4fb3ecb4376fcfa4f3b8ebda8a0f06d8c7cadbe489e3e00c3f66fab59b2a8b5c

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe
Size 13.5MB
Sample261002-vmfcaatsax
SHA256 4fb3ecb4376fcfa4f3b8ebda8a0f06d8c7cadbe489e3e00c3f66fab59b2a8b5c
MD5 32a744da80e978b4c037610b97ced02a
SHA1 a15fcbad02e264dc57c07e2869026618a9ea33f5
SHA512 7beaff170039f59fabea24601446f8a13db27e88d064b2f080883f7a751f5317f81ca8de1960e766ef22fcc028ac3d1c0298839d0c51692822e31ade3f065bd4
SSDEEP 98304:Wm5xILXtUYCmBMEdHsunIstWvJKpXgKpTdFKopWtVZTUEV9ivqY5Dq6JDVPnKRcF:4aYMcDrrhKLc5D/VPn8G4M
TLSH
T12DE65B03E29181E8C0AEC478C35BA637FB72BC895525B29F6BE44F512F16F606B0D359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe
2812	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1390833582\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1880147348\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1880147348\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1880147348\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1390833582\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1390833582\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1390833582\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1390833582\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1390833582\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1880147348\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1880147348\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\us_tv_and_film.txt	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2812	powershell.exe
2812	powershell.exe
2812	powershell.exe
4516	msedgewebview2.exe
4516	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3464	msedgewebview2.exe
3464	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeIncreaseQuotaPrivilege	2368	powershell.exe
Token: SeSecurityPrivilege	2368	powershell.exe
Token: SeTakeOwnershipPrivilege	2368	powershell.exe
Token: SeLoadDriverPrivilege	2368	powershell.exe
Token: SeSystemProfilePrivilege	2368	powershell.exe
Token: SeSystemtimePrivilege	2368	powershell.exe
Token: SeProfSingleProcessPrivilege	2368	powershell.exe
Token: SeIncBasePriorityPrivilege	2368	powershell.exe
Token: SeCreatePagefilePrivilege	2368	powershell.exe
Token: SeBackupPrivilege	2368	powershell.exe
Token: SeRestorePrivilege	2368	powershell.exe
Token: SeShutdownPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeSystemEnvironmentPrivilege	2368	powershell.exe
Token: SeRemoteShutdownPrivilege	2368	powershell.exe
Token: SeUndockPrivilege	2368	powershell.exe
Token: SeManageVolumePrivilege	2368	powershell.exe
Token: 33	2368	powershell.exe
Token: 34	2368	powershell.exe
Token: 35	2368	powershell.exe
Token: 36	2368	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe
4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe
4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3464	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	89
PID 3464 wrote to memory of 3636	3464	msedgewebview2.exe	90
PID 3464 wrote to memory of 1888	3464	msedgewebview2.exe	91
PID 3464 wrote to memory of 1888	3464	msedgewebview2.exe	91
PID 3464 wrote to memory of 1888	3464	msedgewebview2.exe	91
PID 3464 wrote to memory of 1888	3464	msedgewebview2.exe	91
PID 3464 wrote to memory of 3240	3464	msedgewebview2.exe	92
PID 3464 wrote to memory of 432	3464	msedgewebview2.exe	93
PID 3464 wrote to memory of 432	3464	msedgewebview2.exe	93
PID 3464 wrote to memory of 432	3464	msedgewebview2.exe	93
PID 3464 wrote to memory of 1688	3464	msedgewebview2.exe	94
PID 3464 wrote to memory of 1688	3464	msedgewebview2.exe	94
PID 3464 wrote to memory of 1688	3464	msedgewebview2.exe	94
PID 3464 wrote to memory of 1688	3464	msedgewebview2.exe	94
PID 3464 wrote to memory of 1688	3464	msedgewebview2.exe	94
PID 4412 wrote to memory of 5600	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	95
PID 4412 wrote to memory of 2368	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	96
PID 4412 wrote to memory of 3376	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	99
PID 4412 wrote to memory of 2812	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	101
PID 3464 wrote to memory of 2112	3464	msedgewebview2.exe	104
PID 3464 wrote to memory of 2112	3464	msedgewebview2.exe	104
PID 3464 wrote to memory of 2112	3464	msedgewebview2.exe	104
PID 3464 wrote to memory of 2112	3464	msedgewebview2.exe	104
PID 3464 wrote to memory of 2112	3464	msedgewebview2.exe	104
PID 4412 wrote to memory of 296	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	105
PID 4412 wrote to memory of 4756	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	107
PID 4412 wrote to memory of 4104	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	109
PID 4412 wrote to memory of 4128	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	111
PID 4412 wrote to memory of 4896	4412	2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe	113
PID 3464 wrote to memory of 248	3464	msedgewebview2.exe	118
PID 3464 wrote to memory of 248	3464	msedgewebview2.exe	118
PID 3464 wrote to memory of 248	3464	msedgewebview2.exe	118
PID 3464 wrote to memory of 2376	3464	msedgewebview2.exe	119
PID 3464 wrote to memory of 2376	3464	msedgewebview2.exe	119
PID 3464 wrote to memory of 2376	3464	msedgewebview2.exe	119
PID 3464 wrote to memory of 4516	3464	msedgewebview2.exe	120
PID 3464 wrote to memory of 5560	3464	msedgewebview2.exe	121
PID 3464 wrote to memory of 5560	3464	msedgewebview2.exe	121
PID 3464 wrote to memory of 5560	3464	msedgewebview2.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4412.5792.5825489492345620068 /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView /prefetch:4 /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x108,0x7ff9f9905fd8,0x7ff9f9905fe4,0x7ff9f9905ff0
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1732,i,12190219459221488161,7984071824266921647,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2020 --field-trial-handle=1732,i,12190219459221488161,7984071824266921647,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1732,i,12190219459221488161,7984071824266921647,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a
    3⤵
    PID:432
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3312 --field-trial-handle=1732,i,12190219459221488161,7984071824266921647,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a /prefetch:1
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3980 --field-trial-handle=1732,i,12190219459221488161,7984071824266921647,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4684 --field-trial-handle=1732,i,12190219459221488161,7984071824266921647,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=1732,i,12190219459221488161,7984071824266921647,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4628 --field-trial-handle=1732,i,12190219459221488161,7984071824266921647,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView" --webview-exe-name=2026-10-01_32a744da80e978b4c037610b97ced02a_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.1.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4756 --field-trial-handle=1732,i,12190219459221488161,7984071824266921647,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44abacc92517bf97a4e9e5da90510013fe957f2a
    3⤵
    PID:5560
- C:\Windows\system32\reg.exe
  "reg" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
  2⤵
  PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process -Filter \"Name='chrome.exe' or Name='chromium.exe'\" | ForEach-Object { \"$($_.ProcessId)`t$($_.CommandLine)\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\system32\reg.exe
  "reg" query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
  2⤵
  PID:3376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding $false; Get-Culture | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\system32\wsl.exe
  "wsl.exe" --status
  2⤵
  PID:296
- C:\Windows\system32\where.exe
  "where.exe" codex
  2⤵
  PID:4756
- C:\Windows\system32\where.exe
  "where.exe" claude
  2⤵
  PID:4104
- C:\Windows\system32\where.exe
  "where.exe" workbuddy
  2⤵
  PID:4128
- C:\Windows\system32\where.exe
  "where.exe" hermes
  2⤵
  PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1c614fcdbe62ff6b5be064fbf30973d32a00390565315992f183de84c82d3320
MD5 c79abf99e2c941bd540264baf15c182a
SHA1 babd165d17b0c1fd5a1b32596866418a37e33946
SHA512 499b77a02ff32f77077b5f318a084b78112479ac6e4c46c5483e12cd3cfec9bdef2ce2e2ef78215cbbf7f0c546530acbd61335b7e081a75dd6d851acdae35272
TLSH
T1A2216837F3DC8214C89A413A10DDAC1436B6C7DB40DECF9B6B85E159A82F699DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3ois5osh.5oy.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ois5osh.5oy.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2643a20b-5eac-416b-9387-e5e8f7e53175.tmp

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\2643a20b-5eac-416b-9387-e5e8f7e53175.tmp
Size 3KB
SHA256 040c983e350fd7998e0c0f2686123202510af962048c7111b4420bab43e4b999
MD5 68945ed5ed1c57dfdd24993c5d37e905
SHA1 4e0ca9eba80e1230fe2749aafc90ccd4bfa3d5f4
SHA512 a78965970c9a96c4d274cd0fc4469bed83513429555e5d62ce12b4346066a9304418fd0191fc649f1bebf231a3d7dfd72517d5f29080fce8f375a6f5e72e9d92
TLSH
T1EF61A43669749A3B4DF2C605B88A3F0AA7A55223E5D53F98D6EC0E1C01EB29C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c158fd88768a4e7d3469299cdeae600f4f91c030f45263454cbd0f4fa65a280a
MD5 c685c14a05cbc638ba361214b47e9d5c
SHA1 5d2f52923e78d35d068aede35b2b63b0dcc9c517
SHA512 b5df4b8a5788d1a03281aca43134a683dcbfeb7e82f4ad4ce23338120ae0f9d02ef709d9ccf49a66da864ce080c0250f08d991e0fe9a78580aaf9a88f79ef46b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 65b47b6d7c5f4e7c278b9465280f34443bace79474b6408beba3a8e9d6fd0589
MD5 c077d1d3856ef3ed7007873fcf836e64
SHA1 43f8168fd62c2589af9ca972092d45beaff2c46a
SHA512 f09d4fb7506c039c301a434c4db15524bc8ca1c61dbcdd77063b2ec3270aa5589a07266ca1681e678c4b1193503e9583aee949c091b127e0a73605ef6a00ecdc
TLSH
T1F4D01216B2014178C8103073040362480401E50F410A40805828B62D1A084B00A02482
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

40499985-6eec-427c-bbfb-c51b41a74d12.tmp

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Default\40499985-6eec-427c-bbfb-c51b41a74d12.tmp
Size 6KB
SHA256 e742c0a708a2592c915abe1f00b323d8ea3768ebf30994f34d4a8ecd17d09a24
MD5 e8c61ed8fb6091b451ec19f7ed8bdb0f
SHA1 bbbbb25ac2528c59a455d7e81bbb4ddd22ab9c9c
SHA512 92340124d1ea9ab28e284454c4c87ba031bd7d7d542fd2a26d397c8a871ce6fba0fa10758f7c51bb054ea133fabbea22150aed5682542876fe796fa9cb97d1ad
SSDEEP 96:stK/dsYXl6b9Okvo5h16Z0xs7/x+6MhmuecJ1uSMkkjeAK+gM+28XM1C7K:styrb8onxsV+Fd1Zwj8K+G6K
TLSH
T171D1A6026E2879BB4CCBE50ABA397E47E2F5657174D11E58EBF8452C04EB6CC234790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8044680b-6e38-4bf9-93dc-913fd9007f9b.tmp

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Default\8044680b-6e38-4bf9-93dc-913fd9007f9b.tmp
Size 6KB
SHA256 98ffafc4b84738f36532f130825eeb6c3789fc3a88a7822ebf3811c9481e65d2
MD5 9a1a7e2102cf86c5dc2e003be80a820b
SHA1 a549d229dc566f97118f26b38849db1e52300baf
SHA512 d7562a9d7dfa25bf03a121db16ec3e5626c41bf76e8bf225958a09593bb83d1616fc9277d22a2fdba7ffef0143b747824527f5ccdc4f40efe8a9d78ecf833cea
SSDEEP 96:stK/dsYXsG6b9Okvo5h16Z0xs7/x+6MhmuecJ1uSMkkjeAK+gL+28XM1C7K:styrh8onxsV+Fd1Zwj8B+G6K
TLSH
T12CD1A5026E2879BB4CCBE51ABA397F57E2F5657170901E58EBF8452C04EB6DC234390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 360B
SHA256 5a768cb7630e9704569fa5ebb30de14c3cb3b41c374980f8e478fc7007c843b5
MD5 8792f285cf7dda542aa56f1e4c3ed2d0
SHA1 815196febb83d411135e66dbdc3f8e31662848cf
SHA512 345a478ee7bf6e560ae0dd963342ac364d826437810401b682dd7dae0f9f878552d438a45e4c3eb4020332d5d30af983960f1a153b646f2f4d68f236dc6f726b
TLSH
T19EE0A766130445B4CB94573464F471BDB93028BC1D433D46806C93B6FD393C46CD1885
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 259cc0ce508faee8d6c47f07a50f1b08551c0dea45c7d8f7ddf10fb6df55d705
MD5 2a919bb790cc0e7e70af796798c65714
SHA1 3b25187d1dce18d37f79091660d2f88c006e0e60
SHA512 f0ea21d1c66ea1e413baaf62c826b410c7dd3e45f88c3fb2ce31d237b1e9af13ee2f30a3523bfaf7d964b15842f6b12eb3009bf129c4bc2d9725fa266d26129a
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

3b76af7a-0b87-4836-b728-aba6f633a62c.tmp

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Default\Network\3b76af7a-0b87-4836-b728-aba6f633a62c.tmp
Size 242B
SHA256 fafd5ef6576b5fdd2409f61fbd3aaabd3f8caf7c4f259f7d517bb6560119b9d2
MD5 01c571fb9cfb862b969dceb2058a130c
SHA1 d41605bd269d010a8e27217bd23ebc8a2239a055
SHA512 f9a42794b488a2ba199851a43c8f115f174cda4bf3c25880bba2959b6c3ce948a66b2c9d78a33e054ff08cd6c4fd1bcc8b199c67f890710f1b783cab193bb323
TLSH
T13CD095714170D8FE474053D015246407CD7E0007571C4D77CBA577754762078D010403
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\Local State
Size 1KB
SHA256 552216e1eed21ddeda22b966bbab05aec76b7ba10737a6f7a69087af2c8bcc09
MD5 4a276a31330fc8acd31ac9f4b190c3f1
SHA1 3cf48089a6d0b89cdd4ea2f162528a775590eed1
SHA512 f6fd0a4ef3173006c253c90eedd8876d778d14663d343017a1b697ebec4d0678215a05acd1ec33aaf82d254aa039fa5d51217b8c9c89a5a366df01ee361ab1f4
TLSH
T1DF214272E4A44F33ACD69206614B7E5F5E2421AA81914E0866DD8A2805EA45CA36AC36
MD5 SHA1 SHA512 TLSH

Submit Download

a3d46c58-4358-44fd-be98-18171a5c9345.tmp

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\a3d46c58-4358-44fd-be98-18171a5c9345.tmp
Size 2KB
SHA256 dae2398af2f6a66bd384aeb0a9881254723111c9c3ef2669430873ddb008d3b3
MD5 55d666b707656eb80ed27d2a12b82a99
SHA1 3b8d4b9790befef910dd546b8190d5823013e944
SHA512 a0ab04523c400416e45bff7793de9fef53d5fd4fd0e5e29a2d9e1d043704436f9a40706568a725a58e060615b0dc60a07522dfb27f7cfb542dcac7a0c2916b15
TLSH
T10E51B83378249B3789F78309B94F3F179E7962A5AA922F545ADC0B2C00EB55C2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

abe28523-9d9e-4103-a5c9-189d4decdc89.tmp

Path C:\Users\Admin\AppData\Local\run.thorp.desktop\EBWebView\abe28523-9d9e-4103-a5c9-189d4decdc89.tmp
Size 15KB
SHA256 0d0715b4c2179515930ac0bf7e211905ad22fa0ea84962e26461b1d7a0ead1bb
MD5 15812d3a484c32f7641c6ee212824d5f
SHA1 7df8b2862187cabec940b03aa5bba2aa98adecb0
SHA512 c17f2fbed29469e21a047226c1ce390540e7fb455d0511733987d40c955a70f60079442bc3393cc6b6f1e321f6195e1a6fe975894405ba8b8e77a364fe3e3e38
SSDEEP 384:z+aQikB+z/xvxjg/qhEENBSgxFv2nNGB09zE:S/UxvxjgC+LNGuFE
TLSH
T1A9729E3B64783E2395F7E6057D4D1B8FCAB9A4B290C26EB84AED5F1D06C72980342D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\Thorp\data\config\settings.json
Size 1KB
SHA256 df44886e91b5be90b92b38a53a619a63f09b6360a51baa231a419babc15dff40
MD5 fa2b751ba13ac61a2b01f1c65579e16b
SHA1 037ad5ad81f7eb781f2c3fe6e1aca8d98c007fa7
SHA512 a9dcd601f1c0a804fd75cb8e4201c046018970ae35ca971c0aed841faa194c66b90416ffd8626bbe49cb1c4c475db862f4bcaa4e702c05456b4b61361e4d45a8
TLSH
T108218B80F0198D5F29879604656D80836D31996B15D43D1CBB4FE5189F0D23AB2FFFE9
MD5 SHA1 SHA512 TLSH

Submit Download

thorp_browser.db

Path C:\Users\Admin\AppData\Roaming\Thorp\data\sqlite\thorp_browser.db
Size 368KB
SHA256 fd2fbdc34d35274aee84b87f9f324f40f0f15aa096b609e270f57f28132b6e42
MD5 079830f48fc3c76a9a10e390b2081e12
SHA1 1355393f434ef8d26e988d0b633087c62d4f9d31
SHA512 ad3bc18e268fe7e7595250e4d4d00dc406e1228dea948f95420c24630804ecbf9db42e94ed9ca9a5578d3cbd14614e74186187ca4139ce4cce5a40ea70246512
SSDEEP 192:bNFyB73tOeMOzoppNFOsktOKYvePJnoPZnZ4ZkJmKZqXR+e46ggl+wD6b:B03AeDoprGAK99oP16WJRUse46TD
TLSH
T17884539D1E29E711E2B290B1CBA1271655380E1F4F837FD93EED40929F8EB8BD039465
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

runtime.json

Path C:\Users\Admin\AppData\Roaming\Thorp\runtime.json
Size 427B
SHA256 6bfa0e9b09a437692baf645025ec7f3b42aa0de9d7389cb81faff81c47c5bfd8
MD5 cb3f7b1ace10b88ed51ef70ba8681c71
SHA1 4af3dbbc393f03375c1a8036e64870387330dd2c
SHA512 77c1ea2c72452227933df8dfb7e62be93685bdfdb4b71bf48a85f776be49953f9645da7bf7a553f4ddf493200670676141ba0ca7887995397a82666bd7736f9a
TLSH
T173E05C10D513EB320DD5158E52A2A68A4015EA4F779035281A83CE481A5EA36543331A
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.json

Path C:\Users\Admin\AppData\Roaming\Thorp\runtime.json
Size 523B
SHA256 6141563919799ee951c1199c8333ff25c1d321a0c7d8e7fd893d1b882f409b48
MD5 5378103a82d7333030ed26ed1bde8af5
SHA1 ab815f539e42c142d8b5c807e07caf4d3addc0f9
SHA512 c36f10f482bd8983dc953e9b0f20054de99c6b2812fb7b174fda62cba1ef09674e8e68439c65043f671eb6ff7dd8bc7ea1dacb9bc433afceae78a0d1beb37811
TLSH
T156F0C0109933E7331CD9268D62B1A64A0022EF0F77F0361C2B4397880A5E93B953365A
MD5 SHA1 SHA512 TLSH

Submit Download

runtime.json

Path C:\Users\Admin\AppData\Roaming\Thorp\runtime.json
Size 463B
SHA256 703299b6ba836b9c46c48f086ef7ef390e505922af4a73e51b36de580bd54d54
MD5 8c4f37a68240a29622167ebaebe0ac16
SHA1 ee7eb7e923179c00402055ae3b837284d55cf678
SHA512 94bdfc4a9e4a0e94fc58d403145266904d28ce369cc633dbf62bd1d32ab9a7a20816cf531ac4c2a5ac737b67ab98699b5ff23a604b0113fdb0c0e13659cdcc02
TLSH
T1EFF0D400D513EB330DD8654D52A1A64A0016EE4F73D0352C1A83CB480F5EA365533306
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1390833582\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_1880147348\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3464_261982336\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

memory/248-439-0x00007FFA1B550000-0x00007FFA1B551000-memory.dmp

Download

memory/248-440-0x00007FFA1A680000-0x00007FFA1A681000-memory.dmp

Download

memory/1688-224-0x00007FFA1AA10000-0x00007FFA1AA11000-memory.dmp

Download

memory/1888-137-0x00007FFA1AA10000-0x00007FFA1AA11000-memory.dmp

Download

memory/2368-266-0x000001C5B0B70000-0x000001C5B0B8E000-memory.dmp

Download

memory/2368-267-0x000001C5B0B90000-0x000001C5B0C42000-memory.dmp

Download

memory/2368-263-0x000001C5B08B0000-0x000001C5B08D2000-memory.dmp

Download

memory/2368-270-0x000001C5B0950000-0x000001C5B095A000-memory.dmp

Download

memory/2368-272-0x000001C5B0DD0000-0x000001C5B0DF4000-memory.dmp

Download

memory/2368-271-0x000001C5B0DD0000-0x000001C5B0DFA000-memory.dmp

Download

memory/3464-347-0x000002C71F230000-0x000002C71F23D000-memory.dmp

Download

memory/4516-544-0x00000231A3FC0000-0x00000231A3FC1000-memory.dmp

Download

memory/4516-543-0x00000231A3FC0000-0x00000231A3FC1000-memory.dmp

Download

memory/4516-542-0x00000231A3FC0000-0x00000231A3FC1000-memory.dmp

Download

memory/4516-541-0x00000231A3FC0000-0x00000231A3FC1000-memory.dmp

Download

memory/4516-540-0x00000231A3FC0000-0x00000231A3FC1000-memory.dmp

Download

memory/4516-539-0x00000231A3FC0000-0x00000231A3FC1000-memory.dmp

Download

memory/4516-532-0x00000231A3FC0000-0x00000231A3FC1000-memory.dmp

Download

memory/4516-534-0x00000231A3FC0000-0x00000231A3FC1000-memory.dmp

Download