b7c9ca90e314c01cd3e033d610c0947fa9bfd674f2b3a386cd0a1fa1cd5b0ff1

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
Size 17.4MB
Sample260907-e8wy6aw1es
SHA256 b7c9ca90e314c01cd3e033d610c0947fa9bfd674f2b3a386cd0a1fa1cd5b0ff1
MD5 3fb8e083ba6a7493b07a0029d3ce42a0
SHA1 e29a79d5a28dcb7f07b1022c1bb84b7d94eb96b3
SHA512 13cf9a0e982f7edbd2246c5b8bb4161538f78dfa1a514b3e31e011314f5ab1a5f2f3ff1de741d081acb3655306ff0a50394f93c40cb4b10174519fa3f8c96a7c
SSDEEP 196608:XqVtocGE4uQlOY0zfwH8+l1ZX2dpWB+u7JDsIl:X+K/ROVzfa8+jZGdUB+GhsI
TLSH
T1D3072843F66290E8C16AC075831A6233FB72BC4D47357AEB5BE04A213E55FA06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SimTelemetry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --minimized"	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 25 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4860	tasklist.exe
4356	tasklist.exe
2884	tasklist.exe
1740	tasklist.exe
2220	tasklist.exe
2368	tasklist.exe
2316	tasklist.exe
4508	tasklist.exe
1240	tasklist.exe
2212	tasklist.exe
4880	tasklist.exe
2696	tasklist.exe
4384	tasklist.exe
5668	tasklist.exe
4176	tasklist.exe
2036	tasklist.exe
4216	tasklist.exe
1796	tasklist.exe
5916	tasklist.exe
3212	tasklist.exe
3196	tasklist.exe
4576	tasklist.exe
2664	tasklist.exe
2464	tasklist.exe
4792	tasklist.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1888404218\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1888404218\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_530163678\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_530163678\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1615094594\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1615094594\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1615094594\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1888404218\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1615094594\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1615094594\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_1615094594\_metadata\verified_contents.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\simtelemetry\shell\open	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\simtelemetry\DefaultIcon	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\simtelemetry\shell\open\command	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\simtelemetry\shell	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\simtelemetry\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe\" \"%1\""	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\simtelemetry	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\simtelemetry\ = "URL:io.simtelemetry protocol"	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\simtelemetry\URL Protocol	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\simtelemetry\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe,0"	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2544	msedgewebview2.exe
2544	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1424	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	tasklist.exe
Token: SeDebugPrivilege	2884	tasklist.exe
Token: SeDebugPrivilege	1740	tasklist.exe
Token: SeDebugPrivilege	1240	tasklist.exe
Token: SeDebugPrivilege	2220	tasklist.exe
Token: SeDebugPrivilege	4216	tasklist.exe
Token: SeDebugPrivilege	2368	tasklist.exe
Token: SeDebugPrivilege	2212	tasklist.exe
Token: SeDebugPrivilege	2664	tasklist.exe
Token: SeDebugPrivilege	2316	tasklist.exe
Token: SeDebugPrivilege	1796	tasklist.exe
Token: SeDebugPrivilege	4860	tasklist.exe
Token: SeDebugPrivilege	4880	tasklist.exe
Token: SeDebugPrivilege	2696	tasklist.exe
Token: SeDebugPrivilege	5916	tasklist.exe
Token: SeDebugPrivilege	3212	tasklist.exe
Token: SeDebugPrivilege	2464	tasklist.exe
Token: SeDebugPrivilege	4508	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	4792	tasklist.exe
Token: SeDebugPrivilege	5668	tasklist.exe
Token: SeDebugPrivilege	4176	tasklist.exe
Token: SeDebugPrivilege	2036	tasklist.exe
Token: SeDebugPrivilege	3196	tasklist.exe
Token: SeDebugPrivilege	4576	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 1424	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	89
PID 1424 wrote to memory of 2344	1424	msedgewebview2.exe	90
PID 1424 wrote to memory of 5964	1424	msedgewebview2.exe	91
PID 1424 wrote to memory of 5964	1424	msedgewebview2.exe	91
PID 1424 wrote to memory of 5964	1424	msedgewebview2.exe	91
PID 1424 wrote to memory of 5964	1424	msedgewebview2.exe	91
PID 1424 wrote to memory of 1060	1424	msedgewebview2.exe	92
PID 1424 wrote to memory of 5972	1424	msedgewebview2.exe	93
PID 1424 wrote to memory of 5972	1424	msedgewebview2.exe	93
PID 1424 wrote to memory of 5972	1424	msedgewebview2.exe	93
PID 1424 wrote to memory of 6060	1424	msedgewebview2.exe	94
PID 1424 wrote to memory of 6060	1424	msedgewebview2.exe	94
PID 1424 wrote to memory of 6060	1424	msedgewebview2.exe	94
PID 1424 wrote to memory of 6060	1424	msedgewebview2.exe	94
PID 1424 wrote to memory of 6060	1424	msedgewebview2.exe	94
PID 4808 wrote to memory of 4356	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	96
PID 4808 wrote to memory of 2884	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	99
PID 4808 wrote to memory of 1740	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	101
PID 4808 wrote to memory of 1240	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	103
PID 4808 wrote to memory of 2220	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	105
PID 4808 wrote to memory of 4216	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	108
PID 4808 wrote to memory of 2368	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	110
PID 4808 wrote to memory of 2212	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	112
PID 4808 wrote to memory of 2664	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	114
PID 4808 wrote to memory of 2316	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	116
PID 4808 wrote to memory of 1796	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	120
PID 4808 wrote to memory of 4860	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	122
PID 4808 wrote to memory of 4880	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	124
PID 4808 wrote to memory of 2696	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	126
PID 1424 wrote to memory of 4408	1424	msedgewebview2.exe	128
PID 1424 wrote to memory of 4408	1424	msedgewebview2.exe	128
PID 1424 wrote to memory of 4408	1424	msedgewebview2.exe	128
PID 4808 wrote to memory of 5916	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	129
PID 4808 wrote to memory of 3212	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	131
PID 4808 wrote to memory of 2464	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	133
PID 4808 wrote to memory of 4508	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	135
PID 1424 wrote to memory of 3316	1424	msedgewebview2.exe	137
PID 1424 wrote to memory of 3316	1424	msedgewebview2.exe	137
PID 1424 wrote to memory of 3316	1424	msedgewebview2.exe	137
PID 4808 wrote to memory of 4384	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	138
PID 4808 wrote to memory of 4792	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	140
PID 4808 wrote to memory of 5668	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	142
PID 1424 wrote to memory of 2544	1424	msedgewebview2.exe	144
PID 4808 wrote to memory of 4176	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	145
PID 4808 wrote to memory of 2036	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	147
PID 4808 wrote to memory of 3196	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	149
PID 1424 wrote to memory of 3192	1424	msedgewebview2.exe	151
PID 1424 wrote to memory of 3192	1424	msedgewebview2.exe	151
PID 1424 wrote to memory of 3192	1424	msedgewebview2.exe	151
PID 4808 wrote to memory of 4576	4808	2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.2.43 --user-data-dir="C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4808.4600.12633283806721677838 /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView /prefetch:4 /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x114,0x7ff8d00f5fd8,0x7ff8d00f5fe4,0x7ff8d00f5ff0
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView" --webview-exe-name=2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.2.43 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1760,i,11410966435766787875,6334228413215712142,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView" --webview-exe-name=2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.2.43 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1760,i,11410966435766787875,6334228413215712142,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView" --webview-exe-name=2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.2.43 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2520 --field-trial-handle=1760,i,11410966435766787875,6334228413215712142,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView" --webview-exe-name=2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.2.43 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3372 --field-trial-handle=1760,i,11410966435766787875,6334228413215712142,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1 /prefetch:1
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView" --webview-exe-name=2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.2.43 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1760,i,11410966435766787875,6334228413215712142,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView" --webview-exe-name=2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.2.43 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1760,i,11410966435766787875,6334228413215712142,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView" --webview-exe-name=2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.2.43 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2068 --field-trial-handle=1760,i,11410966435766787875,6334228413215712142,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView" --webview-exe-name=2026-09-06_3fb8e083ba6a7493b07a0029d3ce42a0_akira_glassworm_rusty-stealer.exe --webview-exe-version=0.2.43 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=1760,i,11410966435766787875,6334228413215712142,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a84abcc874111f95a8325ddfce11ce26489bf2f1
    3⤵
    PID:3192
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5916
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5668
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 172058e3103e29bf591efd71903506b58e4e18b78e7c804ba9e3f2ddd864ce28
MD5 b50d4de4044ed39573b305f9b38d8c3c
SHA1 14831ebe4c1149010713d1b4e82c3a77bfa159c7
SHA512 dbb1d98ea7b011551d8eec2857ae0ecd0e315cdbb3a6271896479dffe9822fdbbb4128386b0b48dafe36c39564468a12f32860526dce8945e14fd36f580775e5
TLSH
T122D0121276438234C01034730102A1880542C30B408640486438893D1B440500A12446
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 10148e7f7d63b4d17c77b5363c5bef98ca3a7852d142437a2210788d75ab4d3f
MD5 79a6961e83cb27b64ce2bbf5dbe06174
SHA1 43fcfeeedbe8c8e9ee8d0280b34a3dc1720b5130
SHA512 c8001e6a04da42b107fb04723eb41c804dc053faa9035ad134144bc452f12817504596b036a72e4fbb9d30543d1c6d602aff87ac9be67d9f9ce3e2429f017edd
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8245f193-135d-4141-9a0b-a297824ae48d.tmp

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Default\8245f193-135d-4141-9a0b-a297824ae48d.tmp
Size 6KB
SHA256 2108e7a86cee774429c2fec2e32fc834d7fd41d4372b2acfcc41c98c155076a0
MD5 32c88d5112f1dad739058110284fb747
SHA1 6f0498d1bbbb0222b848d8d70e4bd42bd3201ac2
SHA512 e07ebe3df3f3c3410051351fa1392d0fd3f6bfb5af51f0a5f2fee0976f50464f9194bc265d21a49b455b2f3d3b7b985e403e996276ceb2e12c69c916fe2815b9
SSDEEP 96:stD/dA/f4b9vkro5h16Z0Ws7/x+6MhmuecJsj1ejeSK+gntq28XM1C7K:st7S+gonWsV+FdsjQjWhtqG6K
TLSH
T18FD197015E64B97B4CCBE509BE39BA17E2F5607275D51E98EBF84A2C04DB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 6f1f64740d9fcd5c6d800dd5c6639a85584ffbd94be8da296bf9c6bd75675dbe
MD5 b1181017c3cb641661c5217f332654a0
SHA1 4d3e1461c9d6a89ec423d0a59b7d835a0acf7abb
SHA512 269e8335b14e7f8841d6d9acdbf0f50ef98b0d67598c41ee7af08de4fa2d07761e41495a8c503319970e0c27e8f32c5df8db71223b87823055bf47af09b8afd4
TLSH
T168A002509680C40BE2010B7413C502813234FA240303EB0559E4B26C89513A1420701A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5989d7.TMP

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5989d7.TMP
Size 48B
SHA256 b88495fa8eb1b53d308d74b3f4d69d4f0a38b6e640f414588fec0b8096f496fe
MD5 edd6c3080bc85ea0169d6853a52e07c6
SHA1 67a41caf3709f9e6f9610c04808af3a3d7883426
SHA512 9e6e3fea64b655938a986fb6a616935b8adc42ece20708c1ae184fbfbd813c89500683185452b8d7bffa0a00b8f8b1120965a5012df1fc93daaec713e0477ab4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 c5c92d131b76eaaed66416fd89ade77167c5a01b190173ef7db35e48ba52ea4a
MD5 e21a738548b92e26af063e9c33f3ecbd
SHA1 1bba4d3dad074f3bad2be6c6a3f218efb36fab1b
SHA512 acc3701b5d6fdf37756f113bac35a0e424296af630f5879be0cefd380944d5a4c45bdf82895a92b496225a83a3fc9ac127806639d3392aa8f25d50f4775cf231
TLSH
T13021EDA683F4CA7D8B0066E427303C07CC2D0519922C2E3B8DEAEBE557E20B2D21064B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4cc9.TMP

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Default\Network\Network Persistent State~RFe5a4cc9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Default\Preferences
Size 6KB
SHA256 4c28ec1c20057269320dad5fce5c8a1b7382c9c6ac430f17ba4f2392bc7e7c71
MD5 1648a8d63cd6eba6d105f5e1041927e7
SHA1 526701d30845f78c146596d32084b32385962b33
SHA512 3e2085555c6b2ab06ddd8dc3b81b01efe0b8bbc70d44b2ed744fdd3da9acf3957b786326b3ee91c0e25e257331d4b2677d3a28bd5b89e03bd85cdc91a470ce3c
SSDEEP 96:stD/dA/eG4b9vkro5h16Z0Ws7/x+6MhmuecJsj1ejeSK+gng28XM1C7K:st7S4gonWsV+FdsjQjWhgG6K
TLSH
T13AD197025E64B97B4CC7E519BE29BB17E2F5607271D51E98EBF84A2C04DB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Local State
Size 2KB
SHA256 bfd274f3fca20ef7729a55f43c265fd7632787187e60e3829ab8d71765d6b8d6
MD5 26296a961b1cce151c142a349aec705f
SHA1 9c62baacce830ace7ee325452057888f8f6046e6
SHA512 9e2a3db3276b491a5b1b7a625d4ce972de984e6f931cafb99bdbb681e15e146a91d209fe7a5d5ab79ab73962871890796290cc5f6f3ef33a7263db73131679b1
TLSH
T196517533A824EB3789F28A187C4A3B16CA359077AA512F609ADD0F1D01E224D1745C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Local State
Size 3KB
SHA256 d47d26150308a29b3169dcc527964e0d8ad6aff8c5db718d68d33d063aef0d6b
MD5 952fe50d045de959d72f22da6d42cab3
SHA1 5513862a7617145a20346827187a273ec2d4300b
SHA512 4c0a3fef96bfa27db9e15bd7016d59b87d3be3797b2a3623e66fbe74e44420543cb6f7acb5335d7f59f9a4cd3546a7fdba1ac7072457255a134ed8a06d863193
TLSH
T1D8617737A974EA278EF2DA15BC863706A7655037E5913FA4D6EC0F1D01E33881341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Local State
Size 15KB
SHA256 f83c108aad3ef537c4695c1d1abc87b3baae4f34583141788d6228115f4ba580
MD5 d2b4a0f408f64055a34960191ea7dfa1
SHA1 58cab9e6d2f9d8f6965df7020258e2f96a71acfe
SHA512 d06c0decb24ef185038518fd2e11d5a5bba7fb54d8adb9e823319e90a4fee0e505ba499058c7615803f430b0b822f98bd2b50e75f9c377084d05d5411895ae5f
SSDEEP 384:v+aQikB+z/xvxjg/qhEwNBSHj3puFP9zM:+/UxvxjgC+r5CFM
TLSH
T1CB72AF2795697E2396F3EA457D49174BCBB994B394C26EB44EBD1F0E07C32D80341C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5937cf.TMP

Path C:\Users\Admin\AppData\Local\io.simtelemetry\EBWebView\Local State~RFe5937cf.TMP
Size 1KB
SHA256 ad86502b597850ff02ed42b723e0614da0b9e5542fe3c79a8826dcf7d001f368
MD5 d25b44812c643b8be3ecf67d4a4e1ec1
SHA1 f9e4ff1dac406af11861e6b3a183b4ab5a6fa40d
SHA512 707eada49a32d1eca6f7a744174806c99aa59965ba2fa7862605be940622aa6bfbff6c3cb1e75ea281794ac92216f1fad30c528f487b5947747a0340ea378fd8
TLSH
T1A9216573E4749B33EDE29369384A764B9E31503B92100F4066DD4F2E11B224E9B1AC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2544-274-0x0000022A84600000-0x0000022A84601000-memory.dmp

Download

memory/2544-265-0x0000022A84600000-0x0000022A84601000-memory.dmp

Download

memory/2544-267-0x0000022A84600000-0x0000022A84601000-memory.dmp

Download

memory/2544-275-0x0000022A84600000-0x0000022A84601000-memory.dmp

Download

memory/2544-276-0x0000022A84600000-0x0000022A84601000-memory.dmp

Download

memory/2544-273-0x0000022A84600000-0x0000022A84601000-memory.dmp

Download

memory/2544-272-0x0000022A84600000-0x0000022A84601000-memory.dmp

Download

memory/2544-271-0x0000022A84600000-0x0000022A84601000-memory.dmp

Download

memory/4408-227-0x00007FF8F0A30000-0x00007FF8F0A31000-memory.dmp

Download

memory/4408-226-0x00007FF8F2B40000-0x00007FF8F2B41000-memory.dmp

Download

memory/5964-20-0x00007FF8F0EB0000-0x00007FF8F0EB1000-memory.dmp

Download

memory/6060-100-0x00007FF8F0EB0000-0x00007FF8F0EB1000-memory.dmp

Download