97kho5h16ZjUxs7/x+6Mhmuecu/G+1eje4K+gH28XM1C7K:stdYg9GSoQUxsV+F8G+Qj4BG6K
TLSH
T109D1A7025E247D7B4CC7F619BA29BA43D2FA603265D51E58E7F8952C04EB5DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\Preferences
Size 6KB
SHA256 d307527ded13e0823ed74fa9faa214b201e88010df141b945e550fb4ebfb2ffd
MD5 d097530c4fead1a37836c5fd9e008169
SHA1 e3b5f6f50b25fc6cf0728206aca29bb164c8bd60
SHA512 3ace3cc2faad7de5ca88107f4184a090b3e07b7a15218116fae55f899834033882b1bf99f01888a9cbc9dc559576a56d93a9966530debf0d77051a2349847966
SSDEEP 96:st5/digGBZkPEb97kqBo5h16ZjUxs7/x+6Mhmuecu/G+1eje4K+g1I8XM1C7K:stdYg9G7oQUxsV+F8G+Qj4Xg6K
TLSH
T126D1A7025E24BD7B4CC7E619BA69BA43D2FA603271D51E58E7F8962C04DB6DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59bc61.TMP

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\Preferences~RFe59bc61.TMP
Size 5KB
SHA256 4246f94ad1e0af1940d5068a33842334c661f2224560a3f143e395ce6c0b127c
MD5 71e7b0e46c06ea79f82093c9e131a962
SHA1 7e6b6d1b1d50443010b9a643b3768258565b6d1f
SHA512 80cbcd29d7245e28e012043e227465bff3f674c3739c37037d4281a7ad6b45b4bea43784ef8d55bbe9ae1e98631617cfde51ea8a4cc0b4a7d3a002694f429d27
SSDEEP 96:r5/digGBZkPEb97kxdo5h16ZZs7/x+6Mhmuecmje4K+gp28XM1C7K:rdYg9G2o+sV+Fij4HG6K
TLSH
T123C197025E28797B4CC6F619BA39BA43D2FA602271D51E58E7F8962C04EB5CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Local State
Size 15KB
SHA256 82f056847ab5da6c48cb87bd9cbd293a332e1273704d192cedb93e18012b25bb
MD5 8c7790213ac489853b44ec948c29646b
SHA1 1841a541c4bf4026bd0baaaa53a8735c9ce78032
SHA512 5773970b79a98bf0366dfb43969d5e891d481b0f727eeffe0dcf26f0322cf522b91ea370994f0565037ac8afdb92504bf35ed777c1bf5dd3e5fbfd2f64a5f5e7
SSDEEP 384:C+aQikB+z/xvxjg/qhEwNBS/s45KKzd67iF9z/:t/UxvxjgC+XYKZ67KF/
TLSH
T134729E2B957A7E27D5F3EA05798D078BCEB994B251C16EB84ABD6F0D06C32980342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Local State
Size 2KB
SHA256 41fc7bae2f239fd879a45f3fbb2a496cba0ae69fd346526b92118b5ad352bd74
MD5 9298e24dcbb8a5b8b7ea0b17cb5bb7c1
SHA1 695a93717fdd599d65f5006bf5e6c6076db1c21b
SHA512 4858114bd6ab079cf7a3ccc0c58c2b2fd7d78a00dd3c56720a5c0bdccb8e50da0a50782aee7f100d9ffb0110f4996e10068301057d3115c259c31a87b8f565fe
TLSH
T1625172336816AF37C9E25B44758B2F539E3A91A2AB952F60ABED1B0C01D755C1301C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Local State
Size 3KB
SHA256 6043a5a3f87b473ea3626271196c5b41007ee1bcdfc27a940ba0be10b9f31711
MD5 a2ae2c84d111f2fa41880b9ff76abe03
SHA1 8616f2ac199f0869ac7340972e579efe9375a618
SHA512 fe261c1fb675eb28395a8e6bb70e2d5ff7bbfde55f7431ca558f29e981dfb991fcef96f19e76201bb8af8eab75e3c2f8c9e02fc19029d326a93dcc969f67c11e
TLSH
T1A36185366975AE278DF29B05B5C62B02A7695123E6C53FA4DAFC1F0C01D729C1341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Local State
Size 3KB
SHA256 5d5072855b9791df076ab197dfe287fcb577d55c540cbdee95d09a98aad91d45
MD5 d196b5418f1c35e73fe9cd19b926da84
SHA1 748b34f6dcdce50b02fbdb8a00ff073064dc8151
SHA512 df92ec30c9236b4388b3ae08f77c59bc9dce01f11e522a1680ec957a733ec56dfcecb99648e402ae4c2f1e040a6b050405077faf59ca89df7bd59c9ba7a69b9b
TLSH
T11C7185366475AE2B8DF29A05B5CA3B03AB695167EA853FA5DBFC0F0C01972981341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe596d95.TMP

Path C:\Users\Admin\AppData\Local\Autokroma\EBWebView\Local State~RFe596d95.TMP
Size 1KB
SHA256 2583f6cf812d00b9e0e0d54cff3ae9b43573a81e25360eb80f3209959f212043
MD5 84d28078d4491f1e8b89e6fce6e70694
SHA1 9ee3c0ba82569f43d231f7028591803a2fb34a28
SHA512 00dcffb9a92d4553c3d4e906b23077700e6b4672a3bffc6f6ab8c8cc7d3993d64bc0f949f35f7cbf2ce0e6ef343e9f319985b8ba239ef70708157fffbdd288c5
TLSH
T16A218472E0655F33ECA2234632876E975E35906782548F14B6FE4B1C12E205D8629C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Config.toml

Path C:\Users\Admin\AppData\Roaming\Autokroma\Influx\Config.toml
Size 3KB
SHA256 3d37daaf12fd0656853faca81a235243a9cd90e8b43403d1d6075eab4a3dfb5c
MD5 172a8a06d5b6f9d994976381dd33a0b8
SHA1 8e657e4adf0b57bf4c430acc2ba79325df26ef21
SHA512 a7492b567e0140fe52e80ba59add0072b82626ca93d266523ed9898db839245b878cb23f5743b308580a5726991429a400d8475c7bda2b11a0bb0e2ee0be7660
TLSH
T1F661354F674C323E42745068941AAF96DB3F255C95237DB670DE423C334991690EFEB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4720-127-0x00007FF938E60000-0x00007FF938E61000-memory.dmp

Download

memory/4800-33-0x00007FF938E60000-0x00007FF938E61000-memory.dmp

Download

memory/5040-1-0x00007FF43D160000-0x00007FF43D531000-memory.dmp

Download

memory/5040-136-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-3-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-0-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-212-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-213-0x00007FF43D160000-0x00007FF43D531000-memory.dmp

Download

memory/5040-215-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-214-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-24-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-4-0x00007FF7D559B000-0x00007FF7D559C000-memory.dmp

Download

memory/5040-2-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-8-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-242-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-246-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-7-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-330-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-5-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

memory/5040-6-0x00007FF7D4040000-0x00007FF7D589A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads