Overview
overview
8Static
static
3archievabl...up.exe
windows10-2004-x64
7archievabl...up.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
8archievable.exe
windows10-2004-x64
6archievable.exe
windows11-ltsc_2024-x64
6Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/06/2026, 04:38
Static task
static1
Behavioral task
behavioral1
Sample
archievable-v0.2.1-setup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
archievable-v0.2.1-setup.exe
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral13
Sample
archievable.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
archievable.exe
Resource
win11ltsc2024-20260618-en
General
- Target archievable.exe
- Size 6.7MB
- Sample260625-e9papshs6w
- SHA256 3f556deddb0514f30945b0cdadd4911074f8dcecd1937430181ee34258ee0e2a
- MD5 b10cbddea31f1908fbcc9ccdba3c7806
- SHA1 2abf7cc01e92c77c49f29ee408555756dc908102
- SHA512 2f3556131627f27e2ae843c3ecee5c5b628849e0f2999ee3b121293c1d30fe4199d61b4e3d709c34b808d6fe97d56f125718239705cc79f2fc33b5ada884b3c3
- SSDEEP 98304:nrb/M5qfYccmVQ3RVVEfSL/m4EDuLbmWaE16BC0T9GGDto4o7mRuMNme50K:ro5q0WPRuhK
- TLSH T1F666E711BE9B5958D08ACCB0C34B8B678E2134CB193AB4BF55D9522D2F7D7F06F1821A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA archievable.exe - Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-eu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-hr.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-tk.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-lt.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-ml.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-nl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-ru.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-nb.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-sq.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-ta.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-uk.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\_metadata\verified_contents.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-ka.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-de-1996.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-mr.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-or.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_662519273\manifest.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-cs.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-fr.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-gl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-pa.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-pt.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_480861309\crl-set msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_480861309\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-bn.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-hy.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-sv.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-hu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-cu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-es.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-hi.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-te.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\manifest.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_480861309\manifest.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-el.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-en-us.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-et.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-nn.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_662519273\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-cy.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-de-1901.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-sk.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-la.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-gu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-be.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-ga.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-af.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-kn.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-bg.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-da.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-it.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-as.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-en-gb.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-lv.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-sl.hyb msedgewebview2.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268359258306444" msedgewebview2.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1056 msedgewebview2.exe 1056 msedgewebview2.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3056 msedgewebview2.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1796 archievable.exe 1796 archievable.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1796 archievable.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1796 wrote to memory of 3056 1796 archievable.exe 88 PID 3056 wrote to memory of 3816 3056 msedgewebview2.exe 89 PID 3056 wrote to memory of 4716 3056 msedgewebview2.exe 92 PID 3056 wrote to memory of 4716 3056 msedgewebview2.exe 92 PID 3056 wrote to memory of 4716 3056 msedgewebview2.exe 92 PID 3056 wrote to memory of 4620 3056 msedgewebview2.exe 93 PID 3056 wrote to memory of 3228 3056 msedgewebview2.exe 94 PID 3056 wrote to memory of 3228 3056 msedgewebview2.exe 94 PID 3056 wrote to memory of 1036 3056 msedgewebview2.exe 95 PID 3056 wrote to memory of 1036 3056 msedgewebview2.exe 95 PID 3056 wrote to memory of 1036 3056 msedgewebview2.exe 95 PID 3056 wrote to memory of 1748 3056 msedgewebview2.exe 109 PID 3056 wrote to memory of 1748 3056 msedgewebview2.exe 109 PID 3056 wrote to memory of 3084 3056 msedgewebview2.exe 110 PID 3056 wrote to memory of 3084 3056 msedgewebview2.exe 110 PID 3056 wrote to memory of 1056 3056 msedgewebview2.exe 111 PID 3056 wrote to memory of 1788 3056 msedgewebview2.exe 112 PID 3056 wrote to memory of 1788 3056 msedgewebview2.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\archievable.exe"C:\Users\Admin\AppData\Local\Temp\archievable.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=archievable.exe --webview-exe-version=0.2.1 --user-data-dir="C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1796.3420.35984071269857003982⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdc835b078,0x7ffdc835b084,0x7ffdc835b0903⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView" --webview-exe-name=archievable.exe --webview-exe-version=0.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,5340270560362424639,17790867721905491681,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:23⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView" --webview-exe-name=archievable.exe --webview-exe-version=0.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2040,i,5340270560362424639,17790867721905491681,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:33⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView" --webview-exe-name=archievable.exe --webview-exe-version=0.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1736,i,5340270560362424639,17790867721905491681,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:83⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView" --webview-exe-name=archievable.exe --webview-exe-version=0.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,5340270560362424639,17790867721905491681,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:13⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView" --webview-exe-name=archievable.exe --webview-exe-version=0.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2132,i,5340270560362424639,17790867721905491681,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:83⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView" --webview-exe-name=archievable.exe --webview-exe-version=0.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4428,i,5340270560362424639,17790867721905491681,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:83⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView" --webview-exe-name=archievable.exe --webview-exe-version=0.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4416,i,5340270560362424639,17790867721905491681,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView" --webview-exe-name=archievable.exe --webview-exe-version=0.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3680,i,5340270560362424639,17790867721905491681,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:83⤵PID:1788
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-af.hyb
- Size 70KB
- SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
- MD5 ffa9db945f0f0c15b8bba75a6e064880
- SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
- SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
- SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
- TLSH T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-as.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-hi.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\hyph-nb.hyb
- Size 141KB
- SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
- MD5 677edd1a17d50f0bd11783f58725d0e7
- SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
- SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
- TLSH T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3056_1382688947\manifest.json
- Size 82B
- SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
- MD5 2617c38bed67a4190fc499142b6f2867
- SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
- SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
- TLSH T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3056_480861309\manifest.json
- Size 113B
- SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
- MD5 7ef3c71464d0fef472bc1d81fd363c62
- SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
- SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
- TLSH T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3056_662519273\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
- Size 22KB
- SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
- MD5 d01869348d5a783f61f90cbb27b82a78
- SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
- SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
- SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
- TLSH T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 729c25413253e572ef5974239d69651fc0a5b54f270c356efd4c96d863d0bac0
- MD5 9b5ba7c4bc9a20d52b69e706719322cc
- SHA1 12f866fc5a94ecd83ba8f27ebab03c09103d70da
- SHA512 6458ababfe5995e99c4ff11d02983e902964a85fb09bacca937f5f1150b2122ec75ea5708d3e2185f0bd8fabd81de94616c8ed604167e28d3a10c85d4c0dbbf3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 9fc58144f66b6a3ddb6ddf344a57df96efb12c8088b6d69d36afed5a54647ca2
- MD5 d92759643d185ad064dfa10193eed00a
- SHA1 7486c9903d95d94000a3ba5596962148410648fd
- SHA512 019a0fb758be5ff86e8382fef9cb48f194c74b2d07c18b7aebff68e609d0474b59df1cbe405b114e0f4710334e040ad6240cd9b071394561327b68b46ce8b2d3
- TLSH T1E3D0112232220238C02032330023A2082C80C22F8A0A8080A83CEA2E2A280A02A03AA2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 4192f437ba532cc7873528f2c4a145fb57194d43d16d192d6b52279222b16e13
- MD5 e748c53a063dba3c860868abf92ada3e
- SHA1 b1cbe5275dd3ab5eecc2f49017a5e10851147988
- SHA512 3080e754a3ddf6f913b5b8b850ca6134fbaa49678ca883cf8e83825f20e998d2b4722ac8bb77bbb18e74281d7190bbece7b303a0d41bc4a4cad58f2f4439f114
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 f9017cc8522260342edc5a8427828bd9f561d12244a0ff58c5e572614411df0c
- MD5 5b222653a3a3d4a5bcaad2f35733858a
- SHA1 9a7fa20dd814ac753cef412084850fbb37cd32a8
- SHA512 65c9c805531bc5419e0a98f7eee73db0607e950959514d39f1caaabcbb29db631a5525b5e0c8c034f75c038079ad1cf5c1f48dbec75899adf00f283a492ea2f4
- TLSH T1AFA0026141401406CD04137055C326843734885822071A02C9D1417598D33518997712
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\Network\Network Persistent State~RFe5997c2.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\Preferences
- Size 6KB
- SHA256 a8df9ccf6da3b56b241669fd0f20273aa625e04cf67be4fedf4f1d532d5eb7e2
- MD5 aaadc7d30a34fadc94b510252fab79c2
- SHA1 9dc90335321f3785db06bb6aaee3c017af2e54e2
- SHA512 7000656f54b9ef40190e16dc7ec506cd82bbe49bdaba61925402adf77eb0542880ce0e1d132d6c9846b7d780a0da33b24b2e688dd243c0bbb56bd98cb592684e
- SSDEEP 96:stI05yy+axUbb9fiffEZ8i0vhE2ktCm/7qx+WVHMSm+uecJ0o1idQjh+gmZHplMC:stI0f0ifsZ8pa9f/S+WiT0owd0k5jMC
- TLSH T1CED196435E386D774CC7E61D7A35BF16E6FA106266D50E98ABFC860C04D6ACD230790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\Preferences~RFe590fd5.TMP
- Size 6KB
- SHA256 a36a02926d599856c9a54fc8a9318baf05c2af573588cc4c3a1d621e54bb6edd
- MD5 78d87d570a06692274227c75725d083c
- SHA1 5620c44b0c2fbfef6577620e78b0fdb8808279aa
- SHA512 d623171141f43dcad52d1da6cae99e4d1ec3dc1fc6b946c3636c405756ea47fba614d7c251644e7a254947d3ca38595f1feba57c33c788484b0d2bb41cc8ba80
- SSDEEP 96:stI05yy+axUbb91iffEZ8i0vhE2ktCm/7qx+WVHMSm+uecJ0o1idQjh+gm5plMEB:stI0f+ifsZ8pa9f/S+WiT0owd0k5jM8
- TLSH T113D1B7435E386D774CC7E61D7A35BB0AD6FA206166D40E98EBFC860C08D66CC230790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Default\Sync Data\LevelDB\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Local State
- Size 2KB
- SHA256 d3d93464994b9a8866ab6018f20b4db424a6d269113d94e32e5349c687c37ea4
- MD5 66b3b4f98d033e2db68694b830396dcc
- SHA1 7e3644c972b956d8ff7c8dec330da81d4cd3f5d7
- SHA512 ef4e1477209edefe07ab6525847a99e92fbd9d6629c9573188853dc70673be9ae8a8798096652c10037c94a5816f76c6d1e2f55489302a4d0bdb70b0e253bd10
- TLSH T15551C8B368649E378EF39E0879097F1B5E35506197B12F9099DE0B0C41D7A9D2306C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Local State
- Size 3KB
- SHA256 b3849d11374f132fc95beef20f87d64ad04cc71bee49c241b44a71318df7c830
- MD5 7837831fce9ea9654881a54fcd5815f4
- SHA1 f75fc2d00799e7323e6c67fe1a00522c2180f671
- SHA512 7eaa221e94c01014801c432ce9d0407de6fe357b7a5c9bb279312b1ec7d86e480f6a8bedfa448ffb30402542b21a496eecf8144aaf19f294c28111fba508997f
- TLSH T13D71737769B4AD374EF29E04B9852B1A7AA55127E2A13FA4D9ED0F0C01D77DC2302C1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Local State
- Size 16KB
- SHA256 3f1f33c668a99fabc37115380f06228a3fc78054b420bc656afaa603595853a3
- MD5 26229adffbe05555a9021169bd1cac42
- SHA1 0608204ec85257f2e0ef2483bf6b44c5f5e088e6
- SHA512 56459c86424ddd6c45acad9879e4b65198ef6c920acb0d392b010ec48a78cb33ae1428a7306cc6d55e1c13292246fa73e092239ea3c3c552bee424ca385ba068
- SSDEEP 384:zmsrv+89zHqlDNP9oid6NbPu/FTqwyuzNy:trv+4UNbd5tqwyINy
- TLSH T180728D33A57CAA334DF29949F48A6E0B3F78609652D11BE4D9D90B8D82DF4C92307D17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Local State
- Size 1KB
- SHA256 cc6d4abcac84cf4deadfdea557912511f1cd9bd83db38659d85fff797f2afce4
- MD5 60eb52d152aa2ac51501a624e5b634d3
- SHA1 44f7ffc1112809f320b54a1fdc1f395c3e3784ae
- SHA512 8784dc58110a40fe67ab9957472d52d0660d1576d6ad01b097850361b72dc3dea7aac4d5b5486ff97d55e9ac21b13d3986cf33283ddd830a9682c3e6d1f8267e
- TLSH T1213185F394F06F365DE19A497102AF9F2D21102693701F84A1DE4B4C02D7A8E962EC37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\shop.archievable.desktop\EBWebView\Local State~RFe587153.TMP
- Size 1KB
- SHA256 0107e4e82eed9fcf2084e26433be7689662978c68cd1bc35412e70adcd1542cc
- MD5 ff9c325c36ae6a5b7e8ed4c7cfde4ac3
- SHA1 5ae27e624272c4ebe750b6f06f3f285dce95916b
- SHA512 78069912a6958ac3d9fc50d112395e5f36cbc9b7680eaa7d31fa33f6fcec2734665355d43ed09b6da5bb9462be6e7685ac238023ef4047670235b279a5bbd187
- TLSH T15C2162B3C4F46E369DE19959B102EB8F2D11506653701F48E1CE470C02D7A9E962BC37
- MD5 SHA1 SHA512 TLSH