56debff66f16f161ec7ec92604242d2f6218ff1657516d86638cd6cd7de0206e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 12.1MB
Sample260903-x1ph8avaph
SHA256 56debff66f16f161ec7ec92604242d2f6218ff1657516d86638cd6cd7de0206e
MD5 ee5bddc4c70bc201c03867ffe9fe96d2
SHA1 5208186c67326e4bbca1d36acb53e60fcd173f82
SHA512 7776ea9181212c3fb906736765904c7fce618dd2aecddc7315993d5be59d3a4697d9fa8b43e27b01a295061a223a11b5be3b483057c573c2019a26f965d4998c
SSDEEP 98304:o3t5XanQEV1R1EWen4EGXZbIRcR2onr3mpsi/RXwlq1myvaIRDAqZZG2sz46g46X:ggNXZ8RcLrKXwcAAscAs
TLSH
T119D6F911BA5F99ACD19AC8B083474B674E2134DB1A36B8BF41C452393F6DBF46F28319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_2146292611\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_955479838\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_955479838\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_955479838\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_332169530\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_332169530\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_2146292611\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_332169530\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_332169530\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_2146292611\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_2146292611\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_2146292611\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4848	2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4848	2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1800	msedgewebview2.exe
1800	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4560	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4848	2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4560	4848	2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 4560 wrote to memory of 244	4560	msedgewebview2.exe	90
PID 4560 wrote to memory of 2692	4560	msedgewebview2.exe	91
PID 4560 wrote to memory of 2692	4560	msedgewebview2.exe	91
PID 4560 wrote to memory of 2692	4560	msedgewebview2.exe	91
PID 4560 wrote to memory of 2692	4560	msedgewebview2.exe	91
PID 4560 wrote to memory of 5032	4560	msedgewebview2.exe	92
PID 4560 wrote to memory of 2648	4560	msedgewebview2.exe	93
PID 4560 wrote to memory of 2648	4560	msedgewebview2.exe	93
PID 4560 wrote to memory of 2648	4560	msedgewebview2.exe	93
PID 4560 wrote to memory of 3612	4560	msedgewebview2.exe	94
PID 4560 wrote to memory of 3612	4560	msedgewebview2.exe	94
PID 4560 wrote to memory of 3612	4560	msedgewebview2.exe	94
PID 4560 wrote to memory of 3612	4560	msedgewebview2.exe	94
PID 4560 wrote to memory of 3612	4560	msedgewebview2.exe	94
PID 4560 wrote to memory of 4744	4560	msedgewebview2.exe	99
PID 4560 wrote to memory of 4744	4560	msedgewebview2.exe	99
PID 4560 wrote to memory of 4744	4560	msedgewebview2.exe	99
PID 4560 wrote to memory of 3324	4560	msedgewebview2.exe	100
PID 4560 wrote to memory of 3324	4560	msedgewebview2.exe	100
PID 4560 wrote to memory of 3324	4560	msedgewebview2.exe	100
PID 4560 wrote to memory of 1800	4560	msedgewebview2.exe	101
PID 4560 wrote to memory of 4540	4560	msedgewebview2.exe	102
PID 4560 wrote to memory of 4540	4560	msedgewebview2.exe	102
PID 4560 wrote to memory of 4540	4560	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4848.3252.1038997492548691394 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView /prefetch:4 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x128,0x194,0x7ffcd6065fd8,0x7ffcd6065fe4,0x7ffcd6065ff0
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1384 --field-trial-handle=1760,i,10982471911063728193,9875831069419558796,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1760,i,10982471911063728193,9875831069419558796,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1760,i,10982471911063728193,9875831069419558796,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1760,i,10982471911063728193,9875831069419558796,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5 /prefetch:1
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4404 --field-trial-handle=1760,i,10982471911063728193,9875831069419558796,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4576 --field-trial-handle=1760,i,10982471911063728193,9875831069419558796,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4596 --field-trial-handle=1760,i,10982471911063728193,9875831069419558796,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-03_ee5bddc4c70bc201c03867ffe9fe96d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4624 --field-trial-handle=1760,i,10982471911063728193,9875831069419558796,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3d4c22832dd6f05afe15cf561a987074e88fd95504711e8fb717954268ce6afa
MD5 6e87e3c8c1e89f1fcc9384f6138e0cc2
SHA1 f88d6381ba7ebee5396e1125fd6764a89aac8e75
SHA512 659cec6b648f693fbaee721a784f0acf4f14780684c75340541bf660f60165a69d1216f427c7d10035362b60890222b65f271874577dc6109e2d09c7e825256b
TLSH
T165D01122BB220238C02022330202A20C2880CA0B808A8002E82C8A2E2B280A0AA0A882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 39d527814b59f8805aead91ba2f5f9abe0af5443e0589e790ed2417c9f612f1c
MD5 a525d15c3a9604bb19e0d49c7236d7a4
SHA1 0aa7218acd9e4296bf0c30f49c88fe4cabafa74c
SHA512 d18cf28199261594406d86c0b96b6a2f1af5c7a315d4fb7baaffc0dcc8b4e454c7ad42de1c322db7ca070ae3e92d3c10630afcb6968283bcf866cfe266f08b6f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

1a52cd37-840a-4011-a876-fdafa44a49e0.tmp

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\1a52cd37-840a-4011-a876-fdafa44a49e0.tmp
Size 5KB
SHA256 eff1d055730a0e81fb287f347e0224bd0b2f81991c4fb8285cc2763123af7817
MD5 34afbe16dc4b17d666605d07034f2c39
SHA1 a62db9e5d0690b931d7892398314f162d87a801f
SHA512 656fe0c7d634be32688d5e2188b9e52bd5592d9388c635574a9acce58ea26e912cc6a182a8deda7440c47a3089b5a18527cb8adc033b8cad01b232ea22136633
SSDEEP 96:ru/dXxghaZb94kAdo616ZrAs7/x+6MhmuecjmH81ejeaK+g328XM1C7K:r2/YZrotAsV+FPmH8QjWJG6K
TLSH
T195C1A8026A24797B4CC6E50CFA297B53E2F5A03265D51E58F7F95A2C14E66CC630BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Cache\Cache_Data\f_00000c
Size 36KB
SHA256 7ab4b609ef0c86632d628bd737945e1a90dfdb07276bf2fd56577c4f007a7aea
MD5 2dad665125d6444b32dbbdfb9ed9680d
SHA1 f5bacacbb8987997d704713c4da1b5baaaa90391
SHA512 fb029d343268f4bd418f2766ae934c691e1c12c745a6f325f37c8ff6f24d72ba89bce0f6fdc1d9fdc70419a3fa9ddb388d470abd5b6a5be65b7f5e6a64dd9b52
SSDEEP 768:GKdfkcgiY50f+BCZMcWNltg5YShex/zwoqrJ0OiWN:GKSiG0kfcQYXhex/Q95rN
TLSH
T1BE03F1D0206BB47B528FD966215683C86DC58C3A213878CA3F7BF8AE917A10D7F14265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 a76dc13e6ecfddc7f48e24ffba8bd52007fbd5c314083a596cf58a67a7efd9d6
MD5 ea0c5ebffb295819852eb0e169bb37a6
SHA1 82b47b4400609e9a4a67fa555dacdcfad128b58f
SHA512 14e33ddb77b5285f96f558998e9c8ba5ce507a578a2861ea0aaf4f0149886cf823b9916ad9207e822ef89814d35157f76c7e152fbab378c7b197a0d01537caf0
TLSH
T11FF02692A5C44502C704B9B91AF3A493F7B40A2A85537D7EC818E075483DFBE4A65EF2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a33b.TMP

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59a33b.TMP
Size 48B
SHA256 96254c64de04d22fe300f5e3958c46ed5add18208965d1ff1bedc394458124ab
MD5 507aa6d80d269a06bf66283e5e3521f9
SHA1 fc12daf72d3e9419a229b2293a98647c95b5debb
SHA512 0efa097115059ba5a8da4f24e3e6f23ff6d754a033bcaff8556c0f83bcdbb84ff8976bfe380f565626bdadb3016128a0a9767c51207a5cd8c81553a8bf3378ed
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 7fa0c080068a0c2fee06bd94e85e0578725c80efc76e236d3da5a75c3d4cf156
MD5 25d181dc25260bf51617693ae994f787
SHA1 4601bf5e6c5575fbe37c179777c796e9d754a443
SHA512 8ac179ea21cec7686d5252d30c8c9e0347b9052a72c728ba76d7020fdf5031513e86b25d66a9b6106dcc1e4d26fe5e37a7ee7d0622474102ea3d718a9ddc530f
TLSH
T18D319EE3C2E4961D8E6251F53E243827CB590C6552243D6AC8E5FB8B63D1474E214B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a5d06.TMP

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a5d06.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 cfbcb7a4caec63648439b8955918c65583e98fc68009d4066b259349445c643d
MD5 91e592d237a8fae6ff6c6f1d4ade66c4
SHA1 3415bfae8c6327919102d3603fe39c510d5e2cd2
SHA512 219963264155ac4b29ecf41175da2c11618247cd99141d785b666b323d3c039e31ea6c17556b3301137ab9580233e3099331f3500b31ae04f3ebaefec2b6715c
TLSH
T1B2E020F3C07FD52F6578496F19447D4419B7F5350542D4F8D952452CE0005771E03013
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59a138.TMP

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\TransportSecurity~RFe59a138.TMP
Size 355B
SHA256 83a1a2c017e9a72ee8bb127b98c17ebaca2aa1849bdb5c3839b4bc2b18d93407
MD5 7b0cb50e3c5944c452ec6ac341dd553a
SHA1 8d3ffb2c41be3bf8f659f8108ed0047ef67c3d12
SHA512 d30c0ccd3a3f7b67d3c29c8b7a4a718e1a755654783bab6f0ece3a2fa78c7bfdf3c5127d2984c7ceb71839de529e6ab06e982a328f32c814e945dd6d146b95aa
TLSH
T153E026F3C0BFE76FA178C9AB0944BE8819BFF5354441D4F8EA53862CA0005AB1A13023
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 4189464040f327225d3161ed29431d4262cd1aaf62b8b0a195c2d05fcb351a8b
MD5 c713f0cd7732e5ad0142b636abbfb72a
SHA1 5a8448b02ef6d8744a251b1519ba4a14540ec035
SHA512 10546f7b18e31da4d34587da157776898ebb7483f9cffb8c111e928bb96785047bd593b46422117d21bc84d43f7fb09448126a88259698187744ad7826bfedaa
SSDEEP 96:stu/dXxghaZb94keo5h16ZrAs7/x+6MhmuecjmH81ejeaK+gr28XM1C7K:st2/YZtoQAsV+FPmH8QjWtG6K
TLSH
T1D6D1B7126E28797B4CC7E508FA29BB53E2F5A03265D51E58E7FC462C04E66DC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 efcefc35b6101a0057c95302cd19ff42eddbcca8f8a3b0a035a77b5d819c8c79
MD5 6150f1739ab0b550fee7024b0a48c6ae
SHA1 846320418d45cad1e69bcf1f340192782a28e605
SHA512 3f06e9dac91bd751a3bae607846212c43d07339367de1fd829ca040db5c3b43c59df787a800b77cf60572a387af13d2f5004cd5b3a525d3700af5fc5dac2bc53
SSDEEP 96:stu/dXxghBGZb94keo5h16ZrAs7/x+6MhmuecjmH81ejeaK+gr28XM1C7K:st2/Y7toQAsV+FPmH8QjWtG6K
TLSH
T175D1B6126E24797B8CC7E508FA29BB53E2F5A03265D51E58E7FC5A2C04E66CC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Local State
Size 2KB
SHA256 2de9b57fd90f4e84ea64db8fcfc0a9e205ddfd5f4d8fcec6c5d530e492f3561e
MD5 deec1f1b5250a0c59e06754c7311bec4
SHA1 7c9bfbdae952fe8597253d09f7cdca0bb5b58ec1
SHA512 bd22a82119b45ccdba524a32d84d24a3d13b8bfe32e338041a2f86fa94920012411bef3cd47671e81bb5fa2aa8dc775ba3520691287de838a34d2c713264a994
TLSH
T1025195737C25BB3799E28B04B84B3F23AE7591629B561F519AED0B1C00D759C1349C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Local State
Size 3KB
SHA256 9ce5ec5f101e593c51981078c64306e8b9fcbd0bdbb43e1783ddb6c762462371
MD5 506fbfff354180dfbaa370806af34821
SHA1 0d5ef4f321bfc4dcae09fdd3f8a8f35cda0d15db
SHA512 b8eb058ca122494c4e919c2e49579efd1227ca1dd582791975cffb248b9000ea11a26de6a5ce34daa83fdf368396798136d9289963fe87e617e1843b9e02b057
TLSH
T17C61A7376971BA379DE2CA04B8863B16BBA55123E9853F55DAFC0F0C01D72881341C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Local State
Size 3KB
SHA256 cf855fba231bd53309c5b4c929d79faafe0ff30a045f772eaa2538267b66479a
MD5 7f7c81d4e2338b7fbd644941bdce829b
SHA1 a36d3bb9a2f740139689bddfe7260318fd37402f
SHA512 3d9ac3c7a41e80878c01665a1491cdfda68cf769fcd048faade046ecb1829216e42862447ba972d03483fd7ea463ad08ee6433494f94ebe135bd61ed66a278e5
TLSH
T1BD7164266975AA379EF2DA09B8863B13BBA45023D9852F95DAFC0F0C01D76881345C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Local State
Size 16KB
SHA256 db720a19e97f99bb391f507e20573b96461eca8441ffbb57db811372c4c79048
MD5 8c1e70ae1d35dd9e0a6a16805baac3f1
SHA1 642d3e4e735ef53e31af014eeeea07b9a837ad3e
SHA512 2b31670d7eeab7d11021956e92cb2ebbda86f0e8b3122a8b0fbb97ce1ea15d309814730480cd0a874bffd43ea431f7346cda8659ef592c05a046849272a0dfac
SSDEEP 384:p+aQikB+z/xvxjg/qhEwNBSXr2qMUtybSB8HAa9zY:U/UxvxjgC+T2BUwSBfaFY
TLSH
T122729E3AE869FE23A9F3E644790A6B9BDBF4946241C15AE44DFD5F0C02C76DD0306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59483a.TMP

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Local State~RFe59483a.TMP
Size 1KB
SHA256 e49d93d716f275c8ed70ebd7a9e190e0f5f01f210f3c3348e69d19352fe61e08
MD5 7a15c08f9292e3b486a018fec87e2330
SHA1 e0082f9229becb5832399fbb2d40818aec089c4d
SHA512 f3c98918d2fdc2e6168e7061fe7616dfc42f9ab48ca54af9fa4fb6500838414d4ac2c9c39bb9052dc66a00beee663f8a9ba68871858854215e5d055a1b7826c4
TLSH
T1142140B2E876BF32BDC1534671477B576E60116787024B01AAED8B1D11E70CC926DC3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1800-364-0x00000257CEF70000-0x00000257CEF71000-memory.dmp

Download

memory/1800-363-0x00000257CEF70000-0x00000257CEF71000-memory.dmp

Download

memory/1800-361-0x00000257CEF70000-0x00000257CEF71000-memory.dmp

Download

memory/1800-353-0x00000257CEF70000-0x00000257CEF71000-memory.dmp

Download

memory/1800-360-0x00000257CEF70000-0x00000257CEF71000-memory.dmp

Download

memory/1800-359-0x00000257CEF70000-0x00000257CEF71000-memory.dmp

Download

memory/1800-362-0x00000257CEF70000-0x00000257CEF71000-memory.dmp

Download

memory/1800-355-0x00000257CEF70000-0x00000257CEF71000-memory.dmp

Download

memory/2692-26-0x00007FFCF69A0000-0x00007FFCF69A1000-memory.dmp

Download

memory/2692-228-0x000001BB64DF0000-0x000001BB64DF6000-memory.dmp

Download

memory/2692-227-0x000001BB667F0000-0x000001BB667F3000-memory.dmp

Download

memory/2692-225-0x000001BB65550000-0x000001BB65552000-memory.dmp

Download

memory/2692-223-0x000001BB65540000-0x000001BB65542000-memory.dmp

Download

memory/2692-222-0x000001BB64DF0000-0x000001BB64DF1000-memory.dmp

Download

memory/3612-97-0x00007FFCF69A0000-0x00007FFCF69A1000-memory.dmp

Download

memory/4744-309-0x00007FFCF5FA0000-0x00007FFCF5FA1000-memory.dmp

Download

memory/4744-310-0x00007FFCF6C70000-0x00007FFCF6C71000-memory.dmp

Download