f41933922dca39e822180d417b2d55ae549670a47cfc20d2e5d32412cfd4dcc4

Analysis

user interaction
yes
max time kernel
119s
max time network
124s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/04/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpenCode.exe
Size 24.5MB
Sample260416-vb2q5saw2s
SHA256 f41933922dca39e822180d417b2d55ae549670a47cfc20d2e5d32412cfd4dcc4
MD5 5aadb61a90706294ed031031591fc5e0
SHA1 1bc316701d43648ef3f2e5bd66967fe952111d62
SHA512 21129a17081011593bd7aba74a6bdd2d2fea739c5fddc3c61bfab56cb19cda199d2ecc048f019079bf57080fdac8350675b2ddd2f17d786161dedb42ebca97c8
SSDEEP 196608:jNMdADGKNSoTqnDkzMtW34mjBPzEDoQpONOWopELXcb+U+5C7TH0:BMdADGKNR+kwtklpQaopELMb+W30
TLSH
T1924728217B5A996CD05BC474834B8A724A7170EB0B35B9FF448496382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_867026971\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_867026971\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_867026971\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_245739839\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_867026971\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_867026971\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_245739839\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1220_245739839\manifest.fingerprint	msedgewebview2.exe

Loads dropped DLL 2 IoCs

pid	Process
4932	opencode-cli.exe
4932	opencode-cli.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OpenCode.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208320796724094"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000f749d21a9791dc0133d26270a591dc0133d26270a591dc0114000000	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenCode.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenCode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "4"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenCode.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	OpenCode.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	OpenCode.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenCode.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5764	OpenCode.exe
5764	OpenCode.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5764	OpenCode.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1220	msedgewebview2.exe
1220	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5764	OpenCode.exe
5764	OpenCode.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5764	OpenCode.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 4932	5764	OpenCode.exe	82
PID 5764 wrote to memory of 1220	5764	OpenCode.exe	84
PID 1220 wrote to memory of 1192	1220	msedgewebview2.exe	85
PID 1220 wrote to memory of 2772	1220	msedgewebview2.exe	86
PID 1220 wrote to memory of 2772	1220	msedgewebview2.exe	86
PID 1220 wrote to memory of 2772	1220	msedgewebview2.exe	86
PID 1220 wrote to memory of 4132	1220	msedgewebview2.exe	87
PID 1220 wrote to memory of 1968	1220	msedgewebview2.exe	88
PID 1220 wrote to memory of 1968	1220	msedgewebview2.exe	88
PID 1220 wrote to memory of 3284	1220	msedgewebview2.exe	89
PID 1220 wrote to memory of 3284	1220	msedgewebview2.exe	89
PID 1220 wrote to memory of 3284	1220	msedgewebview2.exe	89
PID 1220 wrote to memory of 5388	1220	msedgewebview2.exe	90
PID 1220 wrote to memory of 5388	1220	msedgewebview2.exe	90
PID 1220 wrote to memory of 5388	1220	msedgewebview2.exe	90
PID 5764 wrote to memory of 2288	5764	OpenCode.exe	97
PID 5764 wrote to memory of 4432	5764	OpenCode.exe	99
PID 5764 wrote to memory of 3868	5764	OpenCode.exe	101
PID 5764 wrote to memory of 1424	5764	OpenCode.exe	103
PID 5764 wrote to memory of 5396	5764	OpenCode.exe	105
PID 5764 wrote to memory of 5100	5764	OpenCode.exe	107
PID 5764 wrote to memory of 6060	5764	OpenCode.exe	109
PID 5764 wrote to memory of 4696	5764	OpenCode.exe	111
PID 5764 wrote to memory of 3980	5764	OpenCode.exe	113
PID 5764 wrote to memory of 5224	5764	OpenCode.exe	115
PID 5764 wrote to memory of 2660	5764	OpenCode.exe	117
PID 5764 wrote to memory of 3456	5764	OpenCode.exe	119
PID 5764 wrote to memory of 3096	5764	OpenCode.exe	121
PID 5764 wrote to memory of 1400	5764	OpenCode.exe	123
PID 5764 wrote to memory of 3804	5764	OpenCode.exe	125
PID 1220 wrote to memory of 1508	1220	msedgewebview2.exe	133
PID 1220 wrote to memory of 1508	1220	msedgewebview2.exe	133
PID 1220 wrote to memory of 3888	1220	msedgewebview2.exe	134
PID 1220 wrote to memory of 3888	1220	msedgewebview2.exe	134
PID 1220 wrote to memory of 5988	1220	msedgewebview2.exe	135
PID 1220 wrote to memory of 5988	1220	msedgewebview2.exe	135

C:\Users\Admin\AppData\Local\Temp\OpenCode.exe
"C:\Users\Admin\AppData\Local\Temp\OpenCode.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Users\Admin\AppData\Local\Temp\opencode-cli.exe
  "\\?\C:\Users\Admin\AppData\Local\Temp\opencode-cli" --print-logs --log-level WARN serve --hostname 127.0.0.1 --port 49871
  2⤵
  - Loads dropped DLL
  PID:4932
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --proxy-bypass-list=<-loopback> --lang=en-US --mojo-named-platform-channel-pipe=5764.3112.12303715357379270266
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa4b4eb078,0x7ffa4b4eb084,0x7ffa4b4eb090
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1788,i,1941595225981838318,17157315666122105755,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,1941595225981838318,17157315666122105755,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2288,i,1941595225981838318,17157315666122105755,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:8
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3452,i,1941595225981838318,17157315666122105755,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,1941595225981838318,17157315666122105755,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5032,i,1941595225981838318,17157315666122105755,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4420,i,1941595225981838318,17157315666122105755,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView" --webview-exe-name=OpenCode.exe --webview-exe-version=0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1192,i,1941595225981838318,17157315666122105755,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
    3⤵
    PID:5988
- C:\Windows\system32\where.exe
  "where" code
  2⤵
  PID:2288
- C:\Windows\system32\where.exe
  "where" code.exe
  2⤵
  PID:4432
- C:\Windows\system32\where.exe
  "where" cursor
  2⤵
  PID:3868
- C:\Windows\system32\where.exe
  "where" cursor.exe
  2⤵
  PID:1424
- C:\Windows\system32\where.exe
  "where" zed
  2⤵
  PID:5396
- C:\Windows\system32\where.exe
  "where" zed.exe
  2⤵
  PID:5100
- C:\Windows\system32\where.exe
  "where" powershell
  2⤵
  PID:6060
- C:\Windows\system32\where.exe
  "where" "Sublime Text"
  2⤵
  PID:4696
- C:\Windows\system32\where.exe
  "where" "Sublime Text.exe"
  2⤵
  PID:3980
- C:\Windows\system32\where.exe
  "where" sublime_text
  2⤵
  PID:5224
- C:\Windows\system32\where.exe
  "where" sublime_text.exe
  2⤵
  PID:2660
- C:\Windows\system32\where.exe
  "where" sublimetext
  2⤵
  PID:3456
- C:\Windows\system32\where.exe
  "where" sublimetext.exe
  2⤵
  PID:3096
- C:\Windows\system32\where.exe
  "where" subl
  2⤵
  PID:1400
- C:\Windows\system32\where.exe
  "where" subl.exe
  2⤵
  PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

package.json

Path C:\Users\Admin\.config\opencode\package.json
Size 62B
SHA256 95be083aaf52d6a4cb7a01bfd95a47802441fcdd52a34373cd09c2bfc0722547
MD5 ac29eca972f9638b12df179b33813fe5
SHA1 d49d09d27ce23bc9d4a38c8d846d00c9777c4efd
SHA512 147ad56089db26c8c4c007f92085bad715633b5ae54c1f3d8476050f7edf8fc1c6cc8f875a467162f10aaeb1642184700702fedeac6a4a8b6acf9279bb103974
TLSH
T136A02230B00000E28EEFA0C00088C323880EB808C0088808A0E002CCCC00AB2008C220
MD5 SHA1 SHA512 TLSH

Submit Download

.bebef5fefae8fffe-00000000.dll

Path C:\Users\Admin\AppData\Local\Temp\.bebef5fefae8fffe-00000000.dll
Size 1.1MB
SHA256 1c51f4bd5e5a61a9e3aec69922de6f0da92db82aa3a936abac2a4e02ac155d57
MD5 86940db044ee98a91174b10e7d1f0363
SHA1 0e9db4cf937a6ab17a40e8b3f06e839dc69e42c3
SHA512 befff4a42ee331fa1a340c0224897fde7a5962102d6d59eeb9f8de51fc677fd3430cbeb3f4bfc4b5ad33bc16c709b5f0091095b62920f0b4e38fedaaac40dcd7
SSDEEP 24576:aIp2C9qdXP68TPtiGFrZwFelnwqESQT+:aIp2C6P68pNFrZ/lnwqEv
TLSH
T19935E507F2A29D7BE01E807041E756D2D2FD76498300E8BF91A05A2C1E978FB5B747E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.fea7efdfdfaffffe-00000001.node

Path C:\Users\Admin\AppData\Local\Temp\.fea7efdfdfaffffe-00000001.node
Size 506KB
SHA256 a8199cf7b6c5102267a5889f80321a4cc92e631d7504c474d32a35b4d440f315
MD5 34581748f55c388cd744f152e065bd0c
SHA1 95c5394ad0a174184b808c17d1eb5fc71593d7de
SHA512 b5b8ab91947a2b06bd7ef097855b0cf19dfbf3b9e93b33d02b57cbdac4ed0b7d82004665123a1ee6c5a880b80d7cd9df9ad202fa179731b2045b0ae11e1c69f3
SSDEEP 6144:jk4bH+DHWwaMfPvMpRIO8kM4dac5mlMH1BVLI6vuLlKIdM1sj3vy8BK:N+rWgcc6hdac5mSrVLIUuLlzqsDpU
TLSH
T19BB47D6AA2A803B8D4ABD17CCA574903F77578460761DBDF03E086761F27BE15A7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7fc4b7a60b85004d4d4483b3694e8d843fd33d6f037f13d2019bed8a02148e31
MD5 12a853ef4f2c670a7a73e32a562c3ec1
SHA1 7e7f4c353a884f9fcb5ce542a2cb03bd3759160a
SHA512 e2f419063fa1b33dd92d09affe422b6d8b2acab3f78924c8a3ecf1ccfedd8b638100bb65cebc1c8020a0d5f9cad18f5763725ad4445c9a23595eb727cd3166a5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cad7b85d6fc36d42ee44c513f7b9655be5ce7b223210a9362dc1e286c0e8893d
MD5 5ba77e4cd41ecea9354cace3c00b1d47
SHA1 bfef6132e8b6c46a9e68c1e9bb88ef12825818de
SHA512 37eb81b14cab0d56c2fafc19b68152816d4eb3e9b66760ae0596b884aefa2522e7a5effe7f5a30f1fe426525dea35ad5b997e3b5a6138442ca046926be2d684e
TLSH
T1ADD0121733410934C41030B30082E25C0440C20B820641416439961D1A040640947452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4651cb104903548633bf7a8cb91c41e353870bbc4800a1c39ab4dec01b4b6e60
MD5 4e6d1c2052c09fcd1169cf06c39dd9f1
SHA1 fa0c15e127ccd339b5c002ea4465040a93894057
SHA512 10f8b0414142f3cb96708e17a2c6f853a342897cfb301795a532891077a2e736fcd52ef99960f2ee053b5cb31930b67ecc1f2bdd774022f6e1c7e4a5e0ce14ee
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 4acfbff72f974274f38fddcda39322681c1bb891fdce9b493dfaf10b75d7ecd7
MD5 6f43661f6de934d917a2bd2522e73c9c
SHA1 67bba4eabc7f5e83fdad587a3dd1f4ef23a5ffc8
SHA512 609bf385b104bb879a3c5888024cd97f575fee6a70a7dc39c2be9669c058e92180082bd34b2df27ec54a4738cd5c2ea736565e2ef5a72c6f65ae18d3bec4f0e3
TLSH
T163D0C9615CC3C842F3441A7861DDA3013AB49F0181736FC75CE202FC99B13A55A02534
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 21f60acf2c96cb4bdd8ed8d0969803637a559433299b5486ba4ce4c60789f53d
MD5 5c94b518dc37b4e7da059fba71b66215
SHA1 f7cc1e18c4900999d54e5fa29eb41f5cba983c08
SHA512 49b2224b72624ccdd2e372c405624a03ae8ee0fc06cdfbfa9aa8a6b27f5def5cec82526c92ea1fc2932d80ac1bc04ee60c6dccfe9e4f774dea96757bb5b2fe4a
TLSH
T157E017529ED7D481F3A61678A1DD9B213BF85A418573AECB4CE602FC9CB436215025B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 83f6958772a4cf9c5e427788436539d360a7e137133a8e257736fe022250d8c5
MD5 ec41dd19adde59ee417754b8e8da6ba1
SHA1 3732bed9cf52ad2491b9b18f9f2cf082a975c0b1
SHA512 5909e9143c136ac794811bcddedfccc06075d161b7d2723661cda6342da163aee435a3dd4704b024e04b9081b83ede0b18c0d445360dcbf5656a39864e4d3f2a
TLSH
T1E7E0C2054EC3C481F3514A7860CE9B223BB45B0181336ECB4CD646BC5D743522103474
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59889f.TMP

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Network\Network Persistent State~RFe59889f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Preferences
Size 6KB
SHA256 b40475c7a201818a7f58c3fd36589a15d733bca39c137e114f5c03c1e5d7d058
MD5 2ab282f564987a5bad5d4cd54493f7a6
SHA1 6dba0f85832b4617fa90a4e12216b897021c1571
SHA512 341485c9f88b7e88157c0fb871fe84ff6719c6b335b5d539be4c4f2219b65b433511f9b10cfb60fa3c537f39bd58aeca27ff61f537971c62b74cd1682ca1d44b
SSDEEP 192:stf0UO/f3Z8paF7/S+WiTZ/WdeC/uS0wMC:st8UO/+m/V9WNl0pC
TLSH
T1AAE1B8125E28A9774CCBF71D7A35BF56E6F6102221D40F58ABFC871C09E66CD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58fe12.TMP

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Preferences~RFe58fe12.TMP
Size 6KB
SHA256 7bc5e9c8de5f41fb492daae8ed53a005eeb5e0d3f5570c068d09ef4f9b016c99
MD5 c701a576535c85686fb703e2619156dd
SHA1 739a09cdfb09b1467ff14f400d9465fa55983654
SHA512 3afb165a2cc0b6d17bf0b678ba211a323d12193ae651cc2a3d57b8d0baf41bb8b4d882bcde38e3e1276287997419a9fc0ed4b57089569080e8268ba9b394e0f6
SSDEEP 192:stf0UOIf3Z8paF7/S+WiT08QdeCtS0wM8:st8UOI+m/VrQC0p8
TLSH
T13FD1B9135F28A9774CCBF71DBA35BB56D6FA106225D40E98EBFC861C08D65CC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

f8779118-34c8-4ad6-b79c-3f15706879f0.tmp

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Default\f8779118-34c8-4ad6-b79c-3f15706879f0.tmp
Size 6KB
SHA256 a8446df935de2f596a1e1dc046aaf5bbae8de80d2c8437b5dccd17bfa4001deb
MD5 8b9f8b07b55023bd35c227650780407d
SHA1 374279150317b04e008d015ded4be83ed881265c
SHA512 69dc69971a825e2c10e4d45e386351002f198a18419d063aace14142d78782116ac4ceb9af1e4e27b6df7ded4c4addae6d6c7c8f35d94c54a69159ce54383ed3
SSDEEP 192:stf0VO/f3Z8paF7/S+WiTCw4deCx2S0wMQ:st8VO/+m/V54Ld0pQ
TLSH
T1E9E1B9135E2859774CCBF61D7A35BB56E6FA106266D00F98ABFC861C09E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 1KB
SHA256 a93df2fe51b01d9cde3e7a9685455662dd840cb0df53bf5585d56a106ed28f97
MD5 cd9380aec92dae440396352cd4deb3da
SHA1 713d273f7c89e2c097d1e4840265adf4701ea224
SHA512 719e9d4ebe030daf43ca1ee6000d2dd9cef9d762aafd028f275d4f037042faa2edca853b6c1ccfef5f9222fb6a2e3c75202da20122719a5f17a3f0e061337c22
TLSH
T1D73185B7E494DF320CE6754D72527AAB2F30113F82A10F4895ED0B0C01A7A8C917AD3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 2KB
SHA256 c2d2e90ce10ea2d2a44abc9f87ee16290e24d4f553190085d1a2cb8e9abd0bcb
MD5 985d24a6ecf2d17ddfad1b7a447df770
SHA1 976600a788b15a74fd45908a53cb6b4fd7efb59e
SHA512 ead8b965891f38a398ea43954d58bca826dca564061af38bb0b83b68f9eb1cb8dec59c87bd536e81a8fd14844c42dc5de19b73637905f478c3dabe6780a24830
TLSH
T16851B873BC18DF7348F7AA4879563B675F35516686A22F509AEC0B0C01DB64C2346C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 16KB
SHA256 abc9c63d6e584783f6a4924eceef7cc342f0831982a7939f9fec7915caf4c7ba
MD5 c0b218826150c0202fb6f051ebcc57fd
SHA1 1ebec9764dc4f8008d0a4daa6e0b376d36c169d6
SHA512 4563cba49d67a01cc11fdb800a4ebac05678af3e614d7d84e7e78b6821bb3f3d7005b0fe94d088c1615b970c0355b9adbb1389101c9449a7a7dcfc71d2cdb537
SSDEEP 384:zVfRE5BdEZfr0kuh9Rt/nP9yg3NbbkvGK97PyzQw:9RkurqhNsgavDxyzQw
TLSH
T1BD729E738934ED275CEAD10A394A6B026AB4C55E91D12FA8ACED1F0C06C7BC513A3D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 16KB
SHA256 30b9412a18d41bfd2105ca673b8bec12dbb058da4383870f1eca252ca74cdad6
MD5 a5c809f832daa624166e84ea4d2460db
SHA1 00984e99e0ffd40feed8416cc969318fe024d3c6
SHA512 d8e0936e5a97fcc027fad89d3e3441e0f390ed00dbb510af01cc6bf5f22b419d51fb2e3f9d3b235ce868d4a5bacc11d21d405bb260e1e64d3cf5deb646f824ed
SSDEEP 384:zKfRE5BdEZfr0kuh9Rt/nP9y73NbYkv0K97PyzQw:+RkurqhNs7HvBxyzQw
TLSH
T1C8729E738934ED275CEBD10A390A2B03AAB4C54E91D12F98ADED1F0C06C7BC91393927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State
Size 3KB
SHA256 4674d57c58f48ad883046132aec0cd12009c3ee95cd962ecd0b19848271949d1
MD5 dc4e47b104ef1fd7528b4059fac6c3bf
SHA1 ff8a35e4d8cd52e156fcb0e71e2a338563f32769
SHA512 be402b6805a1d83889d281ac8306d766eed3bc9f2a0b11678767bf23b09c07ea4b85b3aa9e89ddde86b6e7f42b2a63760676c86afac51c80ad5f714ebcb21a1e
TLSH
T15C718537A868EA274DF7A948B9863B167B655127D1D13F94CAEC0F0C01976881342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe586107.TMP

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\Local State~RFe586107.TMP
Size 1KB
SHA256 02d2997134e5b2b9c9ca53931d5df2a6e7cc6ba8caebccd72c1f574ca77ecea3
MD5 c0b07edf73ba41c7b2907b1b73837acd
SHA1 d6ec1f30456ad258104c6019468f100ac98fdcdf
SHA512 f58b663a0ac7dbd3b98a75fb91e6dee6972449989de7d2ec06c9ce10d3c91a61c4c57c0bb285afbebfef289157cad47c3419b4aecc8d1b57711367ca717c87b6
TLSH
T1CA216577D494DF3258AA6859B362769B2F60513F82601F08D5DC071C01A79CC917AD3B
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\RevisitationBloomfilter
Size 392B
SHA256 d479861f5dfc783b959716776a210eb4bf52f38237807860c7997a4964ba8c28
MD5 6fd971129b6326ffb0616c8287111a45
SHA1 d3fd4367bfb4b551a461ce8fdb5b65f6292b983f
SHA512 b51c42c7bfbbb2e5041ce6e653df8f8dab4cc21150f20694bc86899c9768ee8fc2db8ffddc522e7a3e21118ca48285004aded4b14330bba79e9fdb4062723036
TLSH
T18AE00297D700A4AAC82857705943273027D2C13402F113156A4541951D136103D56696
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe595589.TMP

Path C:\Users\Admin\AppData\Roaming\OpenCode\EBWebView\RevisitationBloomfilter~RFe595589.TMP
Size 392B
SHA256 6c84063d35555f6ed6ed8413db98ad7ce047567fbd637eb9fa57c681adcad285
MD5 d17bd69b3755b4157ce79552a0603e77
SHA1 31c5440b11bf7317e78c4a3b734c2875928dd51a
SHA512 4a619e90a2f1922c7b3c1515c116cc9ad8ee184298704eb8c1573fa960410aba114a0373cca0dbd106d21e2ebd1f1be5eb44f8955adf38093a9ca5fcae8f1afc
TLSH
T1B8E00453D700747DCC3C55704C4313303753C13403C113157D0501D04D117101D57CD5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1220-679-0x0000027F156F0000-0x0000027F1572B000-memory.dmp

Download

memory/1220-676-0x0000027F0B9C0000-0x0000027F0B9EE000-memory.dmp

Download

memory/1220-678-0x0000027F156C0000-0x0000027F156E9000-memory.dmp

Download

memory/1220-677-0x0000027F0DBE0000-0x0000027F0DBEC000-memory.dmp

Download

memory/1968-344-0x00007FFA65FC0000-0x00007FFA65FC1000-memory.dmp

Download

memory/1968-343-0x00007FFA669A0000-0x00007FFA669A1000-memory.dmp

Download

memory/1968-694-0x0000027469620000-0x000002746964F000-memory.dmp

Download

memory/2772-273-0x00007FFA65E50000-0x00007FFA65E51000-memory.dmp

Download

memory/3284-345-0x00007FFA65E50000-0x00007FFA65E51000-memory.dmp

Download

memory/3888-908-0x0000019A8C580000-0x0000019A8C5AF000-memory.dmp

Download

memory/4932-673-0x000001E687EF0000-0x000001E687EFC000-memory.dmp

Download

memory/5988-948-0x000001DD09EA0000-0x000001DD09ECF000-memory.dmp

Download