d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Size 2.4MB
Sample260802-trbdfswfna
SHA256 d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353
MD5 a22c05f70efd1adecbefe244606aefd2
SHA1 e9e7e380e9038a29ccc7bc56d6ed77b065b1f0bd
SHA512 92ceba6ddabef17babafa514315c3d8831040e9cc708059ea3d826fe325fe69b0ecb9ba959e12b04dce7f7c61d8fb381e88baeaa855299d598a5756390d79e8a
SSDEEP 49152:QlLEkH4q8hy1JWFeIrk/agsMod2ZPybt+9ZjeWBzNwui0hBdH3B:+4q8hyyCX6WBquTBpR
TLSH
T126C5AE4A63E840E8D077D278CA569617E7F17C121F31CB9F56A19E9A1F333A09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_1422594444\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_541137647\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_541137647\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_251055814\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_1422594444\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_541137647\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_251055814\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_1422594444\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_2067447256\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_251055814\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_1422594444\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_2067447256\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_251055814\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_251055814\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4116_1422594444\crs.pb	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR 压缩文件"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,1"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP 压缩文件"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR 恢复卷"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe,0"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinRAR.exe\" \"%1\""	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5692	msedgewebview2.exe
5692	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4936	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4116	msedgewebview2.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4116	4936	d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe	90
PID 4116 wrote to memory of 2884	4116	msedgewebview2.exe	91
PID 4116 wrote to memory of 5992	4116	msedgewebview2.exe	93
PID 4116 wrote to memory of 5992	4116	msedgewebview2.exe	93
PID 4116 wrote to memory of 5992	4116	msedgewebview2.exe	93
PID 4116 wrote to memory of 5992	4116	msedgewebview2.exe	93
PID 4116 wrote to memory of 5516	4116	msedgewebview2.exe	94
PID 4116 wrote to memory of 3440	4116	msedgewebview2.exe	95
PID 4116 wrote to memory of 3440	4116	msedgewebview2.exe	95
PID 4116 wrote to memory of 3440	4116	msedgewebview2.exe	95
PID 4116 wrote to memory of 2916	4116	msedgewebview2.exe	96
PID 4116 wrote to memory of 2916	4116	msedgewebview2.exe	96
PID 4116 wrote to memory of 2916	4116	msedgewebview2.exe	96
PID 4116 wrote to memory of 2916	4116	msedgewebview2.exe	96
PID 4116 wrote to memory of 2916	4116	msedgewebview2.exe	96
PID 4116 wrote to memory of 1508	4116	msedgewebview2.exe	100
PID 4116 wrote to memory of 1508	4116	msedgewebview2.exe	100
PID 4116 wrote to memory of 1508	4116	msedgewebview2.exe	100
PID 4116 wrote to memory of 1580	4116	msedgewebview2.exe	101
PID 4116 wrote to memory of 1580	4116	msedgewebview2.exe	101
PID 4116 wrote to memory of 1580	4116	msedgewebview2.exe	101
PID 4116 wrote to memory of 2568	4116	msedgewebview2.exe	102
PID 4116 wrote to memory of 2568	4116	msedgewebview2.exe	102
PID 4116 wrote to memory of 2568	4116	msedgewebview2.exe	102
PID 4116 wrote to memory of 5692	4116	msedgewebview2.exe	103
PID 4116 wrote to memory of 564	4116	msedgewebview2.exe	104
PID 4116 wrote to memory of 564	4116	msedgewebview2.exe	104
PID 4116 wrote to memory of 564	4116	msedgewebview2.exe	104

C:\Users\Admin\AppData\Local\Temp\d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe
"C:\Users\Admin\AppData\Local\Temp\d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe"
1⤵
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4936.5756.452583869819035262 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb54775fd8,0x7ffb54775fe4,0x7ffb54775ff0
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,18074769594050416703,18253182147009554380,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1780,i,18074769594050416703,18253182147009554380,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2448 --field-trial-handle=1780,i,18074769594050416703,18253182147009554380,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1780,i,18074769594050416703,18253182147009554380,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4404 --field-trial-handle=1780,i,18074769594050416703,18253182147009554380,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4504 --field-trial-handle=1780,i,18074769594050416703,18253182147009554380,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4400 --field-trial-handle=1780,i,18074769594050416703,18253182147009554380,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4428 --field-trial-handle=1780,i,18074769594050416703,18253182147009554380,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=d2ee726cc805b09d791cf3363605bed07bc31fdbd373a9537cfd9dbe398a3353.exe --webview-exe-version=6.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=1084 --field-trial-handle=1780,i,18074769594050416703,18253182147009554380,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9c86a7accf342da37b1091bdb798813d499af2de5335bd582f3445233ecb05cb
MD5 e5f823ff8d9a5db5905a3b5cd0325968
SHA1 a22a74f7ed59434c8bbfd4fa830a3790ea228577
SHA512 8d1f2903187fbffb62da443e023f87f840c23ee1a81eb904905e5936c87360e9fead6958249370f75ba3e1de4354757ad0cae41604a7af93ee08f84cda64b3e4
TLSH
T178D0121632624138D010303301036D491406C91B42294148643C8A1E5A145500912481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0e7ec13974c27f71b05acddc74304efe3d5e8830bd685a188e06ad915c612a7c
MD5 d75a80a521cb9fa7360054f3b5460cab
SHA1 7dd0114d0abe442436dc0b8f079234453c6e347c
SHA512 0a7d3c6a4f228e3de65c957ecddb736bc4063350c9c0b53670a40074837f9f33355d20ae2f93bea0f806884038960531599d5daae8143317b59a6c10db47980e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

42223952-6d75-4b54-b1fe-f064dbcb531a.tmp

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\42223952-6d75-4b54-b1fe-f064dbcb531a.tmp
Size 6KB
SHA256 9cbeeafa41f9e6089d0a862a6a374af57305d97a3ef0cf321101731a198bbb4e
MD5 64b8cbd635e11efc4607519d3ff7af12
SHA1 fec5f0ca63e536c1652260a63f8b93491b3c26e8
SHA512 46c5ffdc263cfe05f8d0b54b76ea8e56677ae06621e832cf7a27a2b21a4641262d98ab8f72b33918325c39ad113001f179971ab6efc49a151787ea487e2a02be
SSDEEP 96:stO/dIpoo8Ob97ukso5h16Z4cs7/x+6Mhmuec3T51erye+K+gji28XM1C7K:stWSpSmutotcsV+FLT5QryCsG6K
TLSH
T1C7D1A6025E24797B4CCAE119BE29BA12D2F5607274D15D68E7FC462C08EB5DC6307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 009d438ddaa6fb51e16fe0fa70f67cef593ee413edd1dbc2275dc07a699e8e02
MD5 f9c9bbecf965bf2cf35e364c5aaebf24
SHA1 8217e073e33185b0ad4686b58a1c27ba62f21766
SHA512 4e0c4598ea4409598b28477bf505e6eb494967ee96504f937bdf58e0a1b43d9588aaf299f9008d51f302d2ec0432044f65443103671fdde8e89ff050a696107a
TLSH
T18CC09220A8000646C31BA2B055E2A49A36BB1CA6A00FCC800492A171F001B8032000AB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cfc9.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59cfc9.TMP
Size 48B
SHA256 d669a170ea71464c4725c1301edcf8bfa6520ec436cce0976206326b7e20f575
MD5 471a81e72bb6154b19f1f32e4a0135d5
SHA1 49133d16f1cd05a6f90e0e76baf60ff43fdaf4aa
SHA512 6911e20495b7e82d25a27785d86323b3a0fa42798e025138e886d733b72ad3c8120233a3a39f32406971c16cf85df6b0e72aaaca362c431c4017cab06da3c2a4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 489B
SHA256 c35cc25edd8f7fcfc0d717625d4ebf6633eb96ebc2a7f2eadc7db04a84434379
MD5 68da13c8f8d9e960d103c552c4143e45
SHA1 1eaf96c7173e0e87b180e5f566020ddc2fed36f9
SHA512 fcd6b106bb85dbe6e5543ae15c777b0b56d4de255e5f0fd2b9ba7948ad4faec7846c7f5dcd8ca9c9b03512ba622404ea5a4c46e489d83932c244ab945e95761b
TLSH
T1CCF059F282A06AAE9A4196E827286913CE6D0411031C2DB5C9D8BA5783E28A5E21484B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8aec.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a8aec.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 518B
SHA256 94ae46db8543a89db8866ffbec6aa463ae94435679b8fa36f1a577af0540460d
MD5 b9c3cf0620bc185d3f19322a9def84e8
SHA1 61476994f2e620b70969c64178def8226338d10e
SHA512 af51f9a03a2fa21cc1ca9de821fc67b62edbc6b2582126a2788cf636f0c6273a1aa7ad398315c4d3c870b56860b969c4adbbbda3097016c48b97d85b8804cb0e
TLSH
T1AEF059AB507BF4E750394DAB2D447C052D77A4351192A8FCDA938A7EE1444FB576B001
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a5d06.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a5d06.TMP
Size 518B
SHA256 dc03a73bed5f39bf2cf190af6ea275d8c7c93f25cdaf8fd6f6ccfe78b842abed
MD5 e6d1a07241ac16788edb95cc3bc0228a
SHA1 be7a11a7e0ae88b9edb12199fda1111995c59ddc
SHA512 002712e31265e34eda678e9f37e6538dfa14f80ff5f4f26ce690a318723bcdc76334eca749b2c52bfa78a50c3e7cf90967444234303b9de6db6b95f2e1a95d1a
TLSH
T10CF059A7507BF4E7103A4DAB2C447C052977A436115268F8DAA38A7EE0444FB576B011
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 0b321f58118cd73d3bf93a562dd9a1cea2ff242e3a8e7641bf12b433e7fa9296
MD5 c4b3203c7005dbe523a7b6b1fc080f89
SHA1 0e0bf0ec0d36683a7a302149697f734bee939de8
SHA512 905af65bd8c1275ca8ad3158a5aae9ffeb95b84c7166609e624473ff4fbff14937398679be8ac6013bb4204cda39129ab71beaff5494dc6cb5952d291f49573f
SSDEEP 96:stO/dIpofG8Ob97ukso5h16Z4cs7/x+6Mhmuec3T51erye+K+gjb28XM1C7K:stWSp0mutotcsV+FLT5QryCNG6K
TLSH
T191D1A6025E24797B5CCAE119BE29BA22D3F5607265D15E58E7FC462C08EB6DC630380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 27f1866f745a1e384122065f1ef03886909529ea3ff4c3e460cd1eca8a74269a
MD5 d8c07f3e1796b37a46f45a95666b0651
SHA1 e0071e5475a2cd05e7b7658d3e27328fb4763450
SHA512 000506202b5f4380c634d22b30067f9f4e85694372fc132a4ab30ff263ff3783b51bc70c17c996b70850c754c789c37fb1d0dc4443868ebf3905d55f80a60ea7
SSDEEP 384:J+aQikB+z/xvxjg/qhEwNBSPSbIQsub9zV:0/UxvxjgC+HYB1FV
TLSH
T126729E2F59793E27A9F7E508794A075FCABD94B2A0C26AB84FFD5F0906C72D40302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 3c333662dc3b5387ac86f0043a5dbb84fc8e2362d55b47a0a85da3f484cf9b1f
MD5 3d6f726176488e347274ff124650470a
SHA1 64099153af17f5a941b1cdff2815dc56a8dd747d
SHA512 8da0749990e665d84f2ff1f0fceaa6dceba05ca8023b118a00168e17e926933e9d53eb72d34d6cd5a68ba8f3b5162fb6e299383f2c83da9cf38727245532725a
TLSH
T17851977368149F779DE286087E4B3B339D3951969A921F2097ED0F1811D716D1302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 dee270f12d4b787af819d9f7085cac55be126a0484b9215085aafcfd818e7e3b
MD5 a3f4b4ed1b87f74d83e0a41f762f0054
SHA1 4df174b4c7ac09c49145bcef6d8e277486a084e8
SHA512 8639751f001f995341f46d3578643910f47c39f850d0645c457ec49f5e64f801791861220f26e6ac8df1476dadf50c77ad498c0921232124dc74b4e36610148e
TLSH
T12961A43B6974AE3B4DE2DA087D873B26AAA55163E5C13F64D7EC0E1C11D72AC1302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe596f89.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe596f89.TMP
Size 1KB
SHA256 086fec594050608313366f5c3629ead4231057762ba059b6e4a28857ee2f48c5
MD5 86c466689446365a4f4d6cf5fcf24769
SHA1 c1169eb0c14386276a8c23349cd9b3181aa5dcb8
SHA512 a51b61caffbe252248c7e1f07644afce0db60d78354f406ff3330940a71f7e2fb809f319a678305c23f5f2f140bb3d8f105fa97a3acd19c6b24496787c2cd6b6
TLSH
T1C621B4B3E4609F32ACC1A60E36577A6B5D30606B81804F00A3ED8E1C21B70AE9122C36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1508-273-0x00007FFB77400000-0x00007FFB77401000-memory.dmp

Download

memory/1508-274-0x00007FFB76BD0000-0x00007FFB76BD1000-memory.dmp

Download

memory/2916-102-0x00007FFB76580000-0x00007FFB76581000-memory.dmp

Download

memory/2916-208-0x00000287D6000000-0x00000287D6116000-memory.dmp

Download

memory/5692-347-0x000001B7BCD50000-0x000001B7BCD51000-memory.dmp

Download

memory/5692-345-0x000001B7BCD50000-0x000001B7BCD51000-memory.dmp

Download

memory/5692-351-0x000001B7BCD50000-0x000001B7BCD51000-memory.dmp

Download

memory/5692-352-0x000001B7BCD50000-0x000001B7BCD51000-memory.dmp

Download

memory/5692-354-0x000001B7BCD50000-0x000001B7BCD51000-memory.dmp

Download

memory/5692-356-0x000001B7BCD50000-0x000001B7BCD51000-memory.dmp

Download

memory/5692-355-0x000001B7BCD50000-0x000001B7BCD51000-memory.dmp

Download

memory/5692-353-0x000001B7BCD50000-0x000001B7BCD51000-memory.dmp

Download

memory/5992-262-0x0000022A7D490000-0x0000022A7D5A6000-memory.dmp

Download

memory/5992-231-0x0000022A7D490000-0x0000022A7D5A6000-memory.dmp

Download

memory/5992-27-0x00007FFB76580000-0x00007FFB76581000-memory.dmp

Download

memory/5992-207-0x0000022A7D490000-0x0000022A7D5A6000-memory.dmp

Download