bb05a55fe47a4598996bf751c164bd903322267c5dbb57ca46dd975049d8971a

Analysis

max time kernel
31s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
Size 17.6MB
Sample260810-e1bcgsar6v
SHA256 bb05a55fe47a4598996bf751c164bd903322267c5dbb57ca46dd975049d8971a
MD5 91fe4919ea8fa8edc9e6c29b34087d25
SHA1 505f24991986b2ac46b303f737f3a8390410a57c
SHA512 9884b700e5c444cfb06cd0b5bee45cf015e045596f4ce69f1b5fee1c76719011adaafea596805c695d806fc3755d18ef514155b6c2962e2e0ceab99881fac836
SSDEEP 98304:Nl/y7hJxYOIePO0eyDdhV//9KowXnaIv4Ofmd6zeRHDhqc7qN+R1QVygCIxQ49R2:26t6xr1IowF484DIWRAygpxQER5YuPo
TLSH
T1FA17E525BB5A996CD09BC474834B8A724A3130DB0B35B9FF448492392F6DBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 11 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5048	powercfg.exe
4484	powercfg.exe
4520	powercfg.exe
1232	powercfg.exe
4140	powercfg.exe
5060	powercfg.exe
3924	powercfg.exe
1888	powercfg.exe
5492	powercfg.exe
4448	powercfg.exe
2140	powercfg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2332	powershell.exe
4336	powershell.exe
2800	powershell.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2176	sc.exe
1348	sc.exe
1564	sc.exe
4816	sc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2332	powershell.exe
2332	powershell.exe
2332	powershell.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
4336	powershell.exe
4336	powershell.exe
4336	powershell.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2800	powershell.exe
2800	powershell.exe
2800	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2776	msedgewebview2.exe
2776	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeIncreaseQuotaPrivilege	2332	powershell.exe
Token: SeSecurityPrivilege	2332	powershell.exe
Token: SeTakeOwnershipPrivilege	2332	powershell.exe
Token: SeLoadDriverPrivilege	2332	powershell.exe
Token: SeSystemProfilePrivilege	2332	powershell.exe
Token: SeSystemtimePrivilege	2332	powershell.exe
Token: SeProfSingleProcessPrivilege	2332	powershell.exe
Token: SeIncBasePriorityPrivilege	2332	powershell.exe
Token: SeCreatePagefilePrivilege	2332	powershell.exe
Token: SeBackupPrivilege	2332	powershell.exe
Token: SeRestorePrivilege	2332	powershell.exe
Token: SeShutdownPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeSystemEnvironmentPrivilege	2332	powershell.exe
Token: SeRemoteShutdownPrivilege	2332	powershell.exe
Token: SeUndockPrivilege	2332	powershell.exe
Token: SeManageVolumePrivilege	2332	powershell.exe
Token: 33	2332	powershell.exe
Token: 34	2332	powershell.exe
Token: 35	2332	powershell.exe
Token: 36	2332	powershell.exe
Token: SeIncreaseQuotaPrivilege	2332	powershell.exe
Token: SeSecurityPrivilege	2332	powershell.exe
Token: SeTakeOwnershipPrivilege	2332	powershell.exe
Token: SeLoadDriverPrivilege	2332	powershell.exe
Token: SeSystemProfilePrivilege	2332	powershell.exe
Token: SeSystemtimePrivilege	2332	powershell.exe
Token: SeProfSingleProcessPrivilege	2332	powershell.exe
Token: SeIncBasePriorityPrivilege	2332	powershell.exe
Token: SeCreatePagefilePrivilege	2332	powershell.exe
Token: SeBackupPrivilege	2332	powershell.exe
Token: SeRestorePrivilege	2332	powershell.exe
Token: SeShutdownPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeSystemEnvironmentPrivilege	2332	powershell.exe
Token: SeRemoteShutdownPrivilege	2332	powershell.exe
Token: SeUndockPrivilege	2332	powershell.exe
Token: SeManageVolumePrivilege	2332	powershell.exe
Token: 33	2332	powershell.exe
Token: 34	2332	powershell.exe
Token: 35	2332	powershell.exe
Token: 36	2332	powershell.exe
Token: SeShutdownPrivilege	5492	powercfg.exe
Token: SeCreatePagefilePrivilege	5492	powercfg.exe
Token: SeShutdownPrivilege	4448	powercfg.exe
Token: SeCreatePagefilePrivilege	4448	powercfg.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeIncreaseQuotaPrivilege	4336	powershell.exe
Token: SeSecurityPrivilege	4336	powershell.exe
Token: SeTakeOwnershipPrivilege	4336	powershell.exe
Token: SeLoadDriverPrivilege	4336	powershell.exe
Token: SeSystemProfilePrivilege	4336	powershell.exe
Token: SeSystemtimePrivilege	4336	powershell.exe
Token: SeProfSingleProcessPrivilege	4336	powershell.exe
Token: SeIncBasePriorityPrivilege	4336	powershell.exe
Token: SeCreatePagefilePrivilege	4336	powershell.exe
Token: SeBackupPrivilege	4336	powershell.exe
Token: SeRestorePrivilege	4336	powershell.exe
Token: SeShutdownPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeSystemEnvironmentPrivilege	4336	powershell.exe
Token: SeRemoteShutdownPrivilege	4336	powershell.exe
Token: SeUndockPrivilege	4336	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2776	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	88
PID 2776 wrote to memory of 1712	2776	msedgewebview2.exe	89
PID 2776 wrote to memory of 1480	2776	msedgewebview2.exe	90
PID 2776 wrote to memory of 1480	2776	msedgewebview2.exe	90
PID 2776 wrote to memory of 1480	2776	msedgewebview2.exe	90
PID 2776 wrote to memory of 1480	2776	msedgewebview2.exe	90
PID 2776 wrote to memory of 4304	2776	msedgewebview2.exe	91
PID 2776 wrote to memory of 4296	2776	msedgewebview2.exe	92
PID 2776 wrote to memory of 4296	2776	msedgewebview2.exe	92
PID 2776 wrote to memory of 4296	2776	msedgewebview2.exe	92
PID 2776 wrote to memory of 4468	2776	msedgewebview2.exe	93
PID 2776 wrote to memory of 4468	2776	msedgewebview2.exe	93
PID 2776 wrote to memory of 4468	2776	msedgewebview2.exe	93
PID 2776 wrote to memory of 4468	2776	msedgewebview2.exe	93
PID 2776 wrote to memory of 4468	2776	msedgewebview2.exe	93
PID 2776 wrote to memory of 5924	2776	msedgewebview2.exe	94
PID 2776 wrote to memory of 5924	2776	msedgewebview2.exe	94
PID 2776 wrote to memory of 5924	2776	msedgewebview2.exe	94
PID 2776 wrote to memory of 5924	2776	msedgewebview2.exe	94
PID 2776 wrote to memory of 5924	2776	msedgewebview2.exe	94
PID 2416 wrote to memory of 2332	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	97
PID 2416 wrote to memory of 1348	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	102
PID 2416 wrote to memory of 1564	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	104
PID 2416 wrote to memory of 5492	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	106
PID 2416 wrote to memory of 4448	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	108
PID 2416 wrote to memory of 4336	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	110
PID 2416 wrote to memory of 2140	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	112
PID 2416 wrote to memory of 5048	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	114
PID 2416 wrote to memory of 4140	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	116
PID 2416 wrote to memory of 5060	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	118
PID 2416 wrote to memory of 3924	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	120
PID 2416 wrote to memory of 4816	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	122
PID 2416 wrote to memory of 2176	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	124
PID 2416 wrote to memory of 4484	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	126
PID 2416 wrote to memory of 4520	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	128
PID 2416 wrote to memory of 2800	2416	2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.9.11 --user-data-dir="C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2416.3312.14394596058259352329 /pfhostedapp:7d155cb3dc46b1d241f70be8924b70ce266660df
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView /prefetch:4 /pfhostedapp:7d155cb3dc46b1d241f70be8924b70ce266660df --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb52b65fd8,0x7ffb52b65fe4,0x7ffb52b65ff0
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView" --webview-exe-name=2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.9.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1792,i,14448816589408999333,2741206999796562855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7d155cb3dc46b1d241f70be8924b70ce266660df
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView" --webview-exe-name=2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.9.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1792,i,14448816589408999333,2741206999796562855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7d155cb3dc46b1d241f70be8924b70ce266660df
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView" --webview-exe-name=2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.9.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2428 --field-trial-handle=1792,i,14448816589408999333,2741206999796562855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7d155cb3dc46b1d241f70be8924b70ce266660df
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView" --webview-exe-name=2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.9.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3356 --field-trial-handle=1792,i,14448816589408999333,2741206999796562855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7d155cb3dc46b1d241f70be8924b70ce266660df /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView" --webview-exe-name=2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.9.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3976 --field-trial-handle=1792,i,14448816589408999333,2741206999796562855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7d155cb3dc46b1d241f70be8924b70ce266660df /prefetch:1
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView" --webview-exe-name=2026-08-10_91fe4919ea8fa8edc9e6c29b34087d25_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.9.11 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4796 --field-trial-handle=1792,i,14448816589408999333,2741206999796562855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7d155cb3dc46b1d241f70be8924b70ce266660df
    3⤵
    PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -Command " $adapters = Get-NetAdapter -ErrorAction SilentlyContinue | Where-Object { $_.Status -eq 'Up' -and $_.PhysicalMediaType -eq '802.3' } foreach ($a in $adapters) { $props = Get-NetAdapterAdvancedProperty -Name $a.Name -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'Energy[- ]?Efficient[- ]?Ethernet|Green Ethernet|Advanced EEE|^EEE$|EEE PHY|802\.3az' -or ($_.RegistryKeyword -and $_.RegistryKeyword -match '^\*?EEE$|EEELink|GigaEEE|EnergyEfficientEthernet|AdvancedEEE') } foreach ($p in $props) { $valid = @($p.ValidDisplayValues) -join '~' Write-Output ($a.Name + '|' + $p.DisplayName + '|' + $p.DisplayValue + '|' + $valid) } } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\system32\sc.exe
  "sc" query DiagTrack
  2⤵
  - Launches sc.exe
  PID:1348
- C:\Windows\system32\sc.exe
  "sc" query WSearch
  2⤵
  - Launches sc.exe
  PID:1564
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5492
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -Command " $adapters = Get-NetAdapter -ErrorAction SilentlyContinue | Where-Object { $_.Status -eq 'Up' -and $_.PhysicalMediaType -eq '802.3' } foreach ($a in $adapters) { $props = Get-NetAdapterAdvancedProperty -Name $a.Name -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'Energy[- ]?Efficient[- ]?Ethernet|Green Ethernet|Advanced EEE|^EEE$|EEE PHY|802\.3az' -or ($_.RegistryKeyword -and $_.RegistryKeyword -match '^\*?EEE$|EEELink|GigaEEE|EnergyEfficientEthernet|AdvancedEEE') } foreach ($p in $props) { $valid = @($p.ValidDisplayValues) -join '~' Write-Output ($a.Name + '|' + $p.DisplayName + '|' + $p.DisplayValue + '|' + $valid) } } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\system32\powercfg.exe
  "powercfg" /getactivescheme
  2⤵
  - Power Settings
  PID:2140
- C:\Windows\system32\powercfg.exe
  "powercfg" /getactivescheme
  2⤵
  - Power Settings
  PID:5048
- C:\Windows\system32\powercfg.exe
  "powercfg" /getactivescheme
  2⤵
  - Power Settings
  PID:4140
- C:\Windows\system32\powercfg.exe
  "powercfg" /q SCHEME_CURRENT SUB_PROCESSOR 0cc5b647-c1df-4637-891a-dec35c318583
  2⤵
  - Power Settings
  PID:5060
- C:\Windows\system32\powercfg.exe
  "powercfg" /getactivescheme
  2⤵
  - Power Settings
  PID:3924
- C:\Windows\system32\sc.exe
  "sc" query DiagTrack
  2⤵
  - Launches sc.exe
  PID:4816
- C:\Windows\system32\sc.exe
  "sc" query WSearch
  2⤵
  - Launches sc.exe
  PID:2176
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226
  2⤵
  - Power Settings
  PID:4484
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5
  2⤵
  - Power Settings
  PID:4520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -Command " $adapters = Get-NetAdapter -ErrorAction SilentlyContinue | Where-Object { $_.Status -eq 'Up' -and $_.PhysicalMediaType -eq '802.3' } foreach ($a in $adapters) { $props = Get-NetAdapterAdvancedProperty -Name $a.Name -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match 'Energy[- ]?Efficient[- ]?Ethernet|Green Ethernet|Advanced EEE|^EEE$|EEE PHY|802\.3az' -or ($_.RegistryKeyword -and $_.RegistryKeyword -match '^\*?EEE$|EEELink|GigaEEE|EnergyEfficientEthernet|AdvancedEEE') } foreach ($p in $props) { $valid = @($p.ValidDisplayValues) -join '~' Write-Output ($a.Name + '|' + $p.DisplayName + '|' + $p.DisplayValue + '|' + $valid) } } "
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Windows\system32\powercfg.exe
  "powercfg" /getactivescheme
  2⤵
  - Power Settings
  PID:1888
- C:\Windows\system32\powercfg.exe
  "powercfg" /getactivescheme
  2⤵
  - Power Settings
  PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 662ca1244e634d1ef82f1c06533e18e37293f35fbd9c291fded99464615847f3
MD5 27fc07e35ff51fc3670a7800eab99b12
SHA1 7833de3e7337fc53e2035599eaca77bc0e2de09c
SHA512 48311e49fc2d0fd28ce710fb988c631d1a2da999533eb9bce0320fb7a5c5f45af7a8a3e5530ed87261519e9a74b12accc092c3e21cd1d51120fc2eebde56dd47
TLSH
T1F7218E37B3DD8624C89D413A10CDAC1036B6C7DB41DECFAB6B84D655A43F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lfhyvbnl.shm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lfhyvbnl.shm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4782799298c87fc87f09a121c1bf47b1df999b04cc77f10cf45949e36962c47c
MD5 0a54199416498fa96eb91e408557fb00
SHA1 93768024fab8929d918852cc21baafd2a9139e9c
SHA512 521298ae99a86184535bb09b39427fb78c3c8f6644849f303a394a9d5157924479ed13bd792c7d29b11dc62840ab4e9b83b5a903074692e7c4aaadfc9807a214
TLSH
T11FD0123633110634C01020730063760D2500C70F401F4500A42C857E1B444A00902441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9736d819291006b0a46f885c0d7c1e3f3c6b6011a79af8defd480c7fdc0cf293
MD5 9ef9cd4aaab813f1ec21b82196312fee
SHA1 a763047e76e1c62621db4603a637d970e044aa7d
SHA512 8e28daa4d9b2eba798c60da918658c3ac84cbc3dff70c4cff378c72683aec5c21dfcb6b62a41af13d5f008c99405d5c007e4f037b51a3c194c24d56a15210a2a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

9621d200-980b-457b-a877-92ca0bffd97d.tmp

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\9621d200-980b-457b-a877-92ca0bffd97d.tmp
Size 5KB
SHA256 f1442a7907def6762f6493e0987b830e4aff63462de0999807be3e00fd17267d
MD5 69cdb07197d489c573770e0e1cbce191
SHA1 0bef6d360f304d35564203d22bc1095531c3e658
SHA512 693ca6c21e0198a559e810b2f7c9aa1f3d5e8e8841e7689f83501dcc65e2898dc0d2398f5a0f3305b2c512146c3a542430247787695a0c47733beb305756be40
SSDEEP 96:rH7/dM++ZKMb9zkwdo616Z0Qs7/x+6MhmuecJPI1ejeUK+g428XM1C7K:rHDOb1/o6QsV+FdPIQjA+G6K
TLSH
T146C1C7015A2879BF4CCAE549BA397B07D2FA507171D51E58E7FC4A2C08DB6CC632780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 0f745c8d142a8f2ab42fd55d3497f20ba17b8f0e8f8ac546f7bc7eeb76e768ac
MD5 3d412c2c6beca5cc1e6ece58420176b6
SHA1 b54296a8c524cfd676c46eb31aac52605e66e53d
SHA512 d1b714b7f0009640784a1bf72e1e86149195fb379c4680dfc7fac1bf06a1c0ea240545114f4862838672242df9ccf3388db48c0b9971aad63dbbe7c1fa348a03
TLSH
T100C08C2040B08326D7808BB520F2003270B8590085830CE0E3A81E33AC11B22AE0ACD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 41d3b4e215ff1a760a050588a3c3ff2aed38fd95d56aee966e0be262b332f112
MD5 66118f8e387b9678b3e24684f61a2581
SHA1 af582c54f0fc01a49c834f20d496e2372c205381
SHA512 3871d4b30faf5a22175a5b8cdddee2d21b9475beb1519961f4e8299589213dfd5d4634570a56d69bf264b0e45400f10f3a62ed3eb4792ea5c4ca4d554298e204
TLSH
T1CAA00210A6D01106D209937150FA057232344A141A030681D1F58C65CCD43CA9B41410
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1118.TMP

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a1118.TMP
Size 48B
SHA256 b836da1129e72ebb5636411399304a2fda298b847b5c14cfb624608f0e576387
MD5 951970e9f286ebc791270ad78a63dfce
SHA1 62365da3addf0da354ba51926187f96689411bc3
SHA512 5f7249389eb3eac723f7ca93ec9cca43a1377e02c53407dc016a9ef567bd9bd43e7d74b0b2d20cb96c9cd5961dc3577920aef1ff126a180339fd7b857f48f919
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5af53e.TMP

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Network\Network Persistent State~RFe5af53e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Preferences
Size 5KB
SHA256 6f54ab2983c198bf81d81b1f1c6124a6da30d50d02a0ce6e4416cfd9b29eafed
MD5 1aa712f055e20c4e5b3fbaec69f01e27
SHA1 59f157d1e844f2c7d9a9b302b3fb6653540e1d99
SHA512 781f4ed0fdbc805f4a6151adac8d45ae995f915fbde5d976ce2963fed3ba8babf11f0318f80354caf49c1cd8c558b4cdb58a7376694c8ab4d719954c2d81de59
SSDEEP 96:rH7/dXZKMb9zkwdo616Z0+s7/x+6MhmuecJ0NMkkjeUK+g128XM1C7K:rHDV1/o6+sV+Fd0NwjA7G6K
TLSH
T1EBC1B6015E28B97B4CCAE559BA397B07D2F9507171D52E58E7FC4A2C08DB6CC632780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Preferences
Size 6KB
SHA256 5b47fa50dc0a88135ad4f35aaa9f36712bbdd58566dbc7482e5af74df8e2a6b3
MD5 115efad5fa5935ac2ad867fb73e168d1
SHA1 f5825f95fb7b2050d5c2dcec9940d3f4e7ca3c1a
SHA512 b39581c665b045d181b1c60df1cea2240a9016d58268dd1c506c7a88aab12607cee8ba69d982b16190397b6decdbf0e7c82c3254730ad8c22f13cdbb8441e47a
SSDEEP 96:rH7/dXZKMb9zkwdo5h16Z0+s7/x+6MhmuecJ0NMkkjeUK+go28XM1C7K:rHDV1/on+sV+Fd0NwjAWG6K
TLSH
T13BD1A6015E28797B4CCBE559BA35BB06D2F9607160D12E58EBFC4A2C08DB6CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Preferences
Size 6KB
SHA256 71891d614d4603af1ebbeb8eb1c0646629aa48c81b78c84ecd5deb14a729da02
MD5 0dece0e6520cc0536c4ff16b12d85c55
SHA1 d46952ae3ea7c06fb144be330c91317063d86d31
SHA512 e2db1fcad9775aa79d20d7fd6eb49d2c9e5c39fef89489eed556a5b45b684c161572cff7140e52c157f0a5edc4b5602b96dfaff25299d0f79cd4145497437aaf
SSDEEP 96:stH7/dXZRGMb9zkuo5h16Z0+s7/x+6MhmuecJ0NMkkjeUK+go28XM1C7K:stHDVzZon+sV+Fd0NwjAWG6K
TLSH
T10CD1C8015E28797B8CCBE559BA397B03D2F9607260D11E58EBFC4A2C08DB6CC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Default\Preferences
Size 6KB
SHA256 52fdf6814e63dd2481858482719aa17867888aaa6030f88f4577bc8439e83383
MD5 a61c758148d1e4c449964f7f3cebcc6e
SHA1 c7f3c8f6f8eea9714a0535938f7172da96861cc1
SHA512 3f5e0a19a51526327554a822bc832346bfe99e57640f86bd2c1b7307e377b8220410329c1a91118f8898388ca4dfadad8f816ff853f18274156ca7714b4ba648
SSDEEP 96:stH7/dXZKMb9zkwdo5h16Z0+s7/x+6MhmuecJ0NMkkjeUK+go28XM1C7K:stHDV1/on+sV+Fd0NwjAWG6K
TLSH
T170D1A7015E28797B4CCBE559BA35BB06D2F9607160D11E58EBFC4A2C08DB6CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Local State
Size 3KB
SHA256 cb49048fa4280e15483f63317cd1eaba88bf0a64180e5bf8831718f1326e72df
MD5 c96a0118d7cf441c3419d7b689f584c1
SHA1 137c865ad794958d78848f280059bd5c6debca26
SHA512 c510ef5571504f5f8ce95df9ec3231478a14e537d7cbc9fa9ff89f7c68508a05ed158419f4d2be38df670cd0842324e9eb9c1fd8e98439e979e0ae8daaa7922a
TLSH
T1B6718322A974AA374DF6DA44B9453B13BBA95063E8817FE8D6EC0F1C02D728C1352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Local State
Size 2KB
SHA256 2e99a83c3a0a2c2b7e6732177c6bafd53cdc0f826352a13084d2cc8a05e71059
MD5 06a13215a493c9e22cf38d209bd90d03
SHA1 6a1eab386babdcb63d8967206ea0854d3f57af1e
SHA512 8498ad6f592bd18f32583e31b14523ae3109ee10e64cee1eee0659f8bb160daa58bbea319d371f632a5d5f96d890fac8a60bfb9191f72e7fab21b1d4400dff39
TLSH
T17351A7337828AB3785E69A44B94A3F239F7950A6AE522F60D6DC0B1C06C755C2352C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Local State
Size 3KB
SHA256 d47d6d7b83b1e0a858e0327257e223789527bcaa1b5c7168f7acb20ea21b2970
MD5 ca516851b3ecc9e8ba21e352b665fdfa
SHA1 5a5a79f2073c09f0d1935918a0831222bfa4deed
SHA512 bb598f6641bdfd49487f842fc0b5bb9ca2d4f3b840ae7aa276f0759cbcee35aa10349631a42dd08e164b6e4bd7468752b37ff6712ba1df84e5b30ad5cee08727
TLSH
T1666175376974AA374DE69A44B9853B17BBA55027E9813FA4D6EC0F1C02D728C1352C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Local State
Size 16KB
SHA256 9bc95a5990bfa508ccb8dca50ab42e15458fe7ec4e95fa4c1169bccb4aea4ad5
MD5 422b975f67c58ae0ccffc45b24ab87d5
SHA1 90a67e38c29c6053953a7c3ddc3905e35f939386
SHA512 60415f6c573a9741a016d82d33b501d84d4217bfae020ca9fa5fad9e15ed6c0433925bc2b868014783de69e57dcd712eb837f2aab64cf9b5b92583140a52c1f2
SSDEEP 384:N+aQikB+z/xvxjg/qhEwNBSuvRUjQhLEAVdpfqB9za:Y/UxvxjgC+uRjLEUfqBFa
TLSH
T11F729E36D869AF37A8F7AB857A09678BDBF444A254C16DE489EC5F0D07C32DD0302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59bf9d.TMP

Path C:\Users\Admin\AppData\Local\gg.compy.app\EBWebView\Local State~RFe59bf9d.TMP
Size 1KB
SHA256 2c2f7eb3d907e711197544a976b506dc892f9d12115ec3e8ca78d81f66a30389
MD5 6ac9fe16bd962dad5a0a464835995343
SHA1 78ecc2b0dd89c365c1220b93f4bcc369aee27308
SHA512 3f0edcf5f8df7136f4b5b80e12ea38681638be66711009674a459d2f536c8ad678cde4304e871883d35103cb6f89dd469bd12c150f56946636474bf870e2179d
TLSH
T1A62184B3E4786B33B885628672457F5B2E3110B786408E50F2DD8B2C0BD718DA276C36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1480-261-0x00000222C1C80000-0x00000222C1C83000-memory.dmp

Download

memory/1480-234-0x00000222C1BB0000-0x00000222C1BB8000-memory.dmp

Download

memory/1480-288-0x00000222C1D70000-0x00000222C1D71000-memory.dmp

Download

memory/1480-230-0x00000222C1BB0000-0x00000222C1BB8000-memory.dmp

Download

memory/1480-228-0x00000222C1BA0000-0x00000222C1BA2000-memory.dmp

Download

memory/1480-226-0x00000222C1970000-0x00000222C197B000-memory.dmp

Download

memory/1480-284-0x00000222C1D50000-0x00000222C1D52000-memory.dmp

Download

memory/1480-280-0x00000222C1D00000-0x00000222C1D04000-memory.dmp

Download

memory/1480-279-0x00000222C1D30000-0x00000222C1D32000-memory.dmp

Download

memory/1480-277-0x00000222C1CF0000-0x00000222C1CF1000-memory.dmp

Download

memory/1480-275-0x00000222C1D00000-0x00000222C1D0D000-memory.dmp

Download

memory/1480-276-0x00000222C1D10000-0x00000222C1D2A000-memory.dmp

Download

memory/1480-225-0x00000222C1990000-0x00000222C1996000-memory.dmp

Download

memory/1480-273-0x00000222C1CC0000-0x00000222C1CC4000-memory.dmp

Download

memory/1480-272-0x00000222C1CF0000-0x00000222C1CF2000-memory.dmp

Download

memory/1480-269-0x00000222C1CC0000-0x00000222C1CC6000-memory.dmp

Download

memory/1480-270-0x00000222C1C80000-0x00000222C1C8C000-memory.dmp

Download

memory/1480-266-0x00000222C1CC0000-0x00000222C1CCC000-memory.dmp

Download

memory/1480-267-0x00000222C1CD0000-0x00000222C1CE7000-memory.dmp

Download

memory/1480-264-0x00000222C1CB0000-0x00000222C1CB2000-memory.dmp

Download

memory/1480-262-0x00000222C1C70000-0x00000222C1C76000-memory.dmp

Download

memory/1480-24-0x00007FFB74A00000-0x00007FFB74A01000-memory.dmp

Download

memory/1480-258-0x00000222C1C80000-0x00000222C1C8D000-memory.dmp

Download

memory/1480-259-0x00000222C1C90000-0x00000222C1CA9000-memory.dmp

Download

memory/1480-256-0x00000222C1C60000-0x00000222C1C64000-memory.dmp

Download

memory/1480-255-0x00000222C1C70000-0x00000222C1C72000-memory.dmp

Download

memory/1480-252-0x00000222C1C60000-0x00000222C1C67000-memory.dmp

Download

memory/1480-253-0x00000222C1BE0000-0x00000222C1BEE000-memory.dmp

Download

memory/1480-250-0x00000222C1C30000-0x00000222C1C32000-memory.dmp

Download

memory/1480-247-0x00000222C1C30000-0x00000222C1C3C000-memory.dmp

Download

memory/1480-248-0x00000222C1C40000-0x00000222C1C57000-memory.dmp

Download

memory/1480-243-0x00000222C1BD0000-0x00000222C1BD6000-memory.dmp

Download

memory/1480-242-0x00000222C1BE0000-0x00000222C1BE3000-memory.dmp

Download

memory/1480-239-0x00000222C1BE0000-0x00000222C1BF1000-memory.dmp

Download

memory/1480-233-0x00000222C1BC0000-0x00000222C1BC4000-memory.dmp

Download

memory/1480-231-0x00000222C1990000-0x00000222C199F000-memory.dmp

Download

memory/1480-222-0x00000222C1970000-0x00000222C1971000-memory.dmp

Download

memory/1480-223-0x00000222C1980000-0x00000222C1982000-memory.dmp

Download

memory/1480-308-0x00000222C1DF0000-0x00000222C1DF3000-memory.dmp

Download

memory/1480-306-0x00000222C1DD0000-0x00000222C1DDB000-memory.dmp

Download

memory/1480-305-0x00000222C1DE0000-0x00000222C1DE6000-memory.dmp

Download

memory/1480-303-0x00000222C1DC0000-0x00000222C1DC5000-memory.dmp

Download

memory/1480-302-0x00000222C1DD0000-0x00000222C1DD3000-memory.dmp

Download

memory/1480-300-0x00000222C1DB0000-0x00000222C1DB7000-memory.dmp

Download

memory/1480-299-0x00000222C1DC0000-0x00000222C1DC4000-memory.dmp

Download

memory/1480-297-0x00000222C1DA0000-0x00000222C1DA4000-memory.dmp

Download

memory/1480-296-0x00000222C1DB0000-0x00000222C1DB2000-memory.dmp

Download

memory/1480-294-0x00000222C1D70000-0x00000222C1D76000-memory.dmp

Download

memory/1480-293-0x00000222C1DA0000-0x00000222C1DA3000-memory.dmp

Download

memory/1480-291-0x00000222C1D90000-0x00000222C1D92000-memory.dmp

Download

memory/1480-289-0x00000222C1D80000-0x00000222C1D82000-memory.dmp

Download

memory/1480-287-0x00000222C1D30000-0x00000222C1D31000-memory.dmp

Download

memory/1480-286-0x00000222C1D60000-0x00000222C1D62000-memory.dmp

Download

memory/1480-285-0x00000222C1D30000-0x00000222C1D31000-memory.dmp

Download

memory/1480-282-0x00000222C1D40000-0x00000222C1D42000-memory.dmp

Download

memory/1480-281-0x00000222C1D30000-0x00000222C1D31000-memory.dmp

Download

memory/1480-176-0x00000222B7CA0000-0x00000222B7E39000-memory.dmp

Download

memory/1480-245-0x00000222C1BF0000-0x00000222C1BF2000-memory.dmp

Download

memory/1480-244-0x00000222C1BE0000-0x00000222C1BE1000-memory.dmp

Download

memory/1480-240-0x00000222C1C00000-0x00000222C1C22000-memory.dmp

Download

memory/1480-237-0x00000222C1BC0000-0x00000222C1BC4000-memory.dmp

Download

memory/1480-236-0x00000222C1BD0000-0x00000222C1BD2000-memory.dmp

Download

memory/1480-309-0x00000222C1DE0000-0x00000222C1DE5000-memory.dmp

Download

memory/2332-146-0x000001CCE0EE0000-0x000001CCE0EFE000-memory.dmp

Download

memory/2332-145-0x000001CCE0A40000-0x000001CCE0A4A000-memory.dmp

Download

memory/2332-143-0x000001CCE0960000-0x000001CCE097E000-memory.dmp

Download

memory/2332-144-0x000001CCE0980000-0x000001CCE0A32000-memory.dmp

Download

memory/2332-140-0x000001CCE08C0000-0x000001CCE08E2000-memory.dmp

Download

memory/2800-215-0x0000021C3B2B0000-0x0000021C3B362000-memory.dmp

Download

memory/4336-205-0x0000016469B90000-0x0000016469C42000-memory.dmp

Download

memory/4468-67-0x00007FFB74A00000-0x00007FFB74A01000-memory.dmp

Download