Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 02:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe
- Size 7.1MB
- Sample260809-clk72agd34
- SHA256 e6e9f7b234c0c9e0fd4dce723bfd6f0d7284faec65f8eab62ab958675b7fb53b
- MD5 7098d02e92bc0e142028dead3e474928
- SHA1 5221889192ebd8bda84e574a7f851c95a3ce8e57
- SHA512 9bbc2ce9dfed2fa84c39c76ba58caf3320d47d906b51d1c51c785e14d53bd7b4b2e5a84dadbfe93edad1235c081daf6a55a256539e553f85f35aee7d805baa94
- SSDEEP 98304:73Btuoy/Pb+pwVzqv8aps2HQjsQwYn+1d7:7xILLsv8OMs3e
- TLSH T1C2764A027E8A98A9C89DC870C24ACBB30F1138EB1936F5BF15D565252FBE6B51F1D318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 18 raw.githubusercontent.com - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\symbols\DLL\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\symbols\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\dll\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\symbols\DLL\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\symbols\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\dll\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\dll\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\symbols\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\DLL\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\symbols\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\symbols\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\symbols\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\system32\symbols\dll\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\System32\symbols\dll\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\SYSTEM32\DLL\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\symbols\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\symbols\dll\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\symbols\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\symbols\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\dll\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\DLL\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\EBWebView\x64\symbols\DLL\kernel32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-hu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-sq.hyb msedgewebview2.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_221771544\_platform_specific\win_x64\widevinecdm.dll.sig msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-cu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-gl.hyb msedgewebview2.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\symbols\dll\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-lt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-lv.hyb msedgewebview2.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-ml.hyb msedgewebview2.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-cy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-et.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-pt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_307849722\metadata.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-hy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-uk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_221771544\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-de-1996.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-el.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-tk.hyb msedgewebview2.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\EmbeddedBrowserWebView.dll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_221771544\_platform_specific\win_x64\widevinecdm.dll msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_307849722\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_221771544\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-sl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\_metadata\verified_contents.json msedgewebview2.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\symbols\exe\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_221771544\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-as.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-da.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_307849722\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_221771544\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-und-ethi.hyb msedgewebview2.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\gta5rp_binder.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\symbols\dll\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\manifest.json msedgewebview2.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\dll\user32.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.1591_none_3e0fac18e32dc903\ntdll.pdb 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-en-us.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-nb.hyb msedgewebview2.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4272 msedgewebview2.exe 4272 msedgewebview2.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4272 msedgewebview2.exe 4272 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4296 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4296 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe 4296 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4296 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe 4296 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4296 wrote to memory of 4272 4296 2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe 90 PID 4272 wrote to memory of 404 4272 msedgewebview2.exe 91 PID 4272 wrote to memory of 6004 4272 msedgewebview2.exe 92 PID 4272 wrote to memory of 6004 4272 msedgewebview2.exe 92 PID 4272 wrote to memory of 6004 4272 msedgewebview2.exe 92 PID 4272 wrote to memory of 6004 4272 msedgewebview2.exe 92 PID 4272 wrote to memory of 5804 4272 msedgewebview2.exe 93 PID 4272 wrote to memory of 2908 4272 msedgewebview2.exe 94 PID 4272 wrote to memory of 2908 4272 msedgewebview2.exe 94 PID 4272 wrote to memory of 2908 4272 msedgewebview2.exe 94 PID 4272 wrote to memory of 3704 4272 msedgewebview2.exe 95 PID 4272 wrote to memory of 3704 4272 msedgewebview2.exe 95 PID 4272 wrote to memory of 3704 4272 msedgewebview2.exe 95 PID 4272 wrote to memory of 3704 4272 msedgewebview2.exe 95 PID 4272 wrote to memory of 3704 4272 msedgewebview2.exe 95 PID 4272 wrote to memory of 5980 4272 msedgewebview2.exe 96 PID 4272 wrote to memory of 5980 4272 msedgewebview2.exe 96 PID 4272 wrote to memory of 5980 4272 msedgewebview2.exe 96 PID 4272 wrote to memory of 5980 4272 msedgewebview2.exe 96 PID 4272 wrote to memory of 5980 4272 msedgewebview2.exe 96 PID 4272 wrote to memory of 4716 4272 msedgewebview2.exe 100 PID 4272 wrote to memory of 4716 4272 msedgewebview2.exe 100 PID 4272 wrote to memory of 4716 4272 msedgewebview2.exe 100 PID 4272 wrote to memory of 5072 4272 msedgewebview2.exe 101 PID 4272 wrote to memory of 5072 4272 msedgewebview2.exe 101 PID 4272 wrote to memory of 5072 4272 msedgewebview2.exe 101 PID 4272 wrote to memory of 6024 4272 msedgewebview2.exe 102 PID 4272 wrote to memory of 6024 4272 msedgewebview2.exe 102 PID 4272 wrote to memory of 6024 4272 msedgewebview2.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.5 --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-gpu --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4296.3188.14660524348436771229 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView /prefetch:4 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa05715fd8,0x7ffa05715fe4,0x7ffa05715ff03⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1740 --field-trial-handle=1744,i,15524129844726342498,10289348301005308495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce3⤵PID:6004
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1932 --field-trial-handle=1744,i,15524129844726342498,10289348301005308495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce3⤵PID:5804
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1744,i,15524129844726342498,10289348301005308495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce3⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3292 --field-trial-handle=1744,i,15524129844726342498,10289348301005308495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce /prefetch:13⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3804 --field-trial-handle=1744,i,15524129844726342498,10289348301005308495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce /prefetch:13⤵PID:5980
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4292 --field-trial-handle=1744,i,15524129844726342498,10289348301005308495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce3⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2004 --field-trial-handle=1744,i,15524129844726342498,10289348301005308495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce3⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_7098d02e92bc0e142028dead3e474928_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4924 --field-trial-handle=1744,i,15524129844726342498,10289348301005308495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce3⤵PID:6024
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 3d04623a3a4375380e679c6679f0a10b77ddf16f2931a1512ed4fe97845c088a
- MD5 2cbd298c4fa353a6c0ae45373662c2bb
- SHA1 e5cbe7f5894897248f5bd5b86b9ce5232355dcb7
- SHA512 fd85797837c8a4009b181613cc90d869f3ce863120c30c92f20634470246cd9cddd35a47f0de011bc85c6bd28311ed690cfa505b954a24813a59ccaed4c29589
- TLSH T107D01216F2020178C02021330112B1491540D51F41054108982DC52D1E444900E0B481
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 322be5e49b79e4ae72aa0da7d9f1380452fde9632bc1df76aa6e1301041bcec8
- MD5 abe17cbec2248e0ca9d6c57000d20d8c
- SHA1 bff66a0f714f11fd2645cd56474783becb827453
- SHA512 a004dfcc1245e99f6b2cb8f273216883f6e2faefea4f9ce094d22ac38280e968c900fdeb9e73f121274bac321d5a5478390fd8c43c7b9a0ac27a2a3bb312124f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 216B
- SHA256 7267664b3bf9856495a7e1e63e08392eaab5ffa81bfb50e053518fd806478ef9
- MD5 0a520a7e3b6a7f9c261d8df7cd0be3e7
- SHA1 7c5d6d74d14e532756ba8a9948875f14361b9b5c
- SHA512 ca179205233dce2fa0c62915cfcc68418f23a7c2fe5030153d5012a9cecbf44d6ae1155fa8bba31e7a1549aca37c6d663874b1d99c21b9c643e51be0575b71eb
- TLSH T1D3D0025B24E05A05F30783F638D99B813D737550065B1EC99B50DEBF8521FA861550D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 288B
- SHA256 a433c7fc7238c1732c31b04b53168c34465e99b02ec114bd1f4acadd606e18c3
- MD5 6f47d2988f09ee6726140da5fddfd36d
- SHA1 d71d35ab41fb7fdde500235e25231b193da8e009
- SHA512 9e0db8fc3ee5fbfac9f6a774c8d7e52d0824c30b8e03e62249b46c40b9eca464a122be585e89b49d4076cc282918d0e72b73bf68651f299cf7d11595f0f41d1d
- TLSH T1A8D0C99B5AD1164AF32383F678CE4B803D337591430BAEC557D08DBF5111FA852594C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e872.TMP
- Size 48B
- SHA256 84f423ef92128375a381462e0b07c9579d2c807b17a0e60337d725b18aeb23ce
- MD5 8ca07afb3abdec5cd60dea21dcf465a1
- SHA1 1b16d8b4b39f89dc8313f91dbb755333dd87f5ae
- SHA512 d31ed32e4708563aac8da2d08e786af2ad5d18eebd51033b3b3d4c983888988ebe00480382c3843ffe7c632eab2bdac762005e9c5b4f1d4e24bdec883b3a8c69
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Extension Rules\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Extension Scripts\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Network Persistent State
- Size 238B
- SHA256 249d54de53def179f330a53128e2b34253eecb6492c84d2cbdd1d31d594ee500
- MD5 e1938455eed7cf6012be545edade2e40
- SHA1 c2279530d0f4c2e3fdf043df653abf8da15c1de5
- SHA512 c98d029a33f3a4f5c3b8ba0ada7a268631acf6af44588a62596736f472851e18ce40457aae4359f20663a52a3b4194d4c0d4bc9358c7c1050b356f7c0bbca46b
- TLSH T174D097B642F068FE8B4083E409183D0BCFBE0006076C9DBDC1B0BB6787A2078D00884B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Network Persistent State~RFe5aac4f.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences
- Size 6KB
- SHA256 881c5b72b1c247c6183e0b0fd67a765d09a02931391caa22b381e3d7af9c8df6
- MD5 a3c0e13862e6ea70f3a8f48f54e3ce89
- SHA1 5bb43a4019401c3d4e9c216b561b8b0b81d2bb4d
- SHA512 96b8548ba21f0fa3f92290e62539cf2aa74f487912a2e4dab9a9f805a775928e10509366ab748b758d73c28c5660fe36700f94d7e0f46c740a5f014c13ea478e
- SSDEEP 96:stbb/do5Tzkb9Zk+Fo5h16ZPos7/x+6MhmuecpKwMkkje50K+gi28XM1C7K:stvicxo+osV+FNKwwjYnUG6K
- TLSH T15ED1C7126E2879BB4CCFE559BA257A17E2F56072B0D52E58EBFC452C04DB6CC230790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences
- Size 6KB
- SHA256 060fac3a73f2fb1204e726057fda90465de678c5de6bfb9f8510883a1ca49580
- MD5 21cfd4713250db429f871346d26e9f64
- SHA1 32a555271b6516f8876467664199d655da7dabc5
- SHA512 7894ecd8add8890fa0582da91b37ae89eaec3bca97dc35cf417f00109e0625565910797bfaf7ae683f779f6829ce653f97afdd6d632f8ff24ae306f5b02bd7c5
- SSDEEP 96:stbb/do5TyGkb9Zk+Fo5h16ZPos7/x+6MhmuecpKwMkkje50K+gK28XM1C7K:stviKxo+osV+FNKwwjYnIG6K
- TLSH T1D3D1C7125E2479BB4CCFE559BA297B17E2F56072A0D52E58EBFD452C08DB6CC230390B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences~RFe5a11a5.TMP
- Size 6KB
- SHA256 4105d0ec32f8e6ec82c4030ae05ad90062b8133b8069aa635410ac7a53d8ad88
- MD5 38a4fe8c0d582fe29759d2d68c7e25f1
- SHA1 99bc42f5ee9ee5acc60d1d14c12b1cc581d5408f
- SHA512 7c1e142e1cb9c90d91573d558dedb2f120323d6f75d5913aee46a885c9b933b0ad06b110751121ef553d61f5ad6cfad7d3608e80a702f05c8613972fb877bbc0
- SSDEEP 96:stbb/do5Tzkb9Zkzo5h16ZPos7/x+6MhmuecpKwMkkje50K+g2+28XM1C7K:stvicEo+osV+FNKwwjYnY+G6K
- TLSH T134D1A6025E2879BB4CCBE559BA257A17E2F56072B0D52E58EBF9452C04DB6CC230790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
- Size 3KB
- SHA256 9df049365c3856297ca59a2633308354386588e4c55ab5cef0196722ee295f5b
- MD5 191e57a4a10278e79d66dc65ee7b6853
- SHA1 dd175cc7f7af69265021c1e8b9bca3d00a3541aa
- SHA512 e8144bebe14d4daf6c6f4546f748ce638d9bb0ff2b43bbc0519cd5ecc89cdcb190e2e78b1b6b86858d7d0e30ba8b21e2b4957348426f9f553a586c65db5d0093
- TLSH T12D618437A974AA3B4AB7CA05B9862B23FA654063E8853FA9CADC0F0D41D729C1341D17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
- Size 15KB
- SHA256 1a82cdd4846746b6f9f78f7b9125e45048009b89736bb3510035c6729c1ee475
- MD5 a3a0d96df1146c566d6a0c0941ff1f26
- SHA1 be70ce000aeff794e864250e8e8218a9bd05165c
- SHA512 8c735c0ef52336b4dcd1ab5256133e7f0ca58f29256a7664c3311e60f695480982b2fe36c98d1a5a8c2980f1f39417c9b409ab786b78657823661e7d035f01fb
- SSDEEP 384:c+aQikB+z/xvxjg/qhENNBSt/LV8AVdp+9zz:7/UxvxjgC+cR8U+Fz
- TLSH T13D729E2B98387E7396F7E605794D4B87DAB884F3D4816EB84EBD5F0A06C72981302D12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
- Size 2KB
- SHA256 b207a03f526b58ede33813f9ccd4c122c91f6a50a75d2cb978154aa41d669d81
- MD5 2e3fae1e87325511b5edffcb458b004e
- SHA1 d486d31b646304b298e13dcfde64f58dc576f92f
- SHA512 d8120f0ea9a2658c8c5da3d1b334ed378f147ee6a17667449da35dd42233fb3e6017b90e4c3ee0dd413f6e90f82dc012093f6737d25e0e488072da623335423b
- TLSH T168519233A824AF7B86B78649794A6F33DE3940E3E9121F65CACD1B1842DB25C2301D37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State~RFe59931e.TMP
- Size 1KB
- SHA256 67492912c1fce440c95ccb99faa5ae8efe674d2601430906cc98f83116af6c55
- MD5 27f66283aed10f499352aa5f443c0276
- SHA1 e9d70b54e76fdabdd5faa1d03fd80c0d6ed61b6b
- SHA512 0a3807c5c2d00cd0a036d05125b2579527ea3bac7cc189221406bae4c4a87dc0e1cb9b7cf1fa44d821271b127b05e2877aec9a2b3f6c4a5a27ae32ba12af2625
- TLSH T1B82165B3D8746F339A96924A7506BF239D2400A7C1014F1896CE471943EB18C9626E33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\gta5rp-binder\config.json
- Size 3KB
- SHA256 8cbb8ebde5947c673f34604657c6b6960b35627a06a30b0ff6141b47cd883a17
- MD5 c3081f3a7e5e772c00d687cfcd5313ad
- SHA1 4d57ad6e620459c0dc35c9195fbe476000af3af6
- SHA512 6addf99495f6cbb16ff2a537d786d6a6d0d8c8e929e791adb3c415b418fac7daa75e19375cacb2c29dcf34e9a71b1e823a65eba52d8071f40d0db9053ae98a20
- TLSH T11C51D628D5790CB20296317A44AE53C77A78C6570E15BD2C3ACD0A8C4F5EB5E60BB3A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-bn.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-mr.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1140741757\hyph-nn.hyb
- Size 141KB
- SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
- MD5 f2d8fe158d5361fc1d4b794a7255835a
- SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
- SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
- TLSH T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH