4dc9fac7ab8f43e2ee76c2b1ea402058bb295c757d9a22d2282a3086f17665dd

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe
Size 11.6MB
Sample261113-q2zbgswt7n
SHA256 4dc9fac7ab8f43e2ee76c2b1ea402058bb295c757d9a22d2282a3086f17665dd
MD5 4002ffef9ebb64d04b0620ce3c17b9d8
SHA1 0add10d57043237a8706307b31726571061d24d9
SHA512 d5e8fae51a30d481f38df7595279e5599740a74e5ae94185bee7e560b85eb70f8466403fd7b6c2ccc42f839835268679007555e358bb68c299509d8222f28dff
SSDEEP 196608:YVzRFqdr3+kjkZd1WzBCdawI72ORbD145tlquU4rOx6ZDXmA3c8ebDHv:a/FWVCdWKwb8qY6xCDs8e/P
TLSH
T14DC6BF07E39480E8C0AEC478C31BA637EB72B8895535B29F5BE44B512F27F506B1D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_418725298\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_418725298\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1892529275\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1892529275\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_418725298\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_418725298\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_418725298\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1892529275\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576146b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2352	msedgewebview2.exe
2352	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4128	msedgewebview2.exe
4128	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5036	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe
5036	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4128	5036	2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe	89
PID 4128 wrote to memory of 4864	4128	msedgewebview2.exe	90
PID 4128 wrote to memory of 4524	4128	msedgewebview2.exe	91
PID 4128 wrote to memory of 4524	4128	msedgewebview2.exe	91
PID 4128 wrote to memory of 4524	4128	msedgewebview2.exe	91
PID 4128 wrote to memory of 4524	4128	msedgewebview2.exe	91
PID 4128 wrote to memory of 4236	4128	msedgewebview2.exe	92
PID 4128 wrote to memory of 2892	4128	msedgewebview2.exe	93
PID 4128 wrote to memory of 2892	4128	msedgewebview2.exe	93
PID 4128 wrote to memory of 2892	4128	msedgewebview2.exe	93
PID 4128 wrote to memory of 5424	4128	msedgewebview2.exe	94
PID 4128 wrote to memory of 5424	4128	msedgewebview2.exe	94
PID 4128 wrote to memory of 5424	4128	msedgewebview2.exe	94
PID 4128 wrote to memory of 5424	4128	msedgewebview2.exe	94
PID 4128 wrote to memory of 5424	4128	msedgewebview2.exe	94
PID 4128 wrote to memory of 5360	4128	msedgewebview2.exe	95
PID 4128 wrote to memory of 5360	4128	msedgewebview2.exe	95
PID 4128 wrote to memory of 5360	4128	msedgewebview2.exe	95
PID 4128 wrote to memory of 5360	4128	msedgewebview2.exe	95
PID 4128 wrote to memory of 5360	4128	msedgewebview2.exe	95
PID 4128 wrote to memory of 1760	4128	msedgewebview2.exe	99
PID 4128 wrote to memory of 1760	4128	msedgewebview2.exe	99
PID 4128 wrote to memory of 1760	4128	msedgewebview2.exe	99
PID 4128 wrote to memory of 3796	4128	msedgewebview2.exe	100
PID 4128 wrote to memory of 3796	4128	msedgewebview2.exe	100
PID 4128 wrote to memory of 3796	4128	msedgewebview2.exe	100
PID 4128 wrote to memory of 2064	4128	msedgewebview2.exe	101
PID 4128 wrote to memory of 2064	4128	msedgewebview2.exe	101
PID 4128 wrote to memory of 2064	4128	msedgewebview2.exe	101
PID 4128 wrote to memory of 2352	4128	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5036.4104.3796547882827401717 /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.autobot\EBWebView /prefetch:4 /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff87e525fd8,0x7ff87e525fe4,0x7ff87e525ff0
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,16375586010847764503,7936732320669706815,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1764,i,16375586010847764503,7936732320669706815,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1764,i,16375586010847764503,7936732320669706815,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3316 --field-trial-handle=1764,i,16375586010847764503,7936732320669706815,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3972 --field-trial-handle=1764,i,16375586010847764503,7936732320669706815,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5 /prefetch:1
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4656 --field-trial-handle=1764,i,16375586010847764503,7936732320669706815,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4784 --field-trial-handle=1764,i,16375586010847764503,7936732320669706815,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4680 --field-trial-handle=1764,i,16375586010847764503,7936732320669706815,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.autobot\EBWebView" --webview-exe-name=2026-11-11_4002ffef9ebb64d04b0620ce3c17b9d8_akira_glassworm_rusty-stealer.exe --webview-exe-version=3.6.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4936 --field-trial-handle=1764,i,16375586010847764503,7936732320669706815,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a8e1b6bafb26eac73bf5213dc1067b4da5fe91c5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6293476d55b2c38ed955a0f4e972d74ea3899dd5d4bf3faa41741090ef5ebade
MD5 8871d49c8f4c5d1fd65f1ed060b4abac
SHA1 e096771692092693b680eee9ac4475a93c22ad9e
SHA512 1c2d8114f886beb54151aa9e5ed12b2eb80a54bd139610ba558833ef1a8e9003264f0a8b871b21472217518c83f7d7a953258c7cb49ea14db313724847a5388a
TLSH
T194D0243333430134C11034730743710C0400D11F410D4103D47CCDFD3F144541D13451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c4faafc97f12f868f13b4232a6f1f2d750c75c5d569d6ba94cc091ab2b3a9043
MD5 e14f308b9557ef5acd4c691c82c6fff8
SHA1 84bc01a0a8ca1024280753dd57cda203266a1d7c
SHA512 f002ccdcd2f643ce49bda882da1cfe9b5e298a222ed87a7dd2f4b8beb8b7d1376e8b390772b620d2d6153903d686003a90f8fd2745ab023c5ef9936fd4d7396f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8384ad48-d169-4f47-b8c8-f7f55e4b6102.tmp

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Default\8384ad48-d169-4f47-b8c8-f7f55e4b6102.tmp
Size 6KB
SHA256 38cf48a4941e2f9772a025a94be88a2b954a12ff6c29f6991b8b49e8a5c9209e
MD5 18858d4d64589277aefe20920226b10c
SHA1 ba0b14e53f7339421432abb7eebf00bb105ed25c
SHA512 75b64427869ad17aff5cedeef8c419d1572758b31e2ed09cd9f505c7d87d0eedbba144d7dc3f34a91f734cdb985ff017d50c145d2010d17d5dcf12a1cfdac03d
SSDEEP 96:stj/dA5kSGmb9cN7kPo5h16Z0vs7/x+6MhmuecJiT1Mkkjej/K+gK28XM1C7K:stbmwIonvsV+FdiT1wjeCcG6K
TLSH
T100D1A4065E64797B4CC7E519FA39BF17E2F9607160911E48E7F8492C08DB6DD2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 240B
SHA256 0937daa2adaa766ddc840c7cc95897f047b15eac450473880c204340294e115b
MD5 aa6632f6548f18ae7870c55af82aee7d
SHA1 6ea74a0a6d6fc0d37c7f0877ef18d87dfdc07dd6
SHA512 d9673e1bb4c3647c72b337ed2ba6578d2cda94aa593e951a73934a8ae140491937aa31df8cb2e01463960a0437d18eb017d2f9828e5cdef7a96f9bb5802170c3
TLSH
T11AD01261950D0005EB5DEFB801D9E7657E7718100373DB2244854234B050FBBD5F9197
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 088a7b8bc6dd33190f1d56eb510fb1aec1db825b60b2342d9dfbb4c08e7714bf
MD5 c358075e903733e6e6746e60f9bd6b85
SHA1 7f6e629ee4896ffea10af31d3ee30c8ad1de4bc3
SHA512 69e979138ae437be429b6c9a9335b41079bc18991cfdf872c7dc4bf45c28a7b300ab7b7c8ec3eea508fff4447ab2d43b48f2fd77a2b390089980d7059ae111df
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bd155ffa-7acb-488b-ae97-f7724b7eb27b.tmp

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Default\Network\bd155ffa-7acb-488b-ae97-f7724b7eb27b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bf8c07f2-e896-4965-9490-f0557fc07e60.tmp

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Default\bf8c07f2-e896-4965-9490-f0557fc07e60.tmp
Size 6KB
SHA256 421910b0d5fc68e774749798f6d4ce21edfe41ba4e0c970e088c5b6b9b745777
MD5 cb4fc662fab4c716dd3a5f7cf830739b
SHA1 f526615e71b5d85bdd2820b462b1c24be845cc92
SHA512 ccc9625b335aabf6d2773651c1c336aa12b6eec73a5c7fd792ea224a7ced54ab8d75c38c764f3dbe3c71ad5a75e5c4c502ed50ce4f43c4ba8b31c75467ed19d4
SSDEEP 96:stj/dA5kTmb9cN7kPo5h16Z0vs7/x+6MhmuecJiT1Mkkjej/K+gZ28XM1C7K:stbmeIonvsV+FdiT1wjeCXG6K
TLSH
T148D195065E64797B4CC6E519FA39BB17E2F9607260D11E48E7F88A2C08DB6CD2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\Local State
Size 1KB
SHA256 0f4aca6bc72e895e1e52218879b965c5a4e6ecfe625c1e1e9186c921ef26714e
MD5 7a6cd5be5f4e13414aa3187421567b94
SHA1 f157fb11fe60fad3425e6f732aa90b6484e4d02d
SHA512 9c14568cab5a662b0ab00c61a014f199643ac40c22cae6dd6dc38801f41c538ee20583943a8b6180e2c67516d35113bd6d5bdb294f90b19757cef490df4758d7
TLSH
T1B6219232A4E89B329CD2624435077F579F7660B781018E28A2DC4E2D02E318DB3A6C3A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\WidevineCdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

b9be13c6-26a2-47fc-a2c5-b5fdafe30bc4.tmp

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\b9be13c6-26a2-47fc-a2c5-b5fdafe30bc4.tmp
Size 3KB
SHA256 23f97d1b89581dc57067e6a5e9909fe134bab372670a2d8c09d2d602efe3c970
MD5 00fdd23ffb932c7bdf91d9145fc746af
SHA1 0b22dc8849ee6b996df7ac84a851b266ad4643ea
SHA512 f036411b59f18fd5482092be6e3d3fd6cb4aa238531898691a76ebf6bebf7e72851c06faab2c017b4f813250fa20fc23faa307bba6473d5ebb3cf9ba35f17093
TLSH
T1E161873769B4AA3B4DF29604B8863B16ABA95033E5853F69D6EC0F1D01D739C2341C1B
MD5 SHA1 SHA512 TLSH

Submit Download

c3fcf6d9-37f0-4973-a01e-c4be27bdee5e.tmp

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\c3fcf6d9-37f0-4973-a01e-c4be27bdee5e.tmp
Size 2KB
SHA256 5682bb3e6d89e2f17ddb861c51093bc31e16ac8fed3a89302ba2bc0649171d91
MD5 1eec037d7471299e84c15ab10c28bdbc
SHA1 63e86d77814d0d60b5a53e7c4492afec5c214cc2
SHA512 05c40b0316579b9efa4dcf6be13e0f674948d3bd26d6d47e92113064514d1fa881a52631ba926e0d8f48437f329a94649e0e4aee84369b24cf4a7d99e139b40e
TLSH
T1045163336864AB3A89E24644794B3F239F7EA0B29A522F259ADC0F1C01D765D2341C7A
MD5 SHA1 SHA512 TLSH

Submit Download

fe495043-7c72-4f32-9c4e-8778b8a319a7.tmp

Path C:\Users\Admin\AppData\Local\com.autobot\EBWebView\fe495043-7c72-4f32-9c4e-8778b8a319a7.tmp
Size 15KB
SHA256 62be2a4416164f1c5f1a921a4350de97d777da35615f3755fd4bae3971dac333
MD5 ac4748695f5efb37c8091d26de80076c
SHA1 f6c30caeb5806b511fa495c24cfc25d4a9748a0f
SHA512 e5cf703283a7147b1aeb6c7971a07c459c00686979c3b4c57e424c4dd1198d1a651d1b43fe4f8f484440bed4f53d46132a66fa8c3beb3c26e3ccb8a0688ed32a
SSDEEP 384:y+OBqImmJvGBLx3NaFMJFkNBSlGN9p3J0g6rD:3cvGtlNK9ZJKP
TLSH
T1CF72AF3A28A56F372CF78509BE8A37478B656263C0D47BE9D8EC9F0F016B0882341D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1892529275\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_1892529275\manifest.fingerprint
Size 66B
SHA256 7ad6d17bd7b1bf49425f7efe322f4a9065446eca71d3ea1ebe0a838efcb08e95
MD5 fa32cf839f99432676ca9acccd8a0550
SHA1 9a869d2475f9840495188509e12ce9ca5a9e7189
SHA512 b1e901d92adecc46f96f52ac38954688f0a2514710041109785656ffe694766448cdbafcda397e9edb196763997d952537ebfefb4e5d128954576024f8856c04
TLSH
T1C5A00216AEA0E812F29486DEC4254B6A14372BF9AE76008979E8E4819C87260815B8D5
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\_metadata\verified_contents.json
Size 1KB
SHA256 a6ce8c1d0d27c54034e67a83270bf3fd2bdfcc45ffc4b9084357169c00c90f77
MD5 42b331a107b7320d16f115eb7872b3c5
SHA1 3438a81f13c76becc7eb8bf0a7881088e5ad358b
SHA512 afc9393c7a63ec8d95c708eab601ab76887e4600a03b10f3c8c6e6c78c1c48d8b8bc6f059f8f38e66f1e54c5040656b75b6d46b91a795f76dbb5d3c6ac59b333
TLSH
T12F31B7414DD5369EA14E42245AB873AB9F0E71B372C8A51DA9C5900CF4F914ACBD308F
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\_platform_specific\win_x64\widevinecdm.dll
Size 21.9MB
SHA256 e1f9ad648017e2cb0f0cd798d815dc51012b279ba32571e7b6eb5120b0ed2c05
MD5 046fdd0c07bbac0c160b03a2cea5ad4b
SHA1 fbe9107b962ff2c77070579a8769ce7188c4b473
SHA512 0a3e385a3d27883e6495e4cb4fd20bd5dd0c61176e04df2762fca9d13847c9ae88de7ac57648732ce6d6cce27f2eb9da4dbf9c54d1953504de784c4cb35c8fd2
SSDEEP 393216:DKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHk:MWCmz0dwJIkpqCw
TLSH
T15A37E14AE35350E9E81ECDF0866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\_platform_specific\win_x64\widevinecdm.dll.sig
Size 1KB
SHA256 868171d91275d1e180a452621f66428afec0a9288ab96344ce92fc904ac1f70d
MD5 c7bf17a2f118fdb4a4344196706b6393
SHA1 d07695b35bf2f4bd746586fe56ce2ae9d7c99f69
SHA512 11abb5b2ea4120df63216ac38aa85c8deaa7d96b9e0a8867b8f281b0652211f4600bd4107d182f3ea0c657d8a1675ff56d0279837a7c33410a7968f2c5a9a754
TLSH
T1742108F4A215A94A7F50C142053DE827CF3E8AC12C6188B644BFC23628EE7C00F8457C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_282974884\manifest.fingerprint
Size 66B
SHA256 56d1fe98928ebd4be664fc103e35673a15c2dfa98ff241478bbd39beb15a0754
MD5 bef72178d2d9f61006676a8323ac4a20
SHA1 281541cc22aaab5d71703791192ef66ee2e831ba
SHA512 ee3664c72ee9a894249799b642ed8c1f10b7a7a422d1277d7097f43b4f892d7b267200d323f861bb90b0436262da13dd3c674c4425dfdc264c1cce3755a593a3
TLSH
T154A022CE0CC208BC30008300FC8C8B222000282823280022F8A023CA32EF30AB000C02
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_418725298\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_418725298\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_418725298\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4128_418725298\manifest.fingerprint
Size 66B
SHA256 9136f7c8a30419dc70fbe015784d1e8590a197ba88b564ca26b5a1e918e1b850
MD5 b740181eff7f7b568c83ad9d00213b13
SHA1 b3dcc9b0dc397aca84ca76c9fce3d0b37c7e37f8
SHA512 1d5c62a473a4e07c9e3d3d3900992eb6bf504b014763f7c9b7b0ce7e4b05648a9d69bb30a94b139eee88116767ed8d713f42ac49b8bfb4fcb9a1ffeff516397c
TLSH
T1F2A022C082A000F8C8080002C008008ACA00C00208003F00F080F200030CEA008FB800
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1760-296-0x00007FF89F080000-0x00007FF89F081000-memory.dmp

Download

memory/1760-297-0x00007FF8A01A0000-0x00007FF8A01A1000-memory.dmp

Download

memory/2352-402-0x00000166F1990000-0x00000166F1991000-memory.dmp

Download

memory/2352-400-0x00000166F1990000-0x00000166F1991000-memory.dmp

Download

memory/2352-411-0x00000166F1990000-0x00000166F1991000-memory.dmp

Download

memory/2352-410-0x00000166F1990000-0x00000166F1991000-memory.dmp

Download

memory/2352-409-0x00000166F1990000-0x00000166F1991000-memory.dmp

Download

memory/2352-408-0x00000166F1990000-0x00000166F1991000-memory.dmp

Download

memory/2352-407-0x00000166F1990000-0x00000166F1991000-memory.dmp

Download

memory/2352-406-0x00000166F1990000-0x00000166F1991000-memory.dmp

Download

memory/4524-247-0x000001B02C4F0000-0x000001B02C649000-memory.dmp

Download

memory/4524-96-0x00007FF8A02C0000-0x00007FF8A02C1000-memory.dmp

Download

memory/5424-70-0x00007FF8A02C0000-0x00007FF8A02C1000-memory.dmp

Download