1f51b4d985bd37bd004e9c738ab1b34d5f23b514763c78bf76b7fd52b372e178

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Size 15.5MB
Sample260819-grmp9sem9v
SHA256 1f51b4d985bd37bd004e9c738ab1b34d5f23b514763c78bf76b7fd52b372e178
MD5 35a9485227780ba3c2488d8f3346be3b
SHA1 ba80ab9489f62d31d96f30831ff32e25bde15b7b
SHA512 f55df7c80e9b17652895d122a8eecc924ed3baff412e34ad34202c301705969b9f810b0382abcf3c70df70781fcd014765674961e12e7099b38c845fb99d3e84
SSDEEP 196608:yrHkwftYH/Nh1Ut8pX5mMM0XhQeWZ/S3WV0:yBYH/Nh1Ut8pX5e0Xa9/S3e0
TLSH
T1D6F617257B5A99ACD09BC47483878A72497030DB0F35B9FF449492382F6ABF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1958231779\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1958231779\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1958231779\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1958231779\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1557725794\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_344989227\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4880_1958231779\manifest.fingerprint	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\sqwoz	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\sqwoz\URL Protocol	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\sqwoz\DefaultIcon	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\sqwoz\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe\",0"	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\sqwoz\shell\open	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\sqwoz\ = "URL:SQWOZ Protocol"	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\sqwoz\shell\open\command	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\sqwoz\shell	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\sqwoz\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe\" \"%1\""	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3248	msedgewebview2.exe
3248	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4880	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
816	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
816	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
816	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 4880	816	2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe	89
PID 4880 wrote to memory of 4948	4880	msedgewebview2.exe	90
PID 4880 wrote to memory of 3452	4880	msedgewebview2.exe	91
PID 4880 wrote to memory of 3452	4880	msedgewebview2.exe	91
PID 4880 wrote to memory of 3452	4880	msedgewebview2.exe	91
PID 4880 wrote to memory of 3452	4880	msedgewebview2.exe	91
PID 4880 wrote to memory of 4572	4880	msedgewebview2.exe	92
PID 4880 wrote to memory of 1152	4880	msedgewebview2.exe	93
PID 4880 wrote to memory of 1152	4880	msedgewebview2.exe	93
PID 4880 wrote to memory of 1152	4880	msedgewebview2.exe	93
PID 4880 wrote to memory of 2532	4880	msedgewebview2.exe	94
PID 4880 wrote to memory of 2532	4880	msedgewebview2.exe	94
PID 4880 wrote to memory of 2532	4880	msedgewebview2.exe	94
PID 4880 wrote to memory of 2532	4880	msedgewebview2.exe	94
PID 4880 wrote to memory of 2532	4880	msedgewebview2.exe	94
PID 4880 wrote to memory of 3548	4880	msedgewebview2.exe	98
PID 4880 wrote to memory of 3548	4880	msedgewebview2.exe	98
PID 4880 wrote to memory of 3548	4880	msedgewebview2.exe	98
PID 4880 wrote to memory of 5708	4880	msedgewebview2.exe	99
PID 4880 wrote to memory of 5708	4880	msedgewebview2.exe	99
PID 4880 wrote to memory of 5708	4880	msedgewebview2.exe	99
PID 4880 wrote to memory of 3248	4880	msedgewebview2.exe	100
PID 4880 wrote to memory of 2528	4880	msedgewebview2.exe	101
PID 4880 wrote to memory of 2528	4880	msedgewebview2.exe	101
PID 4880 wrote to memory of 2528	4880	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:816
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.4 --user-data-dir="C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=816.4692.15990190029674700930 /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView /prefetch:4 /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x160,0x188,0x18c,0x16c,0x194,0x7ff903dc5fd8,0x7ff903dc5fe4,0x7ff903dc5ff0
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView" --webview-exe-name=2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,10971279560576135361,8888572316855128199,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView" --webview-exe-name=2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1780,i,10971279560576135361,8888572316855128199,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView" --webview-exe-name=2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1940 --field-trial-handle=1780,i,10971279560576135361,8888572316855128199,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView" --webview-exe-name=2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3424 --field-trial-handle=1780,i,10971279560576135361,8888572316855128199,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557 /prefetch:1
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView" --webview-exe-name=2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4348 --field-trial-handle=1780,i,10971279560576135361,8888572316855128199,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView" --webview-exe-name=2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4380 --field-trial-handle=1780,i,10971279560576135361,8888572316855128199,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView" --webview-exe-name=2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4596 --field-trial-handle=1780,i,10971279560576135361,8888572316855128199,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView" --webview-exe-name=2026-08-19_35a9485227780ba3c2488d8f3346be3b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1780,i,10971279560576135361,8888572316855128199,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:9bccececa9ea8ada06d28bc0be5e30345ad4a557
    3⤵
    PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9085de6517cf4a3dd88f9e218d14fad14d0b4df53522fbbb77c2ea5fcb60b698
MD5 e7d419090c936e6d82361b16cd5c7d3d
SHA1 fa7c87391bad9411725fe2bb4e9c105f50a3cf8f
SHA512 3e77a43efe62e9e7f8b0f11c6bc44d1689f7d943f3a640dbef2f7e62dd0c9d738a2018fe69ed9150e4fc0054b97a57161fea33d166c8099a7db2fd983c9ff53e
TLSH
T153D0123232114174C22024330842E6091411D14F414540045838EA1D1A080900D02442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5ed7dc1ef29972bba6fd86cf8e586f50dc6b5ec96b98e6f9f66ade274ef7b467
MD5 a6816543262f44e6ce80f2fe041a7989
SHA1 55edd5f4b0e5f9cc4f035e919a0ad95fc0b2e2c3
SHA512 4e0bbbe55931fb76247351085b8b9ee88ef0995a64a6bb0410f9aa392972ef7e99c80666750beabb03f922e2941702ff18b14850dc1eb1c82ea27fed23a39009
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

6d36f57b-5308-49cc-826a-fcd9975b0494.tmp

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\6d36f57b-5308-49cc-826a-fcd9975b0494.tmp
Size 6KB
SHA256 b1bfce588ec90c83c24b5623714828df5a63cc1cd460d19605d173aa8eaf4eb3
MD5 19ca55e4b8545aeb6658cffb88a75130
SHA1 76038c5349db0c6a2299001a512543f852d6b338
SHA512 3539455e27d46d0ea4b6d5379feba5a58ecf7b81468de23553fa35fe783f9ea9602c4444337c3b1765fd28cb178b84aca6a3b2fd28da35b6ab8d22d7c41149ae
SSDEEP 96:stE/dzOWjb9Vkuo5h16Z0bs7/x+6MhmuecJIIS1eje4K+gwt28XM1C7K:stIpBhonbsV+FdIHQjgoG6K
TLSH
T149D1A7019E24797B4CC6F608BA29BB17E3F5A07261D51E58EBF8452C04E76CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8f5e10cc4cafafd96d83eddc14a067cd9045d9bf21c90ea98b8883b1dc1213c3
MD5 f629ac0355b7df77d7402bcf48800be6
SHA1 ac4b4579fbab7190ab0c85f5fd0ba27fafed0887
SHA512 3b0d2bf28a96f6c4f867d9908aebfefe4045e32d0ea973b874314e0efd73731bc092fa688d2d79c47facb410ff1366f237f63a96a7be8fd3a26dda1f267d861f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 4ba9686ee53703f8b6098efb730602459d3bcac3e0b447792e901ac3b6929771
MD5 0c957c015d43893715f722674708ee84
SHA1 e45f6c8a9d1dad818bb076196f69a92f2aa30672
SHA512 8d2951de605c838dc138d190ba1bd73952cfaf0335c2ae7e9cc9736a967d0901d20e5ecbb663f44800c386130d5190752905550f7d4008192d28362c5eaf36d6
TLSH
T144B01220005042CDCB82013044C1418431F20E1EE4C72F0303503D78501139440F3013
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 f5b3c1fb2ca2558ddc84f434069d23765779d97a1e59b14e5fc36bbed89ca1c5
MD5 ed925a20c0707c4a8dd000bed8002a1b
SHA1 a85fcd8c6acae5cdcc056071a48f29421c236531
SHA512 3b7c992a1a56f2dd10571175989f574072d74665f6d5a361c41db9299941fc6579272da007c7c1c8fcf64a70516a2f55de055e5c67e1aa799db2b27c738addaf
TLSH
T199018EA6C3D8C6BE8A5156E426343C23CD3E0919A2282D27DDEAEBEE57E2071D11454F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4344.TMP

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Network\Network Persistent State~RFe5a4344.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 3fe2e2538f4fd0d211ae47978784235c0415d373a195539d9fe5c7df502cc950
MD5 71fad23ced94b1e0bc9cc06c846ad362
SHA1 dcb80773dbe8c61666988448128701d1e6f0498c
SHA512 df0b6f84e8636eaf33debb09ead2d1802a8b6a77908066a3bee70a4a18cd60ab6dfbf6b5fece4096adef9a8ad8d8f8a6d397ff5093eb9ee576e1c15f53ae18ab
TLSH
T165E0D892847AE46710680E360848FC415A76AE34519054E8DA5358AD70511F6554A462
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59a7a0.TMP

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Network\TransportSecurity~RFe59a7a0.TMP
Size 356B
SHA256 ac6d8ea84fd5c73475ff0ed75742699b4afb39d0fddb9ab6bdbab49f70743fb3
MD5 034ca79c2e202fb4e43392ff369602d4
SHA1 7c22c9845d646e72afbdf23f0cf120f535e40a2d
SHA512 7c6e34123b96ffcaaf789cc6c09409df3949a10b515714cd7b737890b1363e6c68636a4f7481416af9a8d6a06e860306cc6019a383cce461d23ab52a9561189d
TLSH
T163E0D8D2C07BE46710688E360848BC055A76BA74519094E8DA5344AC70511F6655F462
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Default\Preferences
Size 6KB
SHA256 9be0d360289172c14f2ee429aafe75351c7f921c0464b9a8fef678f263ca253b
MD5 c145b64a5bda7d48261d7f9470411ce5
SHA1 d2441ca070de0c1cccab74fbb832caff9093be28
SHA512 af7d616d6529797c08cd183b1e1c58ab91fabc79126f5a76a8f34d2ff329eda7050a08e339f8674fd899022d1d0fd9ce5449a34526deb407da25125d1f6e79ea
SSDEEP 96:stE/dzOtGjb9Vkuo5h16Z0bs7/x+6MhmuecJIIS1eje4K+grt28XM1C7K:stIpzhonbsV+FdIHQjg/G6K
TLSH
T1EAD1B8019E24797B4CC6F618BB297B17D3F56072A1D51E58EBF8451C04EB6CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Local State
Size 3KB
SHA256 c932c076718410834faf33e96898671ab84817e82aaff5a8930d764580693c13
MD5 b5e031f9e5b746f5375aee09bce23534
SHA1 912a36d59a539786078bd81b2dc654097d021868
SHA512 7509a14b26583dbd2913274cf7b33482c537b5ab6019aa5ce735bfbff79d341e6fb5f1101906a5c0450bdba3eb755582c398372a4238401dfa81d5119203c84d
TLSH
T11E6178379974A6375EE29B15B9863B02ABB59063E9813F54CAEC0F1D01C739C2341D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Local State
Size 3KB
SHA256 257450464800df8a6fbcb368d7eef6a80679bd88250ff9a32c257a93d37415db
MD5 68bff73c08ee671f49bf390c8c0c342b
SHA1 e621b6d59d703c1e1a7434ebefb8e68eb13d2e92
SHA512 9ce6c22fe8ae930dd18dff80cdd10208d297b2079edc5fef7404d32e3bd6f335846b75839e6a41a626d0627ac3f16c41c4228f9be914b5731ebbaf63be4f89cc
TLSH
T18F716426A474AA375DE2E705B9863B03ABB58063E9913F54CAEC0F1D01D73DC2342D27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Local State
Size 2KB
SHA256 91c42e9d44c3a63c49d09c7cc6c40d3e3b41dcd5b3fa5f3c6a915c82acc056a6
MD5 e0112f55395ae52625cdfb216a3077c0
SHA1 ca20c95de773abada00a303321b0d89c06b1f626
SHA512 6c2c34426ad715f86ff9e15bd3532f818e10271cd6dc01f399cdc84928f15e803b055507d2a80f4d1e7c4ee15868d675ae3dd8ff1eb23de9ca8fbe241de3e10f
TLSH
T158516433A824AB379AE65714BA4A7A139E7690A1EE512F10DADD0B1D00C769C3741C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Local State
Size 14KB
SHA256 fd498ab8f58b404e7e4df714edc6b3316b0db4c7b582eaf2530aedf7a38bd101
MD5 2806ce47899b0b06e6aed0830d7d017c
SHA1 e853e941667fda6231e9b44e6a684519848e1488
SHA512 41486ceb6dee4ca531b145adccc22736df3dc203d4fa8133a54000eb891261a22bc45f3ef8172f7feddb8863ddd16632433ee5329c6204dcb5c490d86d13bb24
SSDEEP 384:3+aQikB+z/xvxjg/qhEwNBSMYlxanK9z/:G/UxvxjgC+fxwKF/
TLSH
T1E7629D2B95687E2396F2F7147A49174BCBB988B294817EB88AFD1F0D06C73D81342916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe592d40.TMP

Path C:\Users\Admin\AppData\Local\com.maxim.sqwoz\EBWebView\Local State~RFe592d40.TMP
Size 1KB
SHA256 e8a036102b9b24fa4b6a5f8abce9f7e617bcad1a52b261f120901cdc4f3389aa
MD5 8dafe48c05ac2a4f6997ad0794a508dc
SHA1 7cf4187a38f958033d310261b4a064ae78de7187
SHA512 19ec1f11ffff7b316486788b81a88e4111b75f6d6b6187f5295bd823289dbc79708cc21b9ee98bd4044b96c998e5f49ffd4e79158cedf72459306f6688718eec
TLSH
T1042162B3D4689B33BDD56326A246BA039E7080A7D6000F00E6DE0B2E05D779CF926D33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2532-101-0x00007FF9255D0000-0x00007FF9255D1000-memory.dmp

Download

memory/3248-385-0x0000010AEE3F0000-0x0000010AEE3F1000-memory.dmp

Download

memory/3248-383-0x0000010AEE3F0000-0x0000010AEE3F1000-memory.dmp

Download

memory/3248-393-0x0000010AEE3F0000-0x0000010AEE3F1000-memory.dmp

Download

memory/3248-394-0x0000010AEE3F0000-0x0000010AEE3F1000-memory.dmp

Download

memory/3248-392-0x0000010AEE3F0000-0x0000010AEE3F1000-memory.dmp

Download

memory/3248-391-0x0000010AEE3F0000-0x0000010AEE3F1000-memory.dmp

Download

memory/3248-390-0x0000010AEE3F0000-0x0000010AEE3F1000-memory.dmp

Download

memory/3248-389-0x0000010AEE3F0000-0x0000010AEE3F1000-memory.dmp

Download

memory/3452-26-0x00007FF9255D0000-0x00007FF9255D1000-memory.dmp

Download

memory/3548-278-0x00007FF924790000-0x00007FF924791000-memory.dmp

Download

memory/3548-277-0x00007FF925CC0000-0x00007FF925CC1000-memory.dmp

Download