927ef2b5f462aacb7db85e95ae1fb30ead07cb9925ed9dfd63a98f419905d9a8

Analysis

user interaction
yes
max time kernel
54s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Demo_RustTweaker_v1.3.2.exe
Size 194.3MB
Sample260528-slbllady31
SHA256 927ef2b5f462aacb7db85e95ae1fb30ead07cb9925ed9dfd63a98f419905d9a8
MD5 fcabe96d61aec243523c08a4573451ba
SHA1 e215d0cd9ff4dbe3da7ca7d51dc66b47417bd6b9
SHA512 01bb81ebb678b65027931bc5946e4c52ad3a492950d74db5d410a8d008cba96c434b5c1e74792fc85d53e67bb6dd27cb24941c033e64f95340a110843ba4f8d9
SSDEEP 6291456:ROQD5R5jsdtprJahf5hvuwO+8LwgfNoRlmL2XYLt:nGtprJahfr2HesxB
TLSH
T1E9A833AEA5C16F38EEDE593F8FA3810078369C31642B4E4399507484C379179EF6AF85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3144	Demo_RustTweaker_v1.3.2.tmp
1616	MicrosoftEdgeWebview2Setup.exe
1716	MicrosoftEdgeUpdate.exe
2112	RustTweaker.exe

Loads dropped DLL 1 IoCs

pid	Process
1716	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MicrosoftEdgeUpdate.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2112	RustTweaker.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_hi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_hu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\RustTweaker\is-IQ949LNIRP.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-MCLYK0TB6C.tmp	Demo_RustTweaker_v1.3.2.tmp
File opened for modification	C:\Program Files (x86)\RustTweaker\Microsoft.WindowsAPICodePack.ExtendedLinguisticServices.dll	Demo_RustTweaker_v1.3.2.tmp
File opened for modification	C:\Program Files (x86)\RustTweaker\Microsoft.WindowsAPICodePack.Sensors.dll	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\is-LI4U56653D.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\assets\is-OH2J0PMFXD.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-A3Y95UN4S7.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-FZ5RWP4ZLH.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-X8E1BP2WTC.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-PARCD0N5NJ.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-ZCL6421Y7I.tmp	Demo_RustTweaker_v1.3.2.tmp
File opened for modification	C:\Program Files (x86)\RustTweaker\unins000.dat	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-O0JG6VC8MU.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-P8A859CBNM.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_el.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\RustTweaker\content\assets\is-566R4QCEJM.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-N0JGY19SSO.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-QJZ6V9D8ZM.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\psmachine.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_te.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\RustTweaker\runtimes\win-x64\native\WebView2Loader.dll	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-UZXIQ1DRZJ.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-ERZ28L3FAS.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-V4OGBWBNFB.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_kk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_sr-Cyrl-BA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\RustTweaker\is-LYV74VZBP9.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-DDPY7879B4.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-O2D9O7ZB2T.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\MicrosoftEdgeUpdate.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_as.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-BY1GB2U7XA.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-3NNWRB03QO.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-Q6S7YEGEII.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_de.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_fil.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_tr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_zh-CN.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\RustTweaker\Microsoft.Web.WebView2.Core.dll	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-LZYM0Q5EW3.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-5M393GHYSF.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-1N7THLLJS9.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-U94O4CVIZT.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\assets\is-OJHYOLH0PZ.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\assets\is-CBS4J0KZEM.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-9HDORNVNPJ.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-244KB5SK0E.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\psuser.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_or.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-30I3QA23JI.tmp	Demo_RustTweaker_v1.3.2.tmp
File opened for modification	C:\Program Files (x86)\RustTweaker\runtimes\win-arm64\native\WebView2Loader.dll	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-K64MO8W9JI.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\is-8QF5G5JFVK.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\is-HRM81BYOK7.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\assets\is-ZE1M38Y1NR.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\assets\is-4MXQPEBKLO.tmp	Demo_RustTweaker_v1.3.2.tmp
File created	C:\Program Files (x86)\RustTweaker\content\imgs\is-J09GK7BY8X.tmp	Demo_RustTweaker_v1.3.2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RustTweaker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Demo_RustTweaker_v1.3.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Demo_RustTweaker_v1.3.2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3432-0-0x0000000000280000-0x0000000000372000-memory.dmp	innosetup
behavioral2/memory/3432-7-0x0000000000280000-0x0000000000372000-memory.dmp	innosetup
behavioral2/memory/3432-564-0x0000000000280000-0x0000000000372000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3144	Demo_RustTweaker_v1.3.2.tmp
3144	Demo_RustTweaker_v1.3.2.tmp
1716	MicrosoftEdgeUpdate.exe
1716	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1716	MicrosoftEdgeUpdate.exe
Token: SeBackupPrivilege	1716	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1716	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3144	Demo_RustTweaker_v1.3.2.tmp

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 3144	3432	Demo_RustTweaker_v1.3.2.exe	78
PID 3144 wrote to memory of 1616	3144	Demo_RustTweaker_v1.3.2.tmp	80
PID 1616 wrote to memory of 1716	1616	MicrosoftEdgeWebview2Setup.exe	81
PID 1716 wrote to memory of 2996	1716	MicrosoftEdgeUpdate.exe	82
PID 3144 wrote to memory of 2508	3144	Demo_RustTweaker_v1.3.2.tmp	84

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2508	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Demo_RustTweaker_v1.3.2.exe
"C:\Users\Admin\AppData\Local\Temp\Demo_RustTweaker_v1.3.2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\is-GZXEO4YXLZ.tmp\Demo_RustTweaker_v1.3.2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GZXEO4YXLZ.tmp\Demo_RustTweaker_v1.3.2.tmp" /SL5="$90054,202648027,928768,C:\Users\Admin\AppData\Local\Temp\Demo_RustTweaker_v1.3.2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Users\Admin\AppData\Local\Temp\is-SVYWIFINR0.tmp\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-SVYWIFINR0.tmp\MicrosoftEdgeWebview2Setup.exe" /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\MicrosoftEdgeUpdate.exe" /install /quiet /norestart "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1716" "904" "804" "900" "0" "0" "0" "0" "0" "0" "0" "0"
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2996
- - C:\Windows\SysWOW64\attrib.exe
    "attrib" -R "C:\Program Files (x86)\RustTweaker" /S /D
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2508

C:\Program Files (x86)\RustTweaker\RustTweaker.exe
"C:\Program Files (x86)\RustTweaker\RustTweaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\MicrosoftEdgeUpdate.exe
Size 201KB
SHA256 955b5950fd92e5c5eec395b022566c9a2594ca3126d894408e2e29ba25d8b0dd
MD5 b299aa9a27c330a9b44e45bd1595dbea
SHA1 168229a9c05dba514108c58d405ded009e0a00f1
SHA512 ab6c023fc625cacf1cae8df81313ffd4d2864489d5b057c50e9a8eeed3ef68bdb0b2fafa4009562614a9030cb9f2c846409b7817f09a7f555d618396ea1855c4
SSDEEP 3072:eZrfRY16X/uQQTlEDm2fsFg+fJivC6C36oEWkrVAB+f2/VeAKlxBDesH5LToGwBf:EGHlEDmozJC3UreB+uCfc
TLSH
T18C14501237F84A68F8F39E315C748B29DA3ABC319E34EA6E1684119D2D34A51DD31B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdate.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdate.dll
Size 2.2MB
SHA256 f3b294746b21ae8f8e114dce1a8709f6f43290663a397f9b045a2cb22703a9e0
MD5 4fb7a9d21d9172ebe74213734f6a0cb9
SHA1 0e1044182c767a78804c3ac8bce3b23252080f95
SHA512 37cef13ba4756d8ee58e22b473e8ba7e174bf284b8cbda93da2edda112b206c681d62bdc53e4eb4e480dc5aa170f3641941ce0a783d35a2d9475b08eebbe9aa6
SSDEEP 49152:fMKdmGVaC8yvazCwbn0YVbLv9AvbRy0eV7CaT8wi:bRVaC8BbR8RyTVb8/
TLSH
T159B58D2125FC4076E4B642B18BE9A916A5B8FC3117308CDB43F0668E7A729C25477F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgeupdateres_en.dll

Path C:\Program Files (x86)\Microsoft\Temp\EUD879.tmp\msedgeupdateres_en.dll
Size 27KB
SHA256 434273ca930bef6293c477c7fd81e6341bc3be00444bf157fd649b7b66a79664
MD5 80da6f34dff56661e845ed8a0172bf9a
SHA1 435b941196a604f200365f1e1b8855a055a18d7f
SHA512 81d5fccec3e7a9507f0823b8c9249006542f0d9cf0e0a610db2bc61873566e9a285b8fcd7766800558ef0e15684dca4fc2b3fc6d5f0857ee43280edac1ab706e
SSDEEP 384:/QZVFXh7BWmdIWrkagyDlBlR2qHRN7RP3U0R9zUco6:myagyDlpze49zrV
TLSH
T1ECC2428597F88119F6F73F307EB896A21D3ABD91AE34D61D2200A41C1872B51EE74B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RustTweaker.exe

Path C:\Program Files (x86)\RustTweaker\RustTweaker.exe
Size 5.6MB
SHA256 eb0b76b0f56e47d8e19e2b1a1595851e3099dd0839f16a0a300d91ead5916187
MD5 cb5699f1b1209c145f5dc762b73d37f2
SHA1 d453504c5990b246179e222b1ccd3f31ca27ba54
SHA512 9f27e58dd041d2a1502c5299c88482789d16a70802a3ef6c4baf35541dde4934571576753a6cbf8ae04db827fddb083d41af52f8a8f847bff1a59562eedc38e8
SSDEEP 98304:n/CaK0yueEmA+/b7jZGTWmlTzlgQJcx8txiJIX+8xde0F5m9sE95Ly1QUzqOW1WT:/C90yueEmA+/bfZGTWmlTzlhJu8txiJ0
TLSH
T1FA569E0D7AE59300DC2B427A4FE0864406E16D32DE9FCB0762D529D3EAF23895BD635E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Demo_RustTweaker_v1.3.2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-GZXEO4YXLZ.tmp\Demo_RustTweaker_v1.3.2.tmp
Size 3.6MB
SHA256 ec8dbf2cbbf95bd377fc75116ca55b37ab0c4036d0adcffbb99ad4a5919ca0e4
MD5 a3772a2a212ebb7bcb47d87da85087d3
SHA1 417f3a697045e8e591257459451f5eda40d76672
SHA512 b4779f4fd0cfe9fde762f6952cef3333677151ad4585230b3bcb7b2cc640ab5003443a4b16a28f1f711e2385b5265246cd823dacaf762bc808a3989880f64fef
SSDEEP 49152:83SA9I3bZxTZElVySH6UNoO7zjQynN4s7UUZyE8eECaN2Me333iN5:8CbWroSkynN4sQ+TdMe333e
TLSH
T177066C1BB3C4663ED85B1A395F37AA50543F7E7229128C275BE40A8CCE752402E3A777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeWebview2Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-SVYWIFINR0.tmp\MicrosoftEdgeWebview2Setup.exe
Size 1.6MB
SHA256 6a2f2492ea642e3965ce2421e257da53ff18c5dee08df33c84c061ae47a8a302
MD5 b768bdd72bfd424df5f3e810efd5be0f
SHA1 1fa92acb060f417b3a6106cfe4e7370a202aef6c
SHA512 0b2443b5d94c0b737046267be93af10c6b0fa92af1cef38d8eb633f120dae1212e5238db8cc661782546796a262c28b44a9e35ec528e41143fd86899657ceafc
SSDEEP 49152:j7iGx3EEJssZPPbWglP/KCKacj36Kn/xCJNsD:PitE6s9plP/Yacj36UcsD
TLSH
T1C7752214A2E94032F0B32E3465F899B20A7EBD315F355ADB13411E6C1E346A2D63A77F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2112-559-0x0000000005270000-0x0000000005271000-memory.dmp

Download

memory/2112-558-0x0000000000630000-0x0000000000D4C000-memory.dmp

Download

memory/3144-13-0x0000000000230000-0x00000000005DD000-memory.dmp

Download

memory/3144-478-0x0000000000230000-0x00000000005DD000-memory.dmp

Download

memory/3144-5-0x0000000003250000-0x0000000003251000-memory.dmp

Download

memory/3144-9-0x0000000003250000-0x0000000003251000-memory.dmp

Download

memory/3144-11-0x0000000000230000-0x00000000005DD000-memory.dmp

Download

memory/3144-8-0x0000000000230000-0x00000000005DD000-memory.dmp

Download

memory/3144-562-0x0000000000230000-0x00000000005DD000-memory.dmp

Download

memory/3144-563-0x0000000000230000-0x00000000005DD000-memory.dmp

Download

memory/3432-0-0x0000000000280000-0x0000000000372000-memory.dmp

Download

memory/3432-7-0x0000000000280000-0x0000000000372000-memory.dmp

Download

memory/3432-564-0x0000000000280000-0x0000000000372000-memory.dmp

Download