925fe0f97259b91fbb0fb9c5b2f225db40eb3726a3fc09012675a0f08fe32cb2

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe
Size 9.8MB
Sample260818-dnmpbavejg
SHA256 925fe0f97259b91fbb0fb9c5b2f225db40eb3726a3fc09012675a0f08fe32cb2
MD5 8acdef32325865c79da3d168ff49b3e4
SHA1 802b6294caecc98129c9c2470c9e918b66b6c83f
SHA512 b70d1b375da9d98e2ff0bd9b92612e111fedbeb1632515fcbac254d72cb40e46c7ea7b1bcb3cd4de79fdfcf5fca1f0c27e7e3d680a84dbd4bd4e0f0aeacf993f
SSDEEP 196608:jXJg8kn2AElX5p7bmXXhX0AdvUXnQAOSwbVPaiLT7Iw/H:7V7bmXXhX0AdvWnQAOSwBSiLTh
TLSH
T11EA64B03F66291E8C16AC075935A6232FA32BC8D47357AEB57E04B213E65FD06B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1934586602\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_2111028131\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1679502901\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1934586602\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1934586602\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_2111028131\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1934586602\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1934586602\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1934586602\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1679502901\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1934586602\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_2111028131\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1934586602\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1934586602\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1679502901\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1464	msedgewebview2.exe
1464	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1228	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5092	2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe
5092	2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5092	2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1228	5092	2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe	88
PID 1228 wrote to memory of 4064	1228	msedgewebview2.exe	89
PID 1228 wrote to memory of 6272	1228	msedgewebview2.exe	90
PID 1228 wrote to memory of 6272	1228	msedgewebview2.exe	90
PID 1228 wrote to memory of 6272	1228	msedgewebview2.exe	90
PID 1228 wrote to memory of 6272	1228	msedgewebview2.exe	90
PID 1228 wrote to memory of 6392	1228	msedgewebview2.exe	91
PID 1228 wrote to memory of 6044	1228	msedgewebview2.exe	92
PID 1228 wrote to memory of 6044	1228	msedgewebview2.exe	92
PID 1228 wrote to memory of 6044	1228	msedgewebview2.exe	92
PID 1228 wrote to memory of 3724	1228	msedgewebview2.exe	93
PID 1228 wrote to memory of 3724	1228	msedgewebview2.exe	93
PID 1228 wrote to memory of 3724	1228	msedgewebview2.exe	93
PID 1228 wrote to memory of 3724	1228	msedgewebview2.exe	93
PID 1228 wrote to memory of 3724	1228	msedgewebview2.exe	93
PID 1228 wrote to memory of 6572	1228	msedgewebview2.exe	97
PID 1228 wrote to memory of 6572	1228	msedgewebview2.exe	97
PID 1228 wrote to memory of 6572	1228	msedgewebview2.exe	97
PID 1228 wrote to memory of 6568	1228	msedgewebview2.exe	98
PID 1228 wrote to memory of 6568	1228	msedgewebview2.exe	98
PID 1228 wrote to memory of 6568	1228	msedgewebview2.exe	98
PID 1228 wrote to memory of 2972	1228	msedgewebview2.exe	99
PID 1228 wrote to memory of 2972	1228	msedgewebview2.exe	99
PID 1228 wrote to memory of 2972	1228	msedgewebview2.exe	99
PID 1228 wrote to memory of 1464	1228	msedgewebview2.exe	100
PID 1228 wrote to memory of 5768	1228	msedgewebview2.exe	101
PID 1228 wrote to memory of 5768	1228	msedgewebview2.exe	101
PID 1228 wrote to memory of 5768	1228	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5092.3164.3777866626535474903 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView /prefetch:4 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffcee845fd8,0x7ffcee845fe4,0x7ffcee845ff0
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1696 --field-trial-handle=1700,i,2713247932842680778,4266139023046789857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166
    3⤵
    PID:6272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1700,i,2713247932842680778,4266139023046789857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166
    3⤵
    PID:6392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1700,i,2713247932842680778,4266139023046789857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3336 --field-trial-handle=1700,i,2713247932842680778,4266139023046789857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166 /prefetch:1
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1700,i,2713247932842680778,4266139023046789857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166
    3⤵
    PID:6572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=1700,i,2713247932842680778,4266139023046789857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=1700,i,2713247932842680778,4266139023046789857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4568 --field-trial-handle=1700,i,2713247932842680778,4266139023046789857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView" --webview-exe-name=2026-08-17_8acdef32325865c79da3d168ff49b3e4_akira_glassworm_megazord_rusty-stealer.exe --webview-exe-version=0.1.0-beta.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=1700,i,2713247932842680778,4266139023046789857,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c9b3039616137a4e8093ed0eed702fca9ac97166
    3⤵
    PID:5768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9819ab6bfd28a86534273ad73992d731aad323615be109592874443cecd72499
MD5 a3ca9cc202fbcfc2fcc55ea5567c6ab2
SHA1 ff94ed905d1d6e0092c9ba55686e409c93da2f17
SHA512 b37aeed4e8ca2e433bd7f25462be278cc61aa9d251c72e675da78e8cb295cfdae5eef3ba91f32000cd461ebedf5a574442a069be8d4ded80f0ea93435f8e0cfb
TLSH
T1BED0121372114238C81020330003710C0582D11B40054140592CC51D1E440E41F02C82
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3df29f04849751c867dace722af3e928b7d0c655c4ecf032b7eb805fbdc76370
MD5 2b836a6b05b24d26327a1be9a7b1f230
SHA1 6dcdf76bc8617497911d33890805da7d068ae3a9
SHA512 5ab1497f9e33fe61a0583a72f86192955e2653b43d9290516ff295749eb885a512fdf781707223145d4c2fec20bc2b2681023b4a851c728412f6e5e7b25816e2
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

706f375e-3612-4fee-9303-a7a2f1395af1.tmp

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Default\706f375e-3612-4fee-9303-a7a2f1395af1.tmp
Size 6KB
SHA256 8ad06aa4fae8957d49a93f13fac60c7add25ebe491da993dfbcbddf1dfb7169d
MD5 8a11a0231f38996d0e49f06c2ad9284d
SHA1 1e797543a8ef18ec9eb9d3f08505a8834071858b
SHA512 f942da92183ab8b2f0a09706caf4295ad51c8ebb7e376a8282191d650d717b980f274efa6fcf2d2ff144051baf946faf4b5c80df7752007b80990a2d739caa78
SSDEEP 96:stt/dJ7wIab9zOk5o5h16Z0ks7/x+6MhmuecJJm1ejeaK+gmD28XM1C7K:stxrSOuonksV+FdJmQj+oDG6K
TLSH
T122D1A6025E2479BB8CC6F518BA3ABA53E3F5653261D52D58EBF8852C04DA6CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 af39b500f70464abb2c139aa217cc1e6597f1fff2af4999db7fded45378fcdce
MD5 1f76c48a3e8ffac2877b256a405c273e
SHA1 83dc7ce67ab65817d38d6c008c5a3bfe421ce26c
SHA512 bd09090856c5055b9f170454fcac13c0c132729636c3f296f2c00b433ba46a8a818c4e0f66b139d59872443f33db548d8e69109d42029faffa4b14d14242cf09
TLSH
T126A002D147655412C210277514E1A14C36304D9292032F9745D40575AB693536102000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a087d.TMP

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a087d.TMP
Size 48B
SHA256 b16edcb3891b18140f1836407174aeba287fe0c1aa66b015f9e85c39a2f4eeca
MD5 cbacdbd180bf3f7c855675001b0b4156
SHA1 f8706a11f125ddb0380c8389fb83293b14d8b599
SHA512 210d7704e6150e090f1fd0e878a448b78e702be60af1816e6f35f9ec80dfcf202ba20855dadb223b6c2f8b1b17a475bd453f4b95a82c682db1c79775ebbd0d14
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Default\Network\Network Persistent State
Size 361B
SHA256 2d1bca421d120c1c28e14bc0eb255bc63fc5482980adb424cd4a787c0ffa364a
MD5 1eeada9b38ba10405ff6afae8f6cdf07
SHA1 9c8637045d1d3c8b5ad268630f1f2ef7a3fb1ec2
SHA512 33a9b4c12ec3feafc221cb2a94d12e8c58149eec86f2325a158ef7ff0b26e56ce67ff5a7915207144476ff36efc4e39669282b31cada4041e12b8003b998ab83
TLSH
T1E8E0C057C2E089BE4F4063E01B242D03C77E080663185E2BC9E9BB6A4BE2078C02044F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ace9c.TMP

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Default\Network\Network Persistent State~RFe5ace9c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Default\Preferences
Size 6KB
SHA256 0868906693318ee88116705bfe989701c2c59771c2e49199148696808d219c91
MD5 a258a80ffb714338a119b4e20d0abc8b
SHA1 db95369306b3357b29353fd66a5623d7d0b37885
SHA512 59b4470bc51d7740431ddb82fbe73a48a878b6f7402cdcda2e03624b5c6b62ff3e0b3ab70372cf2226431acdc947a03093f5a8cd0caa35c56fe7ae6e8d965a31
SSDEEP 96:stt/dJ7XGIab9zOk5o5h16Z0ks7/x+6MhmuecJJm1ejeaK+gpRg28XM1C7K:stxrUOuonksV+FdJmQj+fqG6K
TLSH
T1CED1A6025E24797B8CC7F518BA3ABB53E3F5653261952D58EBFC852C04DAACC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Local State
Size 15KB
SHA256 2cc26ff707b9bfbb096cab3ce936f572d39caecbc95efacdb64bd04f5282440a
MD5 4a60ca11880c37f56f7bd73cdc5b48a1
SHA1 4063639822a0e9624f5c75125c0ecae37288c8b6
SHA512 19d7c5f9c4269b54aca2bbe8d8cc709128c5dcb93a95aca8b13a7c57e19a41299c1edc2e6ab7fac61e3cf4659a04979c3aa76407fecf153c794056129f0c2b8e
SSDEEP 384:hCkGCMZkoU5//bZ2lw/M85Z3WNBSV90/JDREBgF:b8koU5HbMG8Bt8gF
TLSH
T1C072B0766C315E338AB7DE1CF58A3B069F88D22285456960CBCF9F1E42DB7C41304D29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Local State
Size 2KB
SHA256 8bfc68d40ed519123ca3a9d2413f59108f4fa869ddb95e9932704fcbe7674be0
MD5 9e2c8b8c5811d6c921d7e63fd34ac50a
SHA1 a967242a393eeda72ff806e03fb2ab19740c759e
SHA512 0efd49ea3fef25e37cc7ebdf7ba25e17111306ab601bd701d06ce8889cf2970ae074a8f25b2008472ce9fe3a68b54ffc3389f458b7df248a611c80414b33c63e
TLSH
T10F5175736C14AB37CAF2DA44B94B2F238F759156EA511F509AED0F0C01DA29D2302827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Local State
Size 3KB
SHA256 485f99b8b282957acf7902595c2daf2a93cd1fd283f7b62839a777815536b6a9
MD5 959240391dab264000295b7dc530c43a
SHA1 211698cbd1e433372309e95064a328f11914393d
SHA512 f66bf596075254ceba9b455285453288effd86f413ef46d09231046924bddfae1183806c838cec4905b82f2803fb64787c443a7c79f60870b8bb4f8d6c6929aa
TLSH
T1B96187776974A9378EF3DA04B9872B16ABA55127E5813FA5CAEC0F0C01D73882302817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59b6c3.TMP

Path C:\Users\Admin\AppData\Local\com.intouch.proxy\EBWebView\Local State~RFe59b6c3.TMP
Size 1KB
SHA256 196f5be5659d7aa00fc579c982d74d4cfe1c9af065972cdaa10a548a605baee1
MD5 505d282017bb90d71b212a66143885c5
SHA1 13db89bdee548925e7c5084d8d15465a28daa6d6
SHA512 8972cbe55dcf07807455830616e14a641ac262505ec5fe252d68798f5f42cacf26cfce378fe4f0eca8b4f48769c5737f65fce3721ca6b4e2498baa7c28305c7e
TLSH
T1292162F3E8A45F32DDE2F64522476F6B5F218157D2100E406AEE0F0C02DA29DA62A936
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_541517352\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1464-488-0x000001D394220000-0x000001D394221000-memory.dmp

Download

memory/1464-490-0x000001D394220000-0x000001D394221000-memory.dmp

Download

memory/1464-491-0x000001D394220000-0x000001D394221000-memory.dmp

Download

memory/1464-486-0x000001D394220000-0x000001D394221000-memory.dmp

Download

memory/1464-489-0x000001D394220000-0x000001D394221000-memory.dmp

Download

memory/1464-480-0x000001D394220000-0x000001D394221000-memory.dmp

Download

memory/1464-487-0x000001D394220000-0x000001D394221000-memory.dmp

Download

memory/1464-482-0x000001D394220000-0x000001D394221000-memory.dmp

Download

memory/3724-97-0x00007FFD102C0000-0x00007FFD102C1000-memory.dmp

Download

memory/3724-226-0x0000023DF5E90000-0x0000023DF5F39000-memory.dmp

Download

memory/3724-180-0x0000023DF5E90000-0x0000023DF5F39000-memory.dmp

Download

memory/6272-193-0x0000020FC2D10000-0x0000020FC2DB9000-memory.dmp

Download

memory/6272-177-0x0000020FC2D10000-0x0000020FC2DB9000-memory.dmp

Download

memory/6272-22-0x00007FFD102C0000-0x00007FFD102C1000-memory.dmp

Download

memory/6272-512-0x0000020FC2D10000-0x0000020FC2DB9000-memory.dmp

Download

memory/6572-237-0x00007FFD0FC10000-0x00007FFD0FC11000-memory.dmp

Download

memory/6572-236-0x00007FFD0F490000-0x00007FFD0F491000-memory.dmp

Download