6afbb2e3faba74ab0be59dd12a3b3bd37ae7f2fd83ced0294d2add21f9ebd280

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe
Size 10.6MB
Sample261026-x3kcaavy9m
SHA256 6afbb2e3faba74ab0be59dd12a3b3bd37ae7f2fd83ced0294d2add21f9ebd280
MD5 95b2584574406d76336f1875c70d1af5
SHA1 a454ba81ecb5b855880f98d2b4f4713724eb20da
SHA512 49c7ee93c8498a0a859343ba76f3913c0d3a07e13c112ecfb00b36d06610ad513bbf4c745966a09dafde29af53170bd866926a75def3c487d25ca175318bc18c
SSDEEP 98304:fx9R6u9XS9VUC3XiYyLj4m1NIIbqiYA7sZ1KdxQt7Ic3XlG:p76uc9iC3rMj917bqiYAwZtX4
TLSH
T121B6F8217A5B99ACD19BC474834B4A624A3170CB0B35B9FF449492383F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_747063836\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_610648059\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_747063836\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_747063836\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_747063836\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_747063836\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_610648059\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_747063836\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_747063836\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_610648059\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_610648059\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_747063836\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-sk.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3268	msedgewebview2.exe
3268	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5820	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6072	2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 5820	6072	2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe	90
PID 5820 wrote to memory of 1416	5820	msedgewebview2.exe	91
PID 5820 wrote to memory of 5840	5820	msedgewebview2.exe	92
PID 5820 wrote to memory of 5840	5820	msedgewebview2.exe	92
PID 5820 wrote to memory of 5840	5820	msedgewebview2.exe	92
PID 5820 wrote to memory of 5840	5820	msedgewebview2.exe	92
PID 5820 wrote to memory of 3752	5820	msedgewebview2.exe	93
PID 5820 wrote to memory of 4616	5820	msedgewebview2.exe	94
PID 5820 wrote to memory of 4616	5820	msedgewebview2.exe	94
PID 5820 wrote to memory of 4616	5820	msedgewebview2.exe	94
PID 5820 wrote to memory of 1948	5820	msedgewebview2.exe	95
PID 5820 wrote to memory of 1948	5820	msedgewebview2.exe	95
PID 5820 wrote to memory of 1948	5820	msedgewebview2.exe	95
PID 5820 wrote to memory of 1948	5820	msedgewebview2.exe	95
PID 5820 wrote to memory of 1948	5820	msedgewebview2.exe	95
PID 5820 wrote to memory of 3652	5820	msedgewebview2.exe	100
PID 5820 wrote to memory of 3652	5820	msedgewebview2.exe	100
PID 5820 wrote to memory of 3652	5820	msedgewebview2.exe	100
PID 5820 wrote to memory of 2980	5820	msedgewebview2.exe	101
PID 5820 wrote to memory of 2980	5820	msedgewebview2.exe	101
PID 5820 wrote to memory of 2980	5820	msedgewebview2.exe	101
PID 5820 wrote to memory of 4900	5820	msedgewebview2.exe	102
PID 5820 wrote to memory of 4900	5820	msedgewebview2.exe	102
PID 5820 wrote to memory of 4900	5820	msedgewebview2.exe	102
PID 5820 wrote to memory of 3268	5820	msedgewebview2.exe	103
PID 5820 wrote to memory of 4568	5820	msedgewebview2.exe	104
PID 5820 wrote to memory of 4568	5820	msedgewebview2.exe	104
PID 5820 wrote to memory of 4568	5820	msedgewebview2.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6072.5708.244284015121585866 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView /prefetch:4 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb23d15fd8,0x7ffb23d15fe4,0x7ffb23d15ff0
    3⤵
    PID:1416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1804 --field-trial-handle=1808,i,13992995456928489981,10975471855291953670,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1916 --field-trial-handle=1808,i,13992995456928489981,10975471855291953670,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1808,i,13992995456928489981,10975471855291953670,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3396 --field-trial-handle=1808,i,13992995456928489981,10975471855291953670,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0 /prefetch:1
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4364 --field-trial-handle=1808,i,13992995456928489981,10975471855291953670,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=1808,i,13992995456928489981,10975471855291953670,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=1808,i,13992995456928489981,10975471855291953670,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4512 --field-trial-handle=1808,i,13992995456928489981,10975471855291953670,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3268
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView" --webview-exe-name=2026-10-25_95b2584574406d76336f1875c70d1af5_akira_megazord_rusty-stealer.exe --webview-exe-version=0.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=1808,i,13992995456928489981,10975471855291953670,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:09007a39b3a2ac8aa41e1e9e7579d16b4e457fc0
    3⤵
    PID:4568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bc7f4a67118561b14e49f40a38910b3f354dac86f3bb866bdc8a7c708cfbbc0c
MD5 9a23e60ab2717d33c71c78920f6d6244
SHA1 a7b5a0d21b25813416827a726542ebb80d3b39a8
SHA512 93bf2cb5479208b51798dd731e4c4b0ed803421d12ea27c4bbb1b7fe7e60b458db232ef4da271ffa3e37fbdb55de218e0bddedc96bfd125505abd55bfe00024a
TLSH
T14ED0121637514534C4102033100266492841D10B41464400542A951D1A080681A0A847
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 68b877093ffe2fd41ba4190e0183db4e62c793aa9ca0bec214ae83605da56d1c
MD5 807b5922579ac7d4149ca7f2d13c57e1
SHA1 bdd97f30b64d769116c138c6d92059dd444d4c14
SHA512 9c190bab0ae7b2c13eb3f291907b38c2d8dd863ae2ef22f2718af5a60d9ef4af24bbf0073481e91d29ee354e2ba370338ccb4dbba72578528fe6a38a7815194c
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

47b01de1-4bed-4ef7-8288-c4ebfa039f22.tmp

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Default\47b01de1-4bed-4ef7-8288-c4ebfa039f22.tmp
Size 6KB
SHA256 d56063a9c6abd3bd3eea2ef06cf1e9b0bd4847e631ebad4d66f11c0c1e5c2643
MD5 05a503dabe45bb58cf94b7a2618fd625
SHA1 b1bfb5d509de3b0bb79ce1fa81a8e82f4113badb
SHA512 aec491ce1a690643570a57f9a53edae0d4e6e39bef8847542c6ea702a07169cf27bef4d565c0082327e27871b8b3d46c4c9396bbb86b3d2c20fc3f5f27e3ce8a
SSDEEP 96:stp/d/wWnb9/k7o5h16Z0Ks7/x+6MhmuecJKX1ejeZK+gn28XM1C7K:stNlJYonKsV+FdKXQj/9G6K
TLSH
T179D1B7115E34797B4CCAF109BA397B17E2F9603265D52E58E7FD862C04EA6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 3d1cb0ecbd4a200ff1d20fb3eb77ab8bf6066526c9c010af73c1cc84388251bf
MD5 ed7ef7e347b723ea820641bd6e14bcaf
SHA1 e000140e9a4950b7951b9994b9779b45c575d355
SHA512 91b604f7302a3f40bf956fca70f2ab10a12f5b0e157aa44760702aaadba40148bab691682c8eb01fe5b2e44601ab68d7744d02f902519bb400a7d15edda1b5b8
TLSH
T1CFB002BD63D45037C3801F7112C7E24836B7CCE012171FA651E6C1F695627A491555E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3d911c0546b18aaea9ad8f8b80b56d96521574c104e294ccd0e63ebfd2f5904d
MD5 0bca5edaf52518fcfd36104e25093cd3
SHA1 b447dfd9b7a6d42c62f55879e2aed78dbeb55a31
SHA512 7bbfb14ffa28804428951d911458b57bcb264a5f5c49874bc92fe7fcc9951680a4b82359bb271883fa5e00a4217c250afdc6029fa552a15533d148ec4a679873
MD5 SHA1 SHA512

Submit Download

7e37fc09-9fe3-414a-93d1-59464ebdfd47.tmp

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Default\Network\7e37fc09-9fe3-414a-93d1-59464ebdfd47.tmp
Size 821B
SHA256 e765ff971404721288c31a894cf1a355b3b5ccf2f4e7b00048a134752d0dae5c
MD5 1dc3a5cdae09de9182e548d78b26b27d
SHA1 73dc27752554b5ea735f817608eccfa07e421869
SHA512 f1ed773ee75887eff21f56c5a8cc729e9a8466fd179afdb87dd9ea506a363725df239a17f11c0305f0379d205f9bad3239d47cb330891181d6deac77d7978cda
TLSH
T124014EA2C3E4C67D8A4127E427347827CD3F091992282D27CDEDEBDA97E1475D22064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c696566b-dd18-494e-8ff1-c2e0e50a37d0.tmp

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Default\c696566b-dd18-494e-8ff1-c2e0e50a37d0.tmp
Size 6KB
SHA256 201dad3bddb360588b7730f251c8b036adbab0cac2a4954da407f435f9291a4a
MD5 79b61a27905197d5bf79a1b763b675b8
SHA1 659e4e5f41b71946a88bc0a5e941ac14ffa4f77c
SHA512 b0bc145cb7499c5d856954580c3e81e8814977b53c630dac3732f7e7e2ae32997a278013bc9df1c86814744178043beb64d73d4fb7141f0d3ef88ef200737a1a
SSDEEP 96:stp/d/wtGnb9/k7o5h16Z0Ks7/x+6MhmuecJKX1ejeZK+gA28XM1C7K:stNlLYonKsV+FdKXQj/WG6K
TLSH
T197D1B8025E24797B4CCBF118BA397B17E2F9603166D12E58E7FD462C04EA6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\Local State
Size 1KB
SHA256 6bfc75b7e4f4393c67790f3afd41c1da2c71385fb5739f9bf07ecbd70f6ca560
MD5 a98c6fd90512b86b586f633dfe20cea4
SHA1 b84e74bb3507c31aa5c0f751993dfa44e5808e5c
SHA512 c33e2320726e359fce88ab75f128438d7e992ef556ef931147ee8aecbabade0f4934aa2265018827fdb6b3890812409488c3bf71f44b43303b5c66fd79c2a6d7
TLSH
T18321B7F2E8605B33ECDAE20531173B034E35912783415E0452CF0B1D01E768DE2AAC37
MD5 SHA1 SHA512 TLSH

Submit Download

e1790c91-20fc-46f2-8c09-945232ce812e.tmp

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\e1790c91-20fc-46f2-8c09-945232ce812e.tmp
Size 2KB
SHA256 275e6d017edcff88dd36ff7fcaf03059efcd18ed8878138f8ff3c2fe5ea5377a
MD5 0089ee744028769205538fe3799dd2df
SHA1 584ca00af14ec506e3915c4a5116907c44c4fd7a
SHA512 e06f2a00e09870f676372ce360d004bcfc52b063d0e4e008a335dca01bcae7074da1ddc9ed0da7e64aba93eda37589d85a953439f03d9ff415f50bc561205dbf
TLSH
T1CF5151736C20AB37CDE69608795A2B13CA7D91629B522F519ACE0B1C00DBA5D2346C37
MD5 SHA1 SHA512 TLSH

Submit Download

e2672700-4829-482a-9cd1-9be940894435.tmp

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\e2672700-4829-482a-9cd1-9be940894435.tmp
Size 15KB
SHA256 953fd63cabba9b939aacb0981457b75a8907b353ad4f7fb35ffd207a5f0344e4
MD5 2e90b3dc562bf4a81822de5a6bbe9031
SHA1 b386e412efde0bc8cd008156ca2d3b97d40b27cb
SHA512 0249ff1a1bfe5e290b5e699e8bb4d557e51836496f710a421b0b3fbc46f7404216fe7c46ad27cd3428ffadab931602fbd38a8312a20218eab6bda03dd519c368
SSDEEP 384:P+OBqImmJvGBLx3NaFMJFNNBSJkoC3+dg1hg6r0:OcvGtlNSCOdgRI
TLSH
T117728D7A1C756A232CFBC249BA8A2347CBB96153C1C1BBE5CDEC5F0F116F5841392916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa09ba26-ea7f-4eef-b7b0-38e17e0634e6.tmp

Path C:\Users\Admin\AppData\Local\com.fdaciuk.rl-stats-hud\EBWebView\fa09ba26-ea7f-4eef-b7b0-38e17e0634e6.tmp
Size 3KB
SHA256 039196150a6a33ff4054593698289c421b34bde62571e1d93b1d1ce1125f97b4
MD5 a4bcb0d769a6af4f06be25ebe7d38d9f
SHA1 700fdf9b680fbe97e0c9e193fcf02261f684d6c4
SHA512 d74d1489869ee8e57a5b1b91a579aa144416c6a458f8b42ebe647a9004bc7a84479fbd770a4ac89395203da1bfc93f6f7f36c3eb55d325651088429af4d5300e
TLSH
T1BD6164776D74AA278EF6DA0479862B16AAB99123DA813F95CADD0E0C01D77882341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_1671756721\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_610648059\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_724857974\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5820_747063836\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1948-109-0x00007FFB45EA0000-0x00007FFB45EA1000-memory.dmp

Download

memory/3268-528-0x0000018F0FB10000-0x0000018F0FB11000-memory.dmp

Download

memory/3268-530-0x0000018F0FB10000-0x0000018F0FB11000-memory.dmp

Download

memory/3268-534-0x0000018F0FB10000-0x0000018F0FB11000-memory.dmp

Download

memory/3268-535-0x0000018F0FB10000-0x0000018F0FB11000-memory.dmp

Download

memory/3268-539-0x0000018F0FB10000-0x0000018F0FB11000-memory.dmp

Download

memory/3268-538-0x0000018F0FB10000-0x0000018F0FB11000-memory.dmp

Download

memory/3268-537-0x0000018F0FB10000-0x0000018F0FB11000-memory.dmp

Download

memory/3268-536-0x0000018F0FB10000-0x0000018F0FB11000-memory.dmp

Download

memory/3652-274-0x00007FFB46090000-0x00007FFB46091000-memory.dmp

Download

memory/3652-273-0x00007FFB44C80000-0x00007FFB44C81000-memory.dmp

Download

memory/5840-27-0x00007FFB45EA0000-0x00007FFB45EA1000-memory.dmp

Download