16e1ec3e0d43c7dfc91813926f550c506883d6b86d0d3abc175c3331ad131858

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe
Size 10.2MB
Sample260630-kg9ntsbs8l
SHA256 16e1ec3e0d43c7dfc91813926f550c506883d6b86d0d3abc175c3331ad131858
MD5 68cc8ced6bcf486183cdf5e43a8f2f0a
SHA1 4f53df3574ae858de85bc86b0d3a8dd1dbcea572
SHA512 b6b1e5450500488dfaa628c3aa43fb2de5e68575b3871116e5ca06ff11a5da029cdc42a43f16ad0d7ccfbedc040eef9fce67b0d2277dcceccae2cc8c1f902875
SSDEEP 98304:oIVPRodSt97Aw/G4QBbiJqd5mkLss8HPJvQ:/VPRoopGiyEJvQ
TLSH
T159B6E7256A5B996CD49BC474834B8A76497130CB0B3579FF448892383FAEBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\quobi-daemon.vbs	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 38 IoCs

discovery

Process Discovery

T1057

pid	Process
3728	tasklist.exe
5192	tasklist.exe
2020	tasklist.exe
2168	tasklist.exe
2332	tasklist.exe
2856	tasklist.exe
1824	tasklist.exe
708	tasklist.exe
4752	tasklist.exe
4384	tasklist.exe
1644	tasklist.exe
5440	tasklist.exe
1284	tasklist.exe
5192	tasklist.exe
4948	tasklist.exe
4872	tasklist.exe
5716	tasklist.exe
3036	tasklist.exe
1124	tasklist.exe
5224	tasklist.exe
1712	tasklist.exe
4356	tasklist.exe
2712	tasklist.exe
4832	tasklist.exe
3428	tasklist.exe
3208	tasklist.exe
2620	tasklist.exe
3036	tasklist.exe
5732	tasklist.exe
2576	tasklist.exe
1656	tasklist.exe
4492	tasklist.exe
5600	tasklist.exe
3476	tasklist.exe
1700	tasklist.exe
5012	tasklist.exe
5432	tasklist.exe
1980	tasklist.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_25634583\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_427122043\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_25634583\crl-set	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_427122043\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_25634583\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_427122043\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-lt.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2536	msedgewebview2.exe
2536	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5616	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	tasklist.exe
Token: SeDebugPrivilege	4832	tasklist.exe
Token: SeDebugPrivilege	4872	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	2332	tasklist.exe
Token: SeDebugPrivilege	1980	tasklist.exe
Token: SeDebugPrivilege	3428	tasklist.exe
Token: SeDebugPrivilege	3208	tasklist.exe
Token: SeDebugPrivilege	5224	tasklist.exe
Token: SeDebugPrivilege	5440	tasklist.exe
Token: SeDebugPrivilege	5600	tasklist.exe
Token: SeDebugPrivilege	5716	tasklist.exe
Token: SeDebugPrivilege	1284	tasklist.exe
Token: SeDebugPrivilege	5192	tasklist.exe
Token: SeDebugPrivilege	3036	tasklist.exe
Token: SeDebugPrivilege	4752	tasklist.exe
Token: SeDebugPrivilege	4492	tasklist.exe
Token: SeDebugPrivilege	2856	tasklist.exe
Token: SeDebugPrivilege	1824	tasklist.exe
Token: SeDebugPrivilege	3728	tasklist.exe
Token: SeDebugPrivilege	708	tasklist.exe
Token: SeDebugPrivilege	5192	tasklist.exe
Token: SeDebugPrivilege	3036	tasklist.exe
Token: SeDebugPrivilege	5732	tasklist.exe
Token: SeDebugPrivilege	2020	tasklist.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeDebugPrivilege	2576	tasklist.exe
Token: SeDebugPrivilege	1644	tasklist.exe
Token: SeDebugPrivilege	1712	tasklist.exe
Token: SeDebugPrivilege	1700	tasklist.exe
Token: SeDebugPrivilege	3476	tasklist.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	5012	tasklist.exe
Token: SeDebugPrivilege	4356	tasklist.exe
Token: SeDebugPrivilege	2620	tasklist.exe
Token: SeDebugPrivilege	1656	tasklist.exe
Token: SeDebugPrivilege	2712	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 5616	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	88
PID 5616 wrote to memory of 5560	5616	msedgewebview2.exe	89
PID 5616 wrote to memory of 5188	5616	msedgewebview2.exe	90
PID 5616 wrote to memory of 5188	5616	msedgewebview2.exe	90
PID 5616 wrote to memory of 5188	5616	msedgewebview2.exe	90
PID 5616 wrote to memory of 5188	5616	msedgewebview2.exe	90
PID 5616 wrote to memory of 4804	5616	msedgewebview2.exe	91
PID 5616 wrote to memory of 4792	5616	msedgewebview2.exe	92
PID 5616 wrote to memory of 4792	5616	msedgewebview2.exe	92
PID 5616 wrote to memory of 4792	5616	msedgewebview2.exe	92
PID 5616 wrote to memory of 6040	5616	msedgewebview2.exe	93
PID 5616 wrote to memory of 6040	5616	msedgewebview2.exe	93
PID 5616 wrote to memory of 6040	5616	msedgewebview2.exe	93
PID 5616 wrote to memory of 6040	5616	msedgewebview2.exe	93
PID 5616 wrote to memory of 6040	5616	msedgewebview2.exe	93
PID 3868 wrote to memory of 4948	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	94
PID 3868 wrote to memory of 4832	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	97
PID 3868 wrote to memory of 4872	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	99
PID 3868 wrote to memory of 1124	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	101
PID 3868 wrote to memory of 2332	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	103
PID 3868 wrote to memory of 1980	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	105
PID 3868 wrote to memory of 3428	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	107
PID 3868 wrote to memory of 3208	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	110
PID 3868 wrote to memory of 5224	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	112
PID 3868 wrote to memory of 5440	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	114
PID 3868 wrote to memory of 5600	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	116
PID 3868 wrote to memory of 5716	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	118
PID 3868 wrote to memory of 1284	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	120
PID 3868 wrote to memory of 5192	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	122
PID 3868 wrote to memory of 3036	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	124
PID 3868 wrote to memory of 4752	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	128
PID 3868 wrote to memory of 4492	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	130
PID 3868 wrote to memory of 2856	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	132
PID 3868 wrote to memory of 1824	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	134
PID 3868 wrote to memory of 3728	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	136
PID 3868 wrote to memory of 708	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	138
PID 5616 wrote to memory of 4896	5616	msedgewebview2.exe	140
PID 5616 wrote to memory of 4896	5616	msedgewebview2.exe	140
PID 5616 wrote to memory of 4896	5616	msedgewebview2.exe	140
PID 3868 wrote to memory of 5192	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	141
PID 3868 wrote to memory of 3036	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	143
PID 3868 wrote to memory of 5732	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	145
PID 3868 wrote to memory of 2020	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	147
PID 3868 wrote to memory of 4384	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	149
PID 3868 wrote to memory of 2576	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	151
PID 5616 wrote to memory of 1824	5616	msedgewebview2.exe	153
PID 5616 wrote to memory of 1824	5616	msedgewebview2.exe	153
PID 5616 wrote to memory of 1824	5616	msedgewebview2.exe	153
PID 3868 wrote to memory of 1644	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	154
PID 3868 wrote to memory of 1712	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	156
PID 3868 wrote to memory of 1700	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	158
PID 5616 wrote to memory of 2536	5616	msedgewebview2.exe	160
PID 3868 wrote to memory of 3476	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	161
PID 3868 wrote to memory of 2168	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	163
PID 3868 wrote to memory of 5012	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	165
PID 3868 wrote to memory of 4356	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	167
PID 5616 wrote to memory of 2828	5616	msedgewebview2.exe	169
PID 5616 wrote to memory of 2828	5616	msedgewebview2.exe	169
PID 5616 wrote to memory of 2828	5616	msedgewebview2.exe	169
PID 3868 wrote to memory of 2620	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	170
PID 3868 wrote to memory of 1656	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	172
PID 3868 wrote to memory of 2712	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	174
PID 3868 wrote to memory of 5432	3868	2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe"
1⤵
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3868.5656.2875841513807959750 /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView /prefetch:4 /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8871f5fd8,0x7ff8871f5fe4,0x7ff8871f5ff0
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView" --webview-exe-name=2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,2142298599179056426,3409487710991567596,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView" --webview-exe-name=2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2112 --field-trial-handle=1776,i,2142298599179056426,3409487710991567596,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView" --webview-exe-name=2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1776,i,2142298599179056426,3409487710991567596,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView" --webview-exe-name=2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3408 --field-trial-handle=1776,i,2142298599179056426,3409487710991567596,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView" --webview-exe-name=2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4408 --field-trial-handle=1776,i,2142298599179056426,3409487710991567596,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView" --webview-exe-name=2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1776,i,2142298599179056426,3409487710991567596,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView" --webview-exe-name=2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4548 --field-trial-handle=1776,i,2142298599179056426,3409487710991567596,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView" --webview-exe-name=2026-06-29_68cc8ced6bcf486183cdf5e43a8f2f0a_akira_rusty-stealer.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=1776,i,2142298599179056426,3409487710991567596,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c35367e119e043b34166386632e7c88df74333cd
    3⤵
    PID:2828
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5224
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5440
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5600
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5716
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5192
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3728
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:708
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5192
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5732
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq voice-type.exe" /NH
  2⤵
  - Enumerates processes with tasklist
  PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.toml

Path C:\Users\Admin\.config\voice-type\config.toml
Size 408B
SHA256 f539a08203fd52597b863ae33b890f396f4f5d73122eae8b6ca36e26a75efdbf
MD5 bceefb949915806f26ab7191ca53f47d
SHA1 9d10fc4e2eba1454a7e6d2f8b8b522857edc3ff7
SHA512 4aaf0be28727b456dfcfd58a081f063e3b79b6d9880bfaa4cafc9c008d9f79691f8402fd31b72536c5bb75f6311717ae3cf5d1223c1e0bdb9e0edc13d7b4946d
TLSH
T17CE0220AA1E31E2F009E42D7BB68800B1BD49AA9001D3660A5A7E3341008B5C03EEE2F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ffb7261bf6dc33b3f1318dc99e42857d6f5b7594985ab3babdc3fa361379539b
MD5 54475dc05281f42c4f1283a98241ba05
SHA1 c22d06f94bb4249be4e61b9af955a74f79a3228f
SHA512 6832d8fb96f3e405160741ddf0acdeec924f85107f42bf9b25dc8fa37915c7a0d3c9a9461a415fad63879c804d3921978464ee68d981ad813f258f712ff49170
TLSH
T130D01217360141F8C11034330502A1481840D53F8205C0805828991DAB144950D07442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d8b5d72e778b97eaab7e045af984b88be7adff23fdd26c631c1e35ff41ef5852
MD5 13a141be67d1eaf8cf9c608a7f953bcb
SHA1 d04850807075a6d51a2c75d20ff36b6c7169acd5
SHA512 02489bd76afe0e77f110f7372a02247e312540b954e5f764d7ab55bb3e66127bb5fa6c6abb45d140509eb60b0af9133405d6cf8dd2a4e404bcd2352c7e33f04f
TLSH
T16CD00415750440C5C30434314510C15055405C345701C1C00450140CD5504470407001
MD5 SHA1 SHA512 TLSH

Submit Download

4199eb18-aff2-4b6d-b447-474afde75694.tmp

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Default\4199eb18-aff2-4b6d-b447-474afde75694.tmp
Size 6KB
SHA256 fcf7c3462ab128f0ac574b6e117d258e9366468ed19d3e33056738f70cb65959
MD5 8f9a4c7728edb0d9ccbe450516752649
SHA1 ba1986a985f08879ef269ec2cd3f5e7b2adab88a
SHA512 d9f4f59470dfbe01a19a7b2940ddf5f4e559459438b601f3b053979420d1f4d91b5ccecab2b74554e9c201a179edeabb4f8e1ded4aa66cf3fdbd038615e0fcf3
SSDEEP 96:stI/dPyP1b9MkSo5h16Z0as7/x+6MhmuecJJx1ejeTK+gD128XM1C7K:stsFzhonasV+FdJxQjJjG6K
TLSH
T11AD1C7025E24697B4CC6F509BE39BA17E6F9503261D51E58EBF8861C05EBADC6303C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 316ccb913914b1311fb95791fa95da55af9d83c1bc2d44715503962ccb56a2d0
MD5 c6218d995ac2dce08b2be42338832a01
SHA1 9e8ce2457a973a60b222f28849134092f251b89b
SHA512 0f33c22a85b60583bcb3e850786fd0ff477c8739e08eea8094953679a703809e4ca99f25e6a9584d5924f2021d5425b7e9c61b246146fa95e34f6f4d39186bf3
TLSH
T1E5A0025642D24556D21817B014D105E533719D35532357DD89D124B888627A06A5E000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590054.TMP

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe590054.TMP
Size 48B
SHA256 5cfce31f772215cd330c51cfe433b5d9e60313e902087efed219baa4ddac72c2
MD5 e7e2464bd9c62528975b6caea3e0c9c8
SHA1 01791bde0533720ac669a58fb6ab075e435442c8
SHA512 d672892c8eee7866f4b5434952da5e39f03c4a43d794125346eccf3e92a4879abe25fc1d5e9f3dc1780fdc8b5047e8bb66e85d7229dfc968ac57dfa60cc04a39
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Default\Extension State\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59d596.TMP

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Default\Network\Network Persistent State~RFe59d596.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Default\Preferences
Size 6KB
SHA256 02b1c366d05164fbdec75750793804e5a8b0b5fd751922f368a0047368fcbae3
MD5 2f9439f81db86d722872b109a336aeb0
SHA1 a6a24762c84cc5cb5fee3cee8c4a595003fe9113
SHA512 6f9b32fe4845d6240c7cbda2cab79bac1c3bba67714a2d0f8a19a43e8b8ab6014388437117ed9c59fa3b674f1451f5828fd0dab5fef6fd9001bf6feeefc15a5b
SSDEEP 96:stI/dPyuG1b9MkSo5h16Z0as7/x+6MhmuecJJx1ejeTK+gObY28XM1C7K:stsF9honasV+FdJxQjJHG6K
TLSH
T14ED1B6035E24697B4CCAE509BE29BA17E2F9503261D51E58EBFC861C05EBADC630381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Local State
Size 15KB
SHA256 02b265b4c2a8be518aadb2e1d5160823e62b0bbfa33add195f3fd6de136f3390
MD5 76717eb76d16ff6df7e1111675440fb1
SHA1 ac7a14863802c94140b3dee459014a92899479bd
SHA512 f22f6d3130ed462f06c0f4069aaa83cdb56d81ace6419584a232953f60f910b0c546b3857c06b0486adbdfcaa6a76d37fee3b77f28fdd292d5f67135d9f8d58a
SSDEEP 384:8srv+89zHqlDNP9oid6NBSkiH2aLqisdYDvNZ:nrv+4UNbd+k/qisGLNZ
TLSH
T199729F33E83C6A335DF2C905B8867B177F7C50AB56825FA0E9985B8C428B0D52317D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Local State
Size 2KB
SHA256 6ce0edacaae008c41a27736ae6db1a88e0236f4efb15406f7464ec0e691ee0b6
MD5 4587c8b32dda92debfe5c207f99ccf76
SHA1 52cd679c864d5efaa13733961af04487ef3fce02
SHA512 1ba6b2ebf546bcce83a76921461d6a727edc9f52372d3f7934b211a26861e4479f28a4fce3f2b269648ed0d8e349a4a7321a7bb23e4092adce1d8b2f53efcac7
TLSH
T1A651857368249B7689E38A157D57BF22CE3A40A9AB522F50AEDC4B0C02C70AC5357C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Local State
Size 3KB
SHA256 325950786b414d21eb08e4e1e6535e91b947d12dfa783f44d3686d5f53718b5c
MD5 14fd5cace237af00af88846788d33cf2
SHA1 e1401928adcbae3357b064f821aa549b05523fad
SHA512 edd0f4adf21a4ea6cff611d47d291c890b33c5bfaec6da40a353c34b08a65dfa46b15ec25859d614340340baf24e6bb9f42685293cf11a40a7406ed7e75e994a
TLSH
T175718577686499374DE3CA057C827B16AF75402BEA827F95EAEC0F0C02C72981353C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58aee8.TMP

Path C:\Users\Admin\AppData\Local\com.quobi.app\EBWebView\Local State~RFe58aee8.TMP
Size 1KB
SHA256 1aa9e725a5fc2218d35e23f2c90af73b83911f3569159a2c8b7e7b1bf107ba43
MD5 8f328456d89c184d3fcea707ae28361d
SHA1 bbfe72ae06437ec5e9a68d0dfed215bf36295e29
SHA512 c789372336058f89dd0869889495a0f77bea6022cd0a36e66879ec4069e08b0d3538cd0d7302a3639458e0aea5a0365f21f8317aed7e0e0bc6ee4ce4813349eb
TLSH
T17A3112B2D8A45B729CD29A573953FA678E31006E97518F4479DC8A0C03D70DC966B832
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5616_1859079266\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1824-473-0x0000018482CC0000-0x0000018482CEA000-memory.dmp

Download

memory/1824-462-0x0000018482CF0000-0x0000018482CF1000-memory.dmp

Download

memory/2536-489-0x0000027AD4CB0000-0x0000027AD4CB1000-memory.dmp

Download

memory/2536-498-0x0000027AD4CB0000-0x0000027AD4CB1000-memory.dmp

Download

memory/2536-493-0x0000027AD4CB0000-0x0000027AD4CB1000-memory.dmp

Download

memory/2536-494-0x0000027AD4CB0000-0x0000027AD4CB1000-memory.dmp

Download

memory/2536-487-0x0000027AD4CB0000-0x0000027AD4CB1000-memory.dmp

Download

memory/2536-497-0x0000027AD4CB0000-0x0000027AD4CB1000-memory.dmp

Download

memory/2536-496-0x0000027AD4CB0000-0x0000027AD4CB1000-memory.dmp

Download

memory/2536-495-0x0000027AD4CB0000-0x0000027AD4CB1000-memory.dmp

Download

memory/2828-514-0x000001EC82CF0000-0x000001EC82CF1000-memory.dmp

Download

memory/2828-525-0x000001EC82CC0000-0x000001EC82CEA000-memory.dmp

Download

memory/4896-274-0x00007FF8A81D0000-0x00007FF8A81D1000-memory.dmp

Download

memory/4896-275-0x0000012F0DF80000-0x0000012F0DF81000-memory.dmp

Download

memory/4896-360-0x0000012F0DF50000-0x0000012F0DF7A000-memory.dmp

Download

memory/5188-103-0x00007FF8A8470000-0x00007FF8A8471000-memory.dmp

Download

memory/6040-95-0x00007FF8A8470000-0x00007FF8A8471000-memory.dmp

Download