9898138abfec469d59227973df6e923d70f0fc98ae156cac0a068b5dd24edb37

Resubmissions

16/07/2026, 22:16

260716-16t8fae17q6

16/07/2026, 22:10

260716-13ch8aav3z6

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
flare.exe
Size 433KB
Sample260716-13ch8aav3z
SHA256 9898138abfec469d59227973df6e923d70f0fc98ae156cac0a068b5dd24edb37
MD5 75422d60e44c859e96f35b1aae9cfe2e
SHA1 9f15c3d1ffa2944ee302b01d257532a9907c1118
SHA512 982a1b5947925b9d793efe4c1efa6fe6b16145930f5dd0787cb5415bf15ce2977b383b33b19e9962e610634195d8c3bd2032e7ed37f245f30a2837aab432a7ec
SSDEEP 6144:jZ7JZoYeaNvaqzfUKfubHEVl2NEOjALsrnBsi2zS8MzF7JVFcwcntMQf8EJqSW5L:j1/TzNyUiFjAy2UpfCM/iXnEqzK1jV
TLSH
T1B494D02D81C89AB8E473D1F9DA538802F773BC5A4324DAEF178159760E275D4BA3B9C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	flare.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_633727933\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_633727933\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_633727933\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_633727933\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_633727933\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-nl.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe
4608	flare.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5132	msedgewebview2.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 5132	4608	flare.exe	89
PID 5132 wrote to memory of 4248	5132	msedgewebview2.exe	90
PID 5132 wrote to memory of 1520	5132	msedgewebview2.exe	91
PID 5132 wrote to memory of 1520	5132	msedgewebview2.exe	91
PID 5132 wrote to memory of 1520	5132	msedgewebview2.exe	91
PID 5132 wrote to memory of 1520	5132	msedgewebview2.exe	91
PID 5132 wrote to memory of 2544	5132	msedgewebview2.exe	92
PID 5132 wrote to memory of 2016	5132	msedgewebview2.exe	93
PID 5132 wrote to memory of 2016	5132	msedgewebview2.exe	93
PID 5132 wrote to memory of 2016	5132	msedgewebview2.exe	93
PID 5132 wrote to memory of 124	5132	msedgewebview2.exe	94
PID 5132 wrote to memory of 124	5132	msedgewebview2.exe	94
PID 5132 wrote to memory of 124	5132	msedgewebview2.exe	94
PID 5132 wrote to memory of 124	5132	msedgewebview2.exe	94
PID 5132 wrote to memory of 124	5132	msedgewebview2.exe	94
PID 5132 wrote to memory of 3836	5132	msedgewebview2.exe	98
PID 5132 wrote to memory of 3836	5132	msedgewebview2.exe	98
PID 5132 wrote to memory of 3836	5132	msedgewebview2.exe	98
PID 5132 wrote to memory of 4672	5132	msedgewebview2.exe	99
PID 5132 wrote to memory of 5272	5132	msedgewebview2.exe	100
PID 5132 wrote to memory of 5272	5132	msedgewebview2.exe	100
PID 5132 wrote to memory of 5272	5132	msedgewebview2.exe	100

C:\Users\Admin\AppData\Local\Temp\flare.exe
"C:\Users\Admin\AppData\Local\Temp\flare.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=flare.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-gpu-shader-disk-cache --disk-cache-size=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4608.4724.456217385903809588 /pfhostedapp:5f4b9e1418a850002a26e57272ecdeba8342710c
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView /prefetch:4 /pfhostedapp:5f4b9e1418a850002a26e57272ecdeba8342710c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x140,0x194,0x7ffb6a915fd8,0x7ffb6a915fe4,0x7ffb6a915ff0
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView" --webview-exe-name=flare.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1720 --field-trial-handle=1724,i,6296270705353578741,11758332289123779663,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:5f4b9e1418a850002a26e57272ecdeba8342710c
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView" --webview-exe-name=flare.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1912 --field-trial-handle=1724,i,6296270705353578741,11758332289123779663,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:5f4b9e1418a850002a26e57272ecdeba8342710c
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView" --webview-exe-name=flare.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2116 --field-trial-handle=1724,i,6296270705353578741,11758332289123779663,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5f4b9e1418a850002a26e57272ecdeba8342710c
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView" --webview-exe-name=flare.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3436 --field-trial-handle=1724,i,6296270705353578741,11758332289123779663,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:5f4b9e1418a850002a26e57272ecdeba8342710c /prefetch:1
    3⤵
    PID:124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView" --webview-exe-name=flare.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4228 --field-trial-handle=1724,i,6296270705353578741,11758332289123779663,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5f4b9e1418a850002a26e57272ecdeba8342710c
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView" --webview-exe-name=flare.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3744 --field-trial-handle=1724,i,6296270705353578741,11758332289123779663,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5f4b9e1418a850002a26e57272ecdeba8342710c
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView" --webview-exe-name=flare.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3764 --field-trial-handle=1724,i,6296270705353578741,11758332289123779663,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5f4b9e1418a850002a26e57272ecdeba8342710c
    3⤵
    PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d98a486e8bb7f395932a0d9499a02d4fa7ff931aaea1bfc10fc53048a907128a
MD5 f278b53d065065cc03ba16937ae3dcfd
SHA1 6c2b4fce5d82d4e2b3ff3642c100c8842ef77f21
SHA512 8090afdeac06a90c65bc9246942bbe7574955a1f3258107d05cb4ddca69548167f1d34148902b704b363661bf2fe870e9411812185141cadcf8af31825982265
TLSH
T152D0122233110234C41030370002A18D1541D30BC1058004A42DE55E1A444540A12453
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 88ec08b48615fe6ba6c4443e3e2584d18c9e14891cad0b8e8db70f01f0404f17
MD5 7b433746db66b335195b3288b6aac5e8
SHA1 6015a78dc209da24fe814f076ee60156c2a821d1
SHA512 8ace6ca64ae96ec9e75668991b25f1e20afcd778b4969378b3c100c7a7746a46b0969ff71275a6e2f0f9fc94cfd9e9fa3f41db8e3d810e416b34a2b77d0d8225
TLSH
T106D0043053100101C441303D4014C1C513415701D1014104515D704D04C05050151117
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

4e993086-883a-4c8e-ad27-2a5666a72461.tmp

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\4e993086-883a-4c8e-ad27-2a5666a72461.tmp
Size 6KB
SHA256 ea36051aa9c797806493a8592bd7fd586f0e8f1ec8ca2260e63553bad754dd86
MD5 c2df8801f6efdf326b2c448edd2f12a9
SHA1 135f336674a88625c1a5bd68a356edc2b3c0a161
SHA512 e311695c6d550ca0f929159c7e883939bcd93f6bc58a72609e1c9b779c8d060e8d969f1044b64453e74760b7c47f64b793675f4f2b0f70ba756a9163d6a00c5a
SSDEEP 96:sty/dfJnBb96ukGo5h16Zd0s7/x+6Mhmuecjq/1ejefK+gPYj28XM1C7K:stKZkuPoo0sV+F3q/Qj96jG6K
TLSH
T133D196025E28797B4CC6E109BE25BB83E2FA647265D15D48EBF8472C04EB6CC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 a5933f939bbb5279dac5a4c0ad146bc22c84ff310de52a3181675a03611d6b4a
MD5 84e0b5330bf83c89bdb5ff2a82177e83
SHA1 096545b24038c0b7444c1ac43fe7f80c0fafb1d4
SHA512 893bb6d04d6a41299d62277f6efa3e64d06881dca1cc099cb237bc92968a486ca9294b04131e3c8b91c27454f3e0bcee91a9b1d2da6355fceb04fcce64048e52
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe592939.TMP

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe592939.TMP
Size 48B
SHA256 b2042a780520c737e9a8092fb81608496b4d32e2543a8ed3450e9736f0f56597
MD5 341b0cdd5f634d7b750f13a92161727e
SHA1 1c5a6d9e97c633ee6b637bc5c841c58cf824c27d
SHA512 78250403b7f31a7ba4253cffc835375f77f8a69c6dff5d91dca9013c6f737b73e7b6ff5f02d574ba5d47ac9f122ae85678d824a3ba75b1330af208b1e7d07936
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\Network\Network Persistent State
Size 555B
SHA256 9e2c26415d858986d1a74333f56d4cdf8f3b921f3e64647a81a162baed0cb550
MD5 69f0735aef1d17e3f35eddef3790154c
SHA1 798eef9711fd9e0536d0cbcb0bdcd632504ed0aa
SHA512 c3d1aa5e9ffdb8c2aface1ae8470cd8a0f9d67356b9ac03cce2a3fef174d2487e368118636c133d896c372792cbd7af6706908c77ae75b4056fd0576b985af1c
TLSH
T11CF08BF3D3D8457D8A9203F02A34F857CE5E084142283D29DAE4AB8AD7D1826D10460F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59ff94.TMP

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\Network\Network Persistent State~RFe59ff94.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 e4006e20be4c655452b2f02cd5e86ff93709eedc6c98b63dd0d6c297c15fcd84
MD5 69856a035caa3b2a907dcc0f46078806
SHA1 c9b34a23b8861554ff3ee703d91e0b26268899f0
SHA512 3e69eaa6fc034a9ae3c4897c1535b582c6726458a1dac87125f6ac2861dd94fde6c4cdb709391c0dede56bc9d77a880587633f7be60f2866769a8eaf846a50cb
TLSH
T18FE0DF6354BDE0A7507859BA18C5F9056BBBF4394682A8E8CA66866CA0504AB0607423
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5955d7.TMP

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5955d7.TMP
Size 188B
SHA256 ecfcfdbb62320ff836e3a7a58e088b8bd88a76daf44cfa97b41c284a7ce6d2a5
MD5 01f59395430c1f798bf543acaf4e1d71
SHA1 e61cb67dec676e035e8160db442303201ade3e38
SHA512 79553dc7320c979397e7611a8c1cc69fb19134f8084ce0a91252b0b74ee250dfdf846ad6a9003e5898bf00ea7bf885ab05111a42b7cab446083db61e1da28043
TLSH
T1DFC0126284BAF4B710780B351AC8BD455FBBA574024198E89552457DA0525AA5103512
MD5 SHA1 SHA512 TLSH

Submit Download

b2b028b7-f0c7-418f-a103-086ecf670118.tmp

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\b2b028b7-f0c7-418f-a103-086ecf670118.tmp
Size 6KB
SHA256 c4d1a62bdc4beabc1fcbe2a4c0f22d20958fcc467654ea451f5693835ac6c8dc
MD5 e6e185559670f688232c76e1069d1718
SHA1 71dfbe5a0a80c92d8e390a42f12b7b3377d2de8d
SHA512 9d7d45ab4e11f053d89c8e4aba4101eab7e400e3b5df3ad6f682356225f315a17282383ade3711c84acb6a36aea5662f255981c1c30b4a9565d0b349d84ae603
SSDEEP 96:sty/dfJ2GBb96ukGo5h16Zd0s7/x+6Mhmuecjq/1ejefK+gPDj28XM1C7K:stKZCuPoo0sV+F3q/Qj91jG6K
TLSH
T16CD1B8025E28787B4CC6E119BE25BB43D2FA647265D11D48EBF8472C04EB6DC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\shared_proto_db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Local State
Size 3KB
SHA256 ec7a54ca08864221515dde619e22becbb82a90a0ff75c89d6b1e568d919163b5
MD5 61add7a3cc8b337cf15d75d89ec124a0
SHA1 87aefdf68ae5c19b7f222187f6c9ba023354d7eb
SHA512 2ab02b93f9de0635f651de7a6aaef1e8ae14080818fed7eeb5fabfa8735b1cfac1b96d80b5f3c4d890bc06163b50b258bbbffee31dd430b867a4b3fd53f684d5
TLSH
T192719337A9A4A9375DE2D9047C86BB47EBA15037AA817F94E7EC0F0C11C76D81352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Local State
Size 15KB
SHA256 4f4e89cf0fc2a496afc55e0a112cd42a386c33c2b73996bfb9fd4bc6006fdd5e
MD5 36273a36292042e239471e932fd68083
SHA1 d8ab1452371a60450a0f8441ce621709208959fc
SHA512 b351a22e58d4fabcf3331dc69d82afda813e3506ffbe9711ef57a4d0b4a493c7a70b590cdba4c4148362318a1b6de075fc6e81f821e91202d99af57377d7777e
SSDEEP 384:i5srv+89zHqlDNP9oid6NBSi26ZlPisdzWNl:iGrv+4UNbdhYPisVWNl
TLSH
T10D72AF33993CBA339DF29805B4CABB077B78606656C25AA0DADC5B8C41CB0D92317C43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Local State
Size 2KB
SHA256 795b0cd54f4d3beb251bf303d62f1161afb5184760c6c91574a8275547cad23d
MD5 f5a63ea0a8098f90bb0e76d4413d74e9
SHA1 97cf5a2f801f48883983eca070f488dcf4188a1d
SHA512 bd477ddefbe8b7987642a69fab13ddfee6eab202022c49dd8eafdc9d7935598c4213ba4eadef956726611ebda0908f74c0cd548f2c252a416c67627675cd1aa0
TLSH
T16F5182336D54AA37A9E299047986BF93DF7590A1AA526F90A7DC0B0C01C7A9C2307C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58d879.TMP

Path C:\Users\Admin\AppData\Local\flare\WebView2\EBWebView\Local State~RFe58d879.TMP
Size 1KB
SHA256 4aebe42751c49841a7b07004d1a318fc868e7668acef729326886e1f50229c32
MD5 64907ea0d7b1e92d8060053a66a2d084
SHA1 d9a4177b331c21684a85fd6470f5d9a0a3bfe6e1
SHA512 635776d596a51f9fcbdea77231b26f307564d9f559ada5b171e5aab5b91eef93dd7e1b23eadcf3187b261d28e602db1c1e14fcfe7a00744b919da8e43bbb0fc2
TLSH
T18D31747399945F32BC86A5053481FFC79FB054B692418E80B3DD871C12D75CC522BC32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5132_239014974\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-87-0x00007FFB8C4F0000-0x00007FFB8C4F1000-memory.dmp

Download

memory/1520-19-0x00007FFB8C4F0000-0x00007FFB8C4F1000-memory.dmp

Download

memory/3836-214-0x00007FFB8CC10000-0x00007FFB8CC11000-memory.dmp

Download

memory/3836-215-0x00007FFB8C130000-0x00007FFB8C131000-memory.dmp

Download

memory/4672-247-0x0000026E2D750000-0x0000026E2D751000-memory.dmp

Download

memory/4672-246-0x0000026E2D750000-0x0000026E2D751000-memory.dmp

Download

memory/4672-250-0x0000026E2D750000-0x0000026E2D751000-memory.dmp

Download

memory/4672-249-0x0000026E2D750000-0x0000026E2D751000-memory.dmp

Download

memory/4672-251-0x0000026E2D750000-0x0000026E2D751000-memory.dmp

Download

memory/4672-248-0x0000026E2D750000-0x0000026E2D751000-memory.dmp

Download

memory/4672-242-0x0000026E2D750000-0x0000026E2D751000-memory.dmp

Download

memory/4672-240-0x0000026E2D750000-0x0000026E2D751000-memory.dmp

Download