a163861db238dbddc9d699ea14eee7c5ee735c52a4868f618b5c00b2e46c13f2

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 12.2MB
Sample260910-m3p8esgf35
SHA256 a163861db238dbddc9d699ea14eee7c5ee735c52a4868f618b5c00b2e46c13f2
MD5 c2c88b037b82c8fdf4d2f25dd2e6fe52
SHA1 743e9b0c672dbf7e781e68ad39bace2c7316ef09
SHA512 24c3ed960211c496ff162486ea24946b40fbccf89e97196767fa46d12a6d5d58c9c23a422d15a032f1017af35c86b72da28f40fc735a8f7bf697ca37415fd5e2
SSDEEP 98304:CnbscPUO4N2SXtCIL6F+m+MEt9jZ7AVk8rA9L++yVE+YYKBihnz8NJtqcMxR9:Yw6F+3MEjZx91Yhnp
TLSH
T1A4D6F8117A5F99ACD19BC8B083478A674E2174DB0A36B8AF41C452393F7DBF06F28719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_2041811768\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_2041811768\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_2041811768\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4716_1615163348\adblock_snippet.js	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4084	2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
4084	2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
2732	msedgewebview2.exe
2732	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4716	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4084	2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4716	4084	2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	89
PID 4716 wrote to memory of 5096	4716	msedgewebview2.exe	90
PID 4716 wrote to memory of 4924	4716	msedgewebview2.exe	91
PID 4716 wrote to memory of 4924	4716	msedgewebview2.exe	91
PID 4716 wrote to memory of 4924	4716	msedgewebview2.exe	91
PID 4716 wrote to memory of 4924	4716	msedgewebview2.exe	91
PID 4716 wrote to memory of 4324	4716	msedgewebview2.exe	92
PID 4716 wrote to memory of 4936	4716	msedgewebview2.exe	93
PID 4716 wrote to memory of 4936	4716	msedgewebview2.exe	93
PID 4716 wrote to memory of 4936	4716	msedgewebview2.exe	93
PID 4716 wrote to memory of 5196	4716	msedgewebview2.exe	94
PID 4716 wrote to memory of 5196	4716	msedgewebview2.exe	94
PID 4716 wrote to memory of 5196	4716	msedgewebview2.exe	94
PID 4716 wrote to memory of 5196	4716	msedgewebview2.exe	94
PID 4716 wrote to memory of 5196	4716	msedgewebview2.exe	94
PID 4716 wrote to memory of 3196	4716	msedgewebview2.exe	99
PID 4716 wrote to memory of 3196	4716	msedgewebview2.exe	99
PID 4716 wrote to memory of 3196	4716	msedgewebview2.exe	99
PID 4716 wrote to memory of 2732	4716	msedgewebview2.exe	100
PID 4716 wrote to memory of 3632	4716	msedgewebview2.exe	101
PID 4716 wrote to memory of 3632	4716	msedgewebview2.exe	101
PID 4716 wrote to memory of 3632	4716	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4084.4560.5454380869160688954 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView /prefetch:4 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x12c,0x194,0x7ffdcdb25fd8,0x7ffdcdb25fe4,0x7ffdcdb25ff0
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,8261018119068842440,16851486375230276120,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1936 --field-trial-handle=1740,i,8261018119068842440,16851486375230276120,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1740,i,8261018119068842440,16851486375230276120,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3356 --field-trial-handle=1740,i,8261018119068842440,16851486375230276120,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2372 --field-trial-handle=1740,i,8261018119068842440,16851486375230276120,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=832 --field-trial-handle=1740,i,8261018119068842440,16851486375230276120,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView" --webview-exe-name=2026-09-10_c2c88b037b82c8fdf4d2f25dd2e6fe52_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=1740,i,8261018119068842440,16851486375230276120,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:af26a85ae96c0672211a6949b0abce78831359c5
    3⤵
    PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eb5545800553c246a6408b8f36e0aa9f3dd93246d8b5008fbf92c91ad0e08c85
MD5 7362d84d0d68dbc895151203bc4d7117
SHA1 14ba657521556efad91b6a01edfe565129c72ba8
SHA512 1aa5681d14d317c4b31562861499777a4eb0453ba3363500852b50f26f1b48f52d063dbd0c0fa5a55cbd933b2350d136ffbd091a69cfd7e9b313cca359faaccc
TLSH
T151D0121333614534C01020B30603B10D0940C32F404641455439991D1A084500D1B451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 107871eba013de7a1a74fc624dd6daf5fc6fae0838f1fa2d2f8840de16fdce1d
MD5 718c174e1c374b00777c0536d3b78e3c
SHA1 e5ce4331d73e573199df80241b17d20f11581bfe
SHA512 c17cf211ebc7dfbaf56961788d614ec19195a432f39263e22fabf689deefda7efb25a7982c809fa8a70dbc02ab1907b937ef4836b6898576ad173d6a6d049164
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Cache\Cache_Data\f_00000c
Size 36KB
SHA256 7ab4b609ef0c86632d628bd737945e1a90dfdb07276bf2fd56577c4f007a7aea
MD5 2dad665125d6444b32dbbdfb9ed9680d
SHA1 f5bacacbb8987997d704713c4da1b5baaaa90391
SHA512 fb029d343268f4bd418f2766ae934c691e1c12c745a6f325f37c8ff6f24d72ba89bce0f6fdc1d9fdc70419a3fa9ddb388d470abd5b6a5be65b7f5e6a64dd9b52
SSDEEP 768:GKdfkcgiY50f+BCZMcWNltg5YShex/zwoqrJ0OiWN:GKSiG0kfcQYXhex/Q95rN
TLSH
T1BE03F1D0206BB47B528FD966215683C86DC58C3A213878CA3F7BF8AE917A10D7F14265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 c5c0827830f8d15ad2412b205e3876e907fb0a163ca963d49f488a81f269b7c2
MD5 3292c3beb4ee2faf4b0ab6c4dd7d7a01
SHA1 dddc27434e57152cf6b4b256e7b26177e33e3545
SHA512 1527c43b45d57b9276f2f74aa7e48c494df1f9ef2fc01259b5dff840985717ef8bcfba1e23fedb8cc6778eab72f973a6495f844ea15903e280fd40f695c76317
TLSH
T13801A9C69C92E4F1CF9AE8BC1DD6E5627A316CA43713D9103358C4F5CA3B31B4496840
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59eb60.TMP

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59eb60.TMP
Size 48B
SHA256 e1231bc71e549b4b165f470869681d00e8a109cac90087cfe2630943d9e79598
MD5 3d239d5863d2c75702c684f9ffe9bb57
SHA1 1500b6a12a400d531ce42bef5b75d957ca20e01f
SHA512 75966931a2ed74e633e34dee0e45572a5603710ca320b66b1748ecf2c87ee10f241885663e1b9090777ec2ed8fc252c781001a72289d9c9bcdbbfb4017e38566
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 3e305608b1d7716d74e58b8bbb6e663486b46e08926ee6bdcd22445d822707c9
MD5 057df6663f2930111d375bf00ea9358a
SHA1 de3c81511b2529eb5feaf77d76fda39fc7461668
SHA512 2f618ac2c9b28ed10731fb1cfcfe45f2e493c11a2175e5808ad05567cf8dd0be70d3029d399561458c74916babdcb3de27e54fdcc20e21743671d319d5b848d1
TLSH
T16A316CE3C2E4962D8DA222F53F243827CA690C6557243D2AC9E9FB8B53D1470E315A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a86b6.TMP

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a86b6.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 f2ba3db5d507ee2aa43ccb22ccc85ce7e36664c66314d0cc52b7d33d76e67f54
MD5 0723955b754df83f677c6a14ef4a32b5
SHA1 8a7fe3b3d2681d5da9792743c2553c2e8e13062c
SHA512 671aec1603d80e657e187b13445ed5792177cc583bef70be9a884cb9896d7877773e80021a29af2ab681a3f682f42161e383fec3338fbc83365d272ac082b9e6
TLSH
T15DE0D892806E9A7F10B545661A497E456E36B5340141E4E8D79343AD70650A68613412
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59c411.TMP

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Network\TransportSecurity~RFe59c411.TMP
Size 355B
SHA256 33fade570e4cb3ea3eacb1561108029e9413a69a2bd2f119d1d092216dd61425
MD5 7f7bbb08345baabe1c6a3e5778d81287
SHA1 2e83afb96554c0d0e5125641bf39607a92a9b1c8
SHA512 efcaf6e46d22b5bc4197b009c85aa5625e7c74d6b589d74feef979180f8f4f0a4bae516cef4ca970d806b13557375936de5ec39bba1791674fecdeb783296ba3
TLSH
T149E02092807F99BF10B545671F497D495B37F5340141F4E8D7D2436E71550A78713412
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 975a6ccfd54551b3e016f0d3bd1f4eca079cafedb0f36fbd6f89ad0d8644fe89
MD5 0f086255d065cc656a9e350350aa43da
SHA1 50cad555b607ed266d6cb9106aee5954716c7898
SHA512 1be33d2602ecfb93b07d5621a5dfcc748c245ea5edd0e7e4a64d6366fdd14c4315e119a6507815dfe15b3aaee1c43576d94ee3e897ac9bf41c9abe78ed151e29
SSDEEP 96:ste/dXxLFThb95k+Co5h16ZrVs7/x+6MhmuecjsN1ejeIK+gK28XM1C7K:stm/HuoQVsV+FPsNQjIUG6K
TLSH
T118D195029E24797B4CC7E119FA29BA13E2F5903265D52E58EBF9452C08EB6DD7307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 a525147322ab5146e0011a097ff464f5845e3d0ccbdab487c99775bd4ca0b643
MD5 98c4581b31ed4f7a6b92ae46b70058da
SHA1 2c910c66cb06b1bd427e833342689f6acb277acc
SHA512 4a4fdb522483f4801c4027f0b9af75ebe8c49c79d18c20aabba50c899e67436574d32415ada452afae4a26a936425b6310367506732a1d9d2e0c5c7f4007590b
SSDEEP 96:ste/dXxLFSGhb95k+Co5h16ZrVs7/x+6MhmuecjsN1ejeIK+gg28XM1C7K:stm/RuoQVsV+FPsNQjIqG6K
TLSH
T167D1A4025A247D7B4CC7E119FA29BA13E2F5A07265952E58EBFD452C08EB6DC6303C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c317.TMP

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\Preferences~RFe59c317.TMP
Size 6KB
SHA256 260def1dc651e77d7f913ab890f7c322e924f5c7b2498d8494c9e3034e6517e7
MD5 a8d0ffb3719060bf76f05daf1919f79b
SHA1 dd704509224f4eaddf6d3c76da2db09177b4eba5
SHA512 68240c363b91787bd875b788953087ee4b4566ac50e0e43a513645ff71d1459b37166513357e9ac548ba31ff55864310ae7eb7adc934ddb39d51d9692cfd9fa0
SSDEEP 96:ste/dXxLFThb95k0o5h16Zrss7/x+6MhmuecjsN1ejeIK+gK28XM1C7K:stm/HnoQssV+FPsNQjIUG6K
TLSH
T18ED194029E24797B4CC7E109FA29BA12E2F5A03265D52D58EBF9452C08EA5DC7307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Local State
Size 2KB
SHA256 797f6d7903481dc7e23d089af48da04c72a4476c326627e476dbdabbdd356e59
MD5 af605b52e7bac977d2a910d9590f191f
SHA1 887f4362455f2902e90fc06859ead4ba46077332
SHA512 3d6a89c3e2c73f9fa2cc0e8a94e2cd37a5ad47de705c2b7c26f1acbb561d308bafd5ade3a9cbe5c5a0ab0c90c43f40f612938058e3a431c5411cded9ae63c0a8
TLSH
T1E2517573F924AB775EE38A09790A3F139B759062AE513F14AADE4B0911EB14C2301C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Local State
Size 3KB
SHA256 bd458e370eb6ef5d5a5c626ed32ada0642cc7a828699cde47af854633b25fb3c
MD5 ab662fda5806d60354ba12bab9917977
SHA1 cc3e8d564ba6b5619a0b671ac86eee468f950f98
SHA512 f2ba616fd61833e3bac8aada439860e39646e95ada30b03beb207d5784cfbc997d5196a09ff703b3e8a2916644daa5a25f7957c345969fb51dbaca0bf9d16ebd
TLSH
T10F617777E974AA374EE39A05B9463B17B7A59033E9813F58DAED0F0D11EB2881341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Local State
Size 15KB
SHA256 7f58604603f5902b0fd9aa0f06ead9ddc1c9377c2737c29cc3718e171c8211d4
MD5 52cb5a3fa625162b8f89fd64fcf90c26
SHA1 dc9b679f3db0fdac123f4a00bb142c49cdf35d6b
SHA512 d5ae46d5c7934ce847228a6c5106270ebcc2c9af366e3a831d3b662c4085ffd933110bfdeccd0a52fb54b00360fcf5b06b70e4664a8fba9c0766d0461140c87b
SSDEEP 384:5+aQikB+z/xvxjg/qhEwNBSgqTe6k69zX:k/UxvxjgC+bK4FX
TLSH
T16D729E2BD5797F27A5F3E6047A0D1B4BDBB894B294813E784EEE5F0E06972981302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597258.TMP

Path C:\Users\Admin\AppData\Local\pub.rockstar.launcher\EBWebView\Local State~RFe597258.TMP
Size 1KB
SHA256 823635b9cc07ba554864c1d331cfa10f4e4309b3331b51d4947ad3e5637c27e7
MD5 517c1098c06aa354c3c8f7e269dd0ea5
SHA1 60cfdd55e9d2d17490ea57c2704bddd2a3408bb6
SHA512 10d0773ff27b123d36c97ff61971c29643f40dbce6d443957078f5b8d4bbd2b98e0efd13f4cd236a0c5c3e0ed5e8dcd35d73dec070dc6c79275013a4a0d40e79
TLSH
T1492195F2E9B85B326DC25B4A31067E1B6E20903391005E0879DECF1A26FB04D9515C32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2732-420-0x0000023DBE180000-0x0000023DBE181000-memory.dmp

Download

memory/2732-427-0x0000023DBE180000-0x0000023DBE181000-memory.dmp

Download

memory/2732-428-0x0000023DBE180000-0x0000023DBE181000-memory.dmp

Download

memory/2732-429-0x0000023DBE180000-0x0000023DBE181000-memory.dmp

Download

memory/2732-430-0x0000023DBE180000-0x0000023DBE181000-memory.dmp

Download

memory/2732-431-0x0000023DBE180000-0x0000023DBE181000-memory.dmp

Download

memory/2732-426-0x0000023DBE180000-0x0000023DBE181000-memory.dmp

Download

memory/2732-422-0x0000023DBE180000-0x0000023DBE181000-memory.dmp

Download

memory/3196-357-0x00007FFDEFA20000-0x00007FFDEFA21000-memory.dmp

Download

memory/3196-356-0x00007FFDEEFD0000-0x00007FFDEEFD1000-memory.dmp

Download

memory/4924-275-0x000001D58ABD0000-0x000001D58ABD3000-memory.dmp

Download

memory/4924-236-0x000001D587180000-0x000001D587253000-memory.dmp

Download

memory/4924-271-0x000001D58A090000-0x000001D58A092000-memory.dmp

Download

memory/4924-270-0x000001D58A080000-0x000001D58A081000-memory.dmp

Download

memory/4924-273-0x000001D58ABC0000-0x000001D58ABC2000-memory.dmp

Download

memory/4924-276-0x000001D58A080000-0x000001D58A086000-memory.dmp

Download

memory/4924-21-0x00007FFDF0210000-0x00007FFDF0211000-memory.dmp

Download

memory/5196-54-0x00007FFDF0210000-0x00007FFDF0211000-memory.dmp

Download