259689efa8250feabcee290634cc794f47e066cc7b0550be8e0e5405471aaece

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
Size 8.1MB
Sample260804-p6j7pabc32
SHA256 259689efa8250feabcee290634cc794f47e066cc7b0550be8e0e5405471aaece
MD5 184914ada8a95e7a1af3eb1e6e13ff6b
SHA1 938988c0150acc98f5e03e7ca45c97f430a8bc56
SHA512 a4fdf8bc4f5964c478012a52e4ab08377c0ee818d1090a555ceffc2768c0176627f7e967601818bbc430384f681c398ebca6bf09ad212ab7114ac98a5ffe5291
SSDEEP 98304:GP/CP3ZrhVHvFR3Y4uoSo8FahAV+Krzap1UyW8Slxt0DDn+Fl:LhY4yrzMylxWXOl
TLSH
T1FE868E03F6A281E8C06EC574C35EA633EB72B88D493476AF1BE41B212E16F506F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1626857468\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_2091518713\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_864676034\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_864676034\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_2091518713\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_2091518713\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1626857468\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_2091518713\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_2091518713\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_864676034\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_1942990575\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4516_864676034\_metadata\verified_contents.json	msedgewebview2.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5344	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3300	cmd.exe
5072	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\AppUserModelId\com.targame.app	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\AppUserModelId	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\AppUserModelId\com.targame.app\DisplayName = "TarGame"	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\AppUserModelId\com.targame.app\IconBackgroundColor = "FF1A1A2E"	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\AppUserModelId\com.targame.app\IconUri = "C:\\ProgramData\\TarGame\\notify-icon.png"	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
200	msedgewebview2.exe
200	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4516	msedgewebview2.exe
4516	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1488	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
1488	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
1488	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1488	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1320	1488	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe	89
PID 1320 wrote to memory of 4428	1320	net.exe	91
PID 1488 wrote to memory of 4516	1488	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe	92
PID 4516 wrote to memory of 5084	4516	msedgewebview2.exe	93
PID 4516 wrote to memory of 3256	4516	msedgewebview2.exe	94
PID 4516 wrote to memory of 3256	4516	msedgewebview2.exe	94
PID 4516 wrote to memory of 3256	4516	msedgewebview2.exe	94
PID 4516 wrote to memory of 3256	4516	msedgewebview2.exe	94
PID 4516 wrote to memory of 5556	4516	msedgewebview2.exe	95
PID 4516 wrote to memory of 2352	4516	msedgewebview2.exe	96
PID 4516 wrote to memory of 2352	4516	msedgewebview2.exe	96
PID 4516 wrote to memory of 2352	4516	msedgewebview2.exe	96
PID 4516 wrote to memory of 436	4516	msedgewebview2.exe	97
PID 4516 wrote to memory of 436	4516	msedgewebview2.exe	97
PID 4516 wrote to memory of 436	4516	msedgewebview2.exe	97
PID 4516 wrote to memory of 436	4516	msedgewebview2.exe	97
PID 4516 wrote to memory of 436	4516	msedgewebview2.exe	97
PID 4516 wrote to memory of 5476	4516	msedgewebview2.exe	98
PID 4516 wrote to memory of 5476	4516	msedgewebview2.exe	98
PID 4516 wrote to memory of 5476	4516	msedgewebview2.exe	98
PID 4516 wrote to memory of 5476	4516	msedgewebview2.exe	98
PID 4516 wrote to memory of 5476	4516	msedgewebview2.exe	98
PID 1488 wrote to memory of 1596	1488	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe	99
PID 1488 wrote to memory of 6104	1488	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe	101
PID 1488 wrote to memory of 5344	1488	2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe	103
PID 3300 wrote to memory of 3544	3300	cmd.exe	110
PID 4516 wrote to memory of 1164	4516	msedgewebview2.exe	113
PID 4516 wrote to memory of 1164	4516	msedgewebview2.exe	113
PID 4516 wrote to memory of 1164	4516	msedgewebview2.exe	113
PID 4516 wrote to memory of 1028	4516	msedgewebview2.exe	114
PID 4516 wrote to memory of 1028	4516	msedgewebview2.exe	114
PID 4516 wrote to memory of 1028	4516	msedgewebview2.exe	114
PID 5072 wrote to memory of 2084	5072	cmd.exe	117
PID 4516 wrote to memory of 592	4516	msedgewebview2.exe	118
PID 4516 wrote to memory of 592	4516	msedgewebview2.exe	118
PID 4516 wrote to memory of 592	4516	msedgewebview2.exe	118
PID 4516 wrote to memory of 200	4516	msedgewebview2.exe	119
PID 4516 wrote to memory of 3208	4516	msedgewebview2.exe	120
PID 4516 wrote to memory of 3208	4516	msedgewebview2.exe	120
PID 4516 wrote to memory of 3208	4516	msedgewebview2.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4428
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1488.4908.160464765532859948 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.targame.app\EBWebView /prefetch:4 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x164,0x188,0x18c,0x140,0x194,0x7ffd8da05fd8,0x7ffd8da05fe4,0x7ffd8da05ff0
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2052 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3388 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3960 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec /prefetch:1
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4660 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4760 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4724 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4604 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.targame.app\EBWebView" --webview-exe-name=2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe --webview-exe-version=1.0.97 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4776 --field-trial-handle=1720,i,5174411065530423526,2879323585833277957,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:eca4d8b967ce5c146fb815bd322994784304a2ec
    3⤵
    PID:3208
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Delete /TN TarGameCrashCleanup /F
  2⤵
  PID:1596
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN TarGameCrashCleanup /SC MINUTE /MO 1 /RL HIGHEST /F /RU SYSTEM /TR C:\ProgramData\TarGame\watchdog\run-watchdog.cmd
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6104
- C:\Windows\system32\sc.exe
  "sc" query Netbird
  2⤵
  - Launches sc.exe
  PID:5344

C:\Users\Admin\AppData\Local\Temp\2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe" --crash-watchdog
1⤵
PID:3660

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c ""C:\ProgramData\TarGame\watchdog\run-watchdog.cmd""
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe" --crash-watchdog
  2⤵
  PID:3544

C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe /c ""C:\ProgramData\TarGame\watchdog\run-watchdog.cmd""
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_184914ada8a95e7a1af3eb1e6e13ff6b_akira_glassworm_rusty-stealer.exe" --crash-watchdog
  2⤵
  PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app-marker.json

Path C:\ProgramData\TarGame\watchdog\app-marker.json
Size 159B
SHA256 3ee2710535659b9b157be283218c365563cd87bb1f5b49c141fba32eb828ae17
MD5 4541016240e2cc1e7b786f419a227e96
SHA1 f66260da8fb5c894adb85f0b987320a5988e6363
SHA512 0ef812cc4f96e73ef0b581dd66809b7370101db8470fe950be09625288ab0cd7b96de6ec4b060af04aa2b4e79ab41b0e43a3d8e3155ee97d7b6ad2c9e1c680ae
TLSH
T1FAC08C40AA150E580AD73A464E04998F2820E0C9A2A70E00E2D84B0A04306860080981
MD5 SHA1 SHA512 TLSH

Submit Download

app-marker.json

Path C:\ProgramData\TarGame\watchdog\app-marker.json
Size 159B
SHA256 3b2c29f67ccfc5c524427e03601c44f3ff5ab954e5df3c97f168f262509b7d0e
MD5 43e0c7d7f7c265af8d6fb83351d4dd7c
SHA1 867a3d146d06a5551754ad964489e07efadcea25
SHA512 02bee2657ec3fa73b08ac3a3b476c8a04ba1fe959f719e4f2cdfa5fab942c2e5f34642e556cb5d930e290ae1aa3fe914c4991badf15c89510ecbc5cbfb541ed6
TLSH
T1FAC08C40EE154E580A973A464D009A8F2810E089E2B70E00E2D80B1A00306864140981
MD5 SHA1 SHA512 TLSH

Submit Download

app-marker.json

Path C:\ProgramData\TarGame\watchdog\app-marker.json
Size 159B
SHA256 a1afbdd8e03000c2e72d461ac32592724e5329c905881ca90e9746ace88053f9
MD5 ad56bfb3573a8a7ab97fb9c1ec2da42c
SHA1 dfd073cb11a464b59937c016b2e3ddb6fe11f17b
SHA512 3ef793eddbf246b2fef366dc18b3f380d7e895d50d26ad9c0a5346a26a57a9b81c6497cea75b28618739e99c998d5ee47455b526ee3e6e6f3bf51e8ed35ed4e8
TLSH
T176C08C50AA154E580A973A464D04998F2810E089E2E70E01E2D84B0A00306860040982
MD5 SHA1 SHA512 TLSH

Submit Download

run-watchdog.cmd

Path C:\ProgramData\TarGame\watchdog\run-watchdog.cmd
Size 143B
SHA256 3d736788beae587904491748876bfbb3b610897c8f48fc1bf5369c03c153ed2b
MD5 94f8279fa25b45795e1c484b4d2c06b6
SHA1 fb5f6c9f5a55fd130a9502e080a22f4ee4834a6d
SHA512 2bb66eae43cc0f6dd19a269f470d9d9ec6f710e1c3baca30f9297d65089bede3f7a977af538419b848b062e61a461254ad2b56c11124b1c3f00bbf293b7c9ce5
TLSH
T111C02B00615ED7400217E31B898540CF3C72A08D770B9B005B61C36E61B49CE56D2741
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6ee92af34b548c05554037887fff6949df0fbdb75bdc185f7e4432a2bff46686
MD5 2e5fe7fa276a33d2f371dcb4c60b809b
SHA1 b0699d8180ca514c400f761c77e00e2b8538ea57
SHA512 935a2871e84ba014c5ccbb678935fa7787d390693de781efac51bed074448d8a043f86c2786c1406f513297567d2f58230d881c0f721f77c94243629edcd0a5e
TLSH
T11BD01222B3024638C01021330402698D0401C21B400681215428851D3A444540D0A442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 26cc1e92394687642b5abb45e4fc0adc78fbbb0917a328858d4075599ac35e6e
MD5 22bf70336ccc8dc37c00f0eb4fd7a706
SHA1 5fba78b631d3bf80c88fb50e6cf292c0e2056cd6
SHA512 05902f2de2b23f9c4f10e7631d3d3fff82427d20247df65b0eaeea51630c9821808d27005bba2793dab61cc48bfd142b9598e7cdef080586244faf038bcbc47b
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 ded16a3ead1a3983ceccdd7ada4f147bdbf7f59fca37c593f8f5faf6a4045063
MD5 cac2f7f3bc4b842ab8680c533b00303b
SHA1 b2c3257c5311c376e16484086161a9c3330b1f99
SHA512 ee394fca3504c3e139e41c6ca14bd5c14e531d3f6ec557d5428adf0a799c92aef662b3d815bbc83a857a7fa0a06aa9f4b81cda3a5ff07b842c14f231fc443416
TLSH
T173B0228E080B0223E300033030E30088B3303C0AC30BC088A08CB8FEFAB0B20CA002C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594126.TMP

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe594126.TMP
Size 48B
SHA256 5336f571b4c13a59599e8de227f633b2be96ffbd03d08af06004c08a76915f1a
MD5 7914ebf2cf825eea88b897ed9df95016
SHA1 d4730b6daa7468c9b18ff0ac7fac80041a9a613a
SHA512 ad21ee2ee4642a5616efabb3bea92d12793f500d7dd6c0fcd0e91781c4fc0f9c8d35b6918899c2a6f51eb789a9488b4cd937cad6be97723994ea1a852a94b77f
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a12ce.TMP

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Default\Network\Network Persistent State~RFe5a12ce.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Default\Preferences
Size 6KB
SHA256 090041634e37bac3005c13ae532429da3214ebd70913571faf0c7069ff0d3425
MD5 0b24c04264c7bf8d0f30ab4ded0eff3f
SHA1 4f9831985a3dc1d3eb8eef018bdbc96b8e120a53
SHA512 9c52162d99179069e26f04ba92d3582b2020ce57160ac1dd95f3837eac10a4975d5162812745ae87f41e451b1390aa3056c8bb97d01895e2c315f37349e7f926
SSDEEP 96:stM/dyaXkG/xb9Ak0o5h16Z0ds7/x+6MhmuecJiA8Mkkje6K+gDW8+28XM1C7K:stALvUXondsV+FdiA8wjyl+G6K
TLSH
T1DCD194025E68797B4CC6E518BE39BA47E2F6A07261D51E58E7F8562C04DB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

dcc229e0-4d0f-422c-afb7-6858ca382e01.tmp

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Default\dcc229e0-4d0f-422c-afb7-6858ca382e01.tmp
Size 6KB
SHA256 5f63a9a9d3dbdd3f081da938c46b89e0f23c4c9b8df40d479196174e0508a3a7
MD5 e6fcf375536e923159974f9086d0e30b
SHA1 31ae71fbe10c2123a47986ecdaead17e50798902
SHA512 c522329859be8ed18987349bd266f4d08e33f9e75bf8ce0ae1c1bb9a5abdcec7a287676d3505bbb6a308c9ef89dbb9d4fdcd68b97e61282c8f280c04d9f6b6f5
SSDEEP 96:stM/dyaXN/xb9Ak0o5h16Z0ds7/x+6MhmuecJiA8Mkkje6K+gDAJ+28XM1C7K:stALdUXondsV+FdiA8wjyu+G6K
TLSH
T1E4D185019E68B97B4CC6F509FE39BA46E2F6607271D51E58E7F8962C04DB6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Local State
Size 15KB
SHA256 7b417088a6c8f87fd25e799a3f692c7a4576ab8c50dfe158db8648477f86537c
MD5 0de083f42a87189d5e22b4bb825feda1
SHA1 269a3146fbc7f2b34f7c6f3d70f379296ec3cc2d
SHA512 8616560b9442645ac88d248a5ed75a09d8b5a9db16ec0226cf8d72498897c60f04031d1f90672104600226a0b89edaba82b510ccee93b920fe95f8fb54422789
SSDEEP 384:J+aQikB+z/xvxjg/qhEkNBS2FGAk6UAUJd6+dn9zX:0/UxvxjgC+q4PH68FX
TLSH
T1E6729D2B95B97E3795F7E5047D090B8BDBB994B291826D7809ED6F0D06933981302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Local State
Size 2KB
SHA256 9877f1fb54665a895e32092223dddf7f0ed9090530981f784c1b11dd05ef8606
MD5 97208de408519aa68cad9d570d6a007c
SHA1 efb9345d283e8168dd4a0faec6ae4039ae9dc7d2
SHA512 51b1b070fae95d233c85e0caf23c16ec1cbb48a0dd85944e04370b9a2ba597052233810c2618636608a687d4c7563c423e21d690abdcf9bdaea68503b1ba3b27
TLSH
T11151A733A8A49E3789F34A04BD0A3F13DFB661669A662F25A6DD0B1C01D735C1312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Local State
Size 3KB
SHA256 d7842d36fdd745e1765af1d6a9c32a303c56995e94183a8209820de00ea0f220
MD5 59e2784eb910f4108b014b752982635b
SHA1 f67f914c1b8febb959ab356f84db25e6bc8754b8
SHA512 502a21f93896be6b9b6d962f76472bbebdc2b9b285014126d7f57e2ca833ccd0eb9b712e31894d760824e1ed6056f2cc29433aa30da9201ae74810f3f0e98b3f
TLSH
T1EE61A537A9B4993B4DF38A04BD462B06B7A65023E9953F69D6EC0F1C01D339C1352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58ebd2.TMP

Path C:\Users\Admin\AppData\Local\com.targame.app\EBWebView\Local State~RFe58ebd2.TMP
Size 1KB
SHA256 983e36caefe03273d315fc813ac0ff562e1d5029f96c60bf3457e0d2a0d5fd08
MD5 f2380ffd993ce9cd771b1d82d0f97f5a
SHA1 e89dc1b3cf664ba462efd470bc8c6a344bd3033e
SHA512 dc96c386da7f342a2a279b47ceb4ae0cd680ffddd90b1be670626240c6bcdd75b2cb592eafcaaae9ec2012817e7096da3810a395860eb0d97a6185908aee1c4e
TLSH
T1542165B3D0E54E33ACD256057E077A176E72106782554F0832DE4B1D02E229C563BC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/200-374-0x0000021567680000-0x0000021567681000-memory.dmp

Download

memory/200-363-0x0000021567680000-0x0000021567681000-memory.dmp

Download

memory/200-365-0x0000021567680000-0x0000021567681000-memory.dmp

Download

memory/200-372-0x0000021567680000-0x0000021567681000-memory.dmp

Download

memory/200-373-0x0000021567680000-0x0000021567681000-memory.dmp

Download

memory/200-371-0x0000021567680000-0x0000021567681000-memory.dmp

Download

memory/200-370-0x0000021567680000-0x0000021567681000-memory.dmp

Download

memory/200-369-0x0000021567680000-0x0000021567681000-memory.dmp

Download

memory/436-96-0x00007FFDAE330000-0x00007FFDAE331000-memory.dmp

Download

memory/1164-246-0x00007FFDAEA10000-0x00007FFDAEA11000-memory.dmp

Download

memory/1164-245-0x00007FFDB0140000-0x00007FFDB0141000-memory.dmp

Download

memory/3256-24-0x00007FFDAE330000-0x00007FFDAE331000-memory.dmp

Download