1bf6b9c7a63fc137340b6ed24f24c2256b64b9ef85eb0c29a42cb9e0fd625fee

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RIP_Tweaks_Installer.exe
Size 10.8MB
Sample260712-rntdradv8v
SHA256 1bf6b9c7a63fc137340b6ed24f24c2256b64b9ef85eb0c29a42cb9e0fd625fee
MD5 8ef316992785373ed6cd14c653b89a55
SHA1 90497012f1e4db063257d5a0d5bf2de73c1f1dde
SHA512 1d8cdd281dad341b4f364dc3860d5cf0a5a5f84e068b4024168bec611c48604f0e78dcf886b3ce964b69935b781135b785bbb65e04d40922cd5fcf5ecf101375
SSDEEP 98304:ff6cszhNsqZ6Cym5Gxh1RuOHYYO7dJbEbCF8GR9ytOlDGZrtA+8T76QZfNAkMUqk:fScszp7yWGxheCIzbEbCFnn2K4HQ
TLSH
T177B65C13ECA545E9C0ADD13586629163BB717C885B3023D72BA0FB293F767D06EBA710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RIP_Tweaks_Installer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1075683108\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1075683108\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1075683108\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1744160727\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1744160727\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1744160727\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_1075683108\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_284014160\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
824	msedgewebview2.exe
824	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4600	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4600	1112	RIP_Tweaks_Installer.exe	86
PID 4600 wrote to memory of 2496	4600	msedgewebview2.exe	87
PID 4600 wrote to memory of 5864	4600	msedgewebview2.exe	88
PID 4600 wrote to memory of 5864	4600	msedgewebview2.exe	88
PID 4600 wrote to memory of 5864	4600	msedgewebview2.exe	88
PID 4600 wrote to memory of 5864	4600	msedgewebview2.exe	88
PID 4600 wrote to memory of 4124	4600	msedgewebview2.exe	89
PID 4600 wrote to memory of 2804	4600	msedgewebview2.exe	90
PID 4600 wrote to memory of 2804	4600	msedgewebview2.exe	90
PID 4600 wrote to memory of 2804	4600	msedgewebview2.exe	90
PID 4600 wrote to memory of 2504	4600	msedgewebview2.exe	91
PID 4600 wrote to memory of 2504	4600	msedgewebview2.exe	91
PID 4600 wrote to memory of 2504	4600	msedgewebview2.exe	91
PID 4600 wrote to memory of 2504	4600	msedgewebview2.exe	91
PID 4600 wrote to memory of 2504	4600	msedgewebview2.exe	91
PID 4600 wrote to memory of 3000	4600	msedgewebview2.exe	95
PID 4600 wrote to memory of 3000	4600	msedgewebview2.exe	95
PID 4600 wrote to memory of 3000	4600	msedgewebview2.exe	95
PID 4600 wrote to memory of 4812	4600	msedgewebview2.exe	96
PID 4600 wrote to memory of 4812	4600	msedgewebview2.exe	96
PID 4600 wrote to memory of 4812	4600	msedgewebview2.exe	96
PID 4600 wrote to memory of 824	4600	msedgewebview2.exe	97
PID 4600 wrote to memory of 1928	4600	msedgewebview2.exe	98
PID 4600 wrote to memory of 1928	4600	msedgewebview2.exe	98
PID 4600 wrote to memory of 1928	4600	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\RIP_Tweaks_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\RIP_Tweaks_Installer.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RIP_Tweaks_Installer.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1112.5064.3694606087441457174 /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView /prefetch:4 /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ff902aa5fd8,0x7ff902aa5fe4,0x7ff902aa5ff0
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView" --webview-exe-name=RIP_Tweaks_Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,17830789346948700560,6393416604251984093,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView" --webview-exe-name=RIP_Tweaks_Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1776,i,17830789346948700560,6393416604251984093,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView" --webview-exe-name=RIP_Tweaks_Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1776,i,17830789346948700560,6393416604251984093,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView" --webview-exe-name=RIP_Tweaks_Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3528 --field-trial-handle=1776,i,17830789346948700560,6393416604251984093,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18 /prefetch:1
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView" --webview-exe-name=RIP_Tweaks_Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=1776,i,17830789346948700560,6393416604251984093,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView" --webview-exe-name=RIP_Tweaks_Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=1776,i,17830789346948700560,6393416604251984093,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView" --webview-exe-name=RIP_Tweaks_Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4604 --field-trial-handle=1776,i,17830789346948700560,6393416604251984093,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView" --webview-exe-name=RIP_Tweaks_Installer.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4360 --field-trial-handle=1776,i,17830789346948700560,6393416604251984093,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3813529435d1d6c9109daeb85efe9087c4526f18
    3⤵
    PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e182835a0791b090d5b22e0efdc448b86fcd6716f7298e458f87c0a1b6ec9a32
MD5 fb3a2a20bcd8186860177b6d13137e20
SHA1 74bd3a1a608bc9e7b270133ec1facf5c82a5fa32
SHA512 8a9666ed1d5056280ee40a85ede621d0a44be2a207ea4c3d00b881abdb98d7a90b2e442460843e0ff9fba6cbe2ef4f0cd4b23f0cb2c2381de994ace9db5dcb16
TLSH
T123D0121337520974C85024B32443B55C0800D10F40054004DC28953D3B090501903491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c79f99d8569a3ba048937078d4d65149bed3047a9c97ef4023a19115b073f782
MD5 e81873bcc2c533e3337f949c470fedda
SHA1 436cb7e9025ca1a92552ae68f1e70bc09e0fdeaa
SHA512 259bfff83d9664c7851f60abad6206f68f9fee44b127c59b5d5a01ccf62fef90140242d8753a052e3b2b6cc40be9c87b921fb767a3012f38bf711df27728a768
TLSH
T16CD0041177550C40CDC014F57455D5740504D40710111504CD10103C37470001003050
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0f974531-12f7-4ff2-98f7-9cb764ec9551.tmp

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Default\0f974531-12f7-4ff2-98f7-9cb764ec9551.tmp
Size 6KB
SHA256 d51d14a727c5491d8bcf8fe608c1b85618af17b09d861158ef50c5920ba68df5
MD5 befd0dc376ac5626666ea30261687ea2
SHA1 1bfe051a37adb974e38e3bef62bd4132e3826332
SHA512 eb0a77997e3e048bedb58c0a290b8583dd5db1ab83749e2673027e24fbd718ff52d0c68d888f4e885ef28051dac19f7850c921afcf39d276f5df56fc196ad3a9
SSDEEP 96:sto/dPd9CVb9XkATo5h16Z5Ks7/x+6MhmuecSmzP1ejeeK+gV28XM1C7K:stMly5oKKsV+F2mjQjSvG6K
TLSH
T133D196025E3468BB4CC6E119BE29FA57E2F9607272D51D58E7F88A1C04DB6EC730780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8093ffda-68b0-4717-b600-ea0f962e2901.tmp

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Default\8093ffda-68b0-4717-b600-ea0f962e2901.tmp
Size 6KB
SHA256 fc450ed140e9677c291f6be94aafaa4f7eaa8e450413df221235877660501455
MD5 046cc6399ffe019bf68026adff7aef15
SHA1 fa795e64b965e1a64f70bd3b7cc870c7b013e177
SHA512 2602c560f8502115eea09dcc6b97373a64a4cadba7b8629ddbc38a61b77c067813b602e00e49fd1e42742a6f1d7839dd55c2ccb7b28c3f987d6820f19a98ec30
SSDEEP 96:sto/dPd95GVb9XkATo5h16Z5Ks7/x+6MhmuecSmzP1ejeeK+gb28XM1C7K:stMl05oKKsV+F2mjQjS5G6K
TLSH
T1ADD196025E3468BB4CC6E119BE29BB57E2F5607272D51D58E7FC8A1C04EB6EC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 bbc7c74564e83e819bda537853ed26db0be42ec7c75b8b85047971a6cf25610c
MD5 45e3814af1f1a45370843f870f061c7b
SHA1 895605f8dcf5a1343b59c017b06bb44c521cab9e
SHA512 da973ac42f37571516bb47e9995eace352e9d24242ec69128a160c82c62afdb16c497fe188494524a240bcf329e6ebab0cd77ea27576868250a9489309537e68
TLSH
T16BB001105B12A453E29612B661CB818275754C6C9E27290740D503B5AA2B7A9410E702
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f64d.TMP

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59f64d.TMP
Size 48B
SHA256 ca2d3eca507ad8017a1d2222f5b7c592954cddfb9aa1b9661270787d182ee8a1
MD5 88a82317eb7932bff8624681e9099d97
SHA1 8786b9f0e442095a9aa29a6092bd344017e7cf3f
SHA512 914466c89142ddacad29ce8c2f2d9085bc215a8758b55eab7b777e4bb50ed6d44ca3d9fea8cfc095cbd9242cf355456d0a1799776828fa8a659c41c6acec411f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5acbfc.TMP

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Default\Network\Network Persistent State~RFe5acbfc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Local State
Size 15KB
SHA256 84bf0663a9ffa16d8c047a70a56f2ab5bc9dc2aa702080c5f653c69e46c39790
MD5 f54ad435f16abd947b83b6707ddf5efb
SHA1 e61d949c347b3b666d5ff95cd4f099e5e7fcffd4
SHA512 73150e54eb15d6707e4ec1c8027b278734e99a78a442bb4e2461e5aaa374108554fdca9415594831d0ad19e42c2bacaf0c45a671a63bba639d03cc81fa189568
SSDEEP 192:xsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vnNBSMNdeoDUhEZ:xsrv+89zHqlDNP9oid6NBS8d/i7f3YNL
TLSH
T17872BF33E67C9A379DB38409B84A6A477FB850A7B2C24A60DAD85B4C41CB0E83307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Local State
Size 2KB
SHA256 eae670ad4c4514d002dd054fadb34d0035df1ff2116abe200fbf56ef3a7244bc
MD5 1e247d3aaee9b0cce9ba18c03f7ce86c
SHA1 01107d4cd56567168a3c47b070b9ec57a7b81889
SHA512 1980cd7e374357fa613b1fee785b47660e2ea94d98a74b5e18d766550f63d65349b80d8f3b54ac538d949b197836e12f921d45b87ad8614c9ab71ff3096742df
TLSH
T16A51B673A9205A77A5A38609BD467A67CA354176BB921F51ABDC170C00D72AC3317C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Local State
Size 3KB
SHA256 93b9c964b9e093591d841b0e4d9cb656c220a7dca697bb94be59c53a2f38243b
MD5 e9cbca64ff707c7d1dea13101e130426
SHA1 b0f0f446cc7ac1250063caaf582d306588c2a11e
SHA512 89fcbf01d995a34ecc024067e51ca38f056feed4db603d61f915cabe3dfeb3de2a936c5ef764457ff728fed7023151ac8ac7b7231f8825c1e43a526675b25c55
TLSH
T1DE71A6779970997B59A38505BD862B56E7A14137FAC13FA5DAEC0F0C01C73A82353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59a4d1.TMP

Path C:\Users\Admin\AppData\Roaming\RIP_Tweaks_Installer.exe\EBWebView\Local State~RFe59a4d1.TMP
Size 1KB
SHA256 7b01fa030dba7a3a46d544d1b1dec931f12648b6a2407c66d84fe91104ae4782
MD5 31e80de832283162b5d20bdd7de3e950
SHA1 a173613dcf53e5906d0ba3366988311605fd4d70
SHA512 05a39906b7d4060894c7c0384e4a0d2e4d13fb45c4ab24b13ab20bf8138f8cbe04b3e53da1c4d70fc733dc7eca42b7136ae11162dcb7b0f8fb73731395dd2d19
TLSH
T1843177B3D5605AB27C42910B7941BADB9F20017A63824F44B6CC970C11D71AC753FC36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/824-289-0x000001FF68210000-0x000001FF68211000-memory.dmp

Download

memory/824-287-0x000001FF68210000-0x000001FF68211000-memory.dmp

Download

memory/824-297-0x000001FF68210000-0x000001FF68211000-memory.dmp

Download

memory/824-296-0x000001FF68210000-0x000001FF68211000-memory.dmp

Download

memory/824-295-0x000001FF68210000-0x000001FF68211000-memory.dmp

Download

memory/824-294-0x000001FF68210000-0x000001FF68211000-memory.dmp

Download

memory/824-293-0x000001FF68210000-0x000001FF68211000-memory.dmp

Download

memory/824-298-0x000001FF68210000-0x000001FF68211000-memory.dmp

Download

memory/2504-112-0x00007FF923920000-0x00007FF923921000-memory.dmp

Download

memory/3000-240-0x00007FF924A90000-0x00007FF924A91000-memory.dmp

Download

memory/3000-239-0x00007FF923C30000-0x00007FF923C31000-memory.dmp

Download

memory/5864-178-0x000002801DB20000-0x000002801DBC8000-memory.dmp

Download

memory/5864-24-0x00007FF923920000-0x00007FF923921000-memory.dmp

Download