42d492e47145661d509778cc48c15cc91e1dbb8b56e113393a613f671ca5bb03

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RyuuManifestToolV2.exe
Size 5.6MB
Sample260804-bfzmssek2v
SHA256 42d492e47145661d509778cc48c15cc91e1dbb8b56e113393a613f671ca5bb03
MD5 755484b1c80453fa1520f2b222586763
SHA1 aa295a154c2e92159dd277e49416a68ca082e123
SHA512 aab49f590ded3c989fee670698da7a0220a2da292ef425756cd87643266d9acf34dea2c5b08260ab7bc4744133cd0d3f4c0a9031204c554d582396719799bbf5
SSDEEP 98304:bWW2vSC8I5H+1/ffixrk/sHOLfPdTDUxr2nTuP28K6QOr:yd+1/0dkuP20Q
TLSH
T17E466C03F78581E9C0AEC078C35BA637EB72BC894525B29F1BE44B612E16F606F1D359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RyuuManifestToolV2.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 60 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5796	tasklist.exe
2000	tasklist.exe
5968	tasklist.exe
4864	tasklist.exe
4748	tasklist.exe
2400	tasklist.exe
2936	tasklist.exe
4284	tasklist.exe
6064	tasklist.exe
2528	tasklist.exe
3144	tasklist.exe
3240	tasklist.exe
3396	tasklist.exe
4896	tasklist.exe
5948	tasklist.exe
1984	tasklist.exe
5716	tasklist.exe
3712	tasklist.exe
2900	tasklist.exe
6116	tasklist.exe
5064	tasklist.exe
5064	tasklist.exe
5620	tasklist.exe
3372	tasklist.exe
3936	tasklist.exe
1204	tasklist.exe
2884	tasklist.exe
3952	tasklist.exe
1688	tasklist.exe
1848	tasklist.exe
5384	tasklist.exe
5660	tasklist.exe
5912	tasklist.exe
3136	tasklist.exe
928	tasklist.exe
3412	tasklist.exe
4896	tasklist.exe
1540	tasklist.exe
104	tasklist.exe
1692	tasklist.exe
5588	tasklist.exe
4224	tasklist.exe
5300	tasklist.exe
5216	tasklist.exe
2100	tasklist.exe
4212	tasklist.exe
5928	tasklist.exe
4136	tasklist.exe
1276	tasklist.exe
4120	tasklist.exe
3124	tasklist.exe
5292	tasklist.exe
2072	tasklist.exe
660	tasklist.exe
2920	tasklist.exe
1812	tasklist.exe
5668	tasklist.exe
3724	tasklist.exe
1832	tasklist.exe
2644	tasklist.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1714099735\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1929837639\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1786811609\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1786811609\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1786811609\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1714099735\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1714099735\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1929837639\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1929837639\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302791665821365"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	msedgewebview2.exe
3184	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5380	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	6116	tasklist.exe
Token: SeDebugPrivilege	1832	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	5620	tasklist.exe
Token: SeDebugPrivilege	5968	tasklist.exe
Token: SeDebugPrivilege	5216	tasklist.exe
Token: SeDebugPrivilege	1276	tasklist.exe
Token: SeDebugPrivilege	2644	tasklist.exe
Token: SeDebugPrivilege	2936	tasklist.exe
Token: SeDebugPrivilege	3372	tasklist.exe
Token: SeDebugPrivilege	2920	tasklist.exe
Token: SeDebugPrivilege	2100	tasklist.exe
Token: SeDebugPrivilege	5384	tasklist.exe
Token: SeDebugPrivilege	4120	tasklist.exe
Token: SeDebugPrivilege	4896	tasklist.exe
Token: SeDebugPrivilege	4284	tasklist.exe
Token: SeDebugPrivilege	4212	tasklist.exe
Token: SeDebugPrivilege	3144	tasklist.exe
Token: SeDebugPrivilege	3936	tasklist.exe
Token: SeDebugPrivilege	3240	tasklist.exe
Token: SeDebugPrivilege	1204	tasklist.exe
Token: SeDebugPrivilege	1540	tasklist.exe
Token: SeDebugPrivilege	5064	tasklist.exe
Token: SeDebugPrivilege	3136	tasklist.exe
Token: SeDebugPrivilege	2900	tasklist.exe
Token: SeDebugPrivilege	2884	tasklist.exe
Token: SeDebugPrivilege	5300	tasklist.exe
Token: SeDebugPrivilege	5660	tasklist.exe
Token: SeDebugPrivilege	4864	tasklist.exe
Token: SeDebugPrivilege	1812	tasklist.exe
Token: SeDebugPrivilege	104	tasklist.exe
Token: SeDebugPrivilege	5668	tasklist.exe
Token: SeDebugPrivilege	5928	tasklist.exe
Token: SeDebugPrivilege	6064	tasklist.exe
Token: SeDebugPrivilege	5796	tasklist.exe
Token: SeDebugPrivilege	928	tasklist.exe
Token: SeDebugPrivilege	5912	tasklist.exe
Token: SeDebugPrivilege	3396	tasklist.exe
Token: SeDebugPrivilege	4896	tasklist.exe
Token: SeDebugPrivilege	3124	tasklist.exe
Token: SeDebugPrivilege	3412	tasklist.exe
Token: SeDebugPrivilege	3952	tasklist.exe
Token: SeDebugPrivilege	4136	tasklist.exe
Token: SeDebugPrivilege	5948	tasklist.exe
Token: SeDebugPrivilege	1984	tasklist.exe
Token: SeDebugPrivilege	3724	tasklist.exe
Token: SeDebugPrivilege	5064	tasklist.exe
Token: SeDebugPrivilege	5716	tasklist.exe
Token: SeDebugPrivilege	1688	tasklist.exe
Token: SeDebugPrivilege	1692	tasklist.exe
Token: SeDebugPrivilege	5292	tasklist.exe
Token: SeDebugPrivilege	5588	tasklist.exe
Token: SeDebugPrivilege	2072	tasklist.exe
Token: SeDebugPrivilege	2528	tasklist.exe
Token: SeDebugPrivilege	4748	tasklist.exe
Token: SeDebugPrivilege	660	tasklist.exe
Token: SeDebugPrivilege	1848	tasklist.exe
Token: SeDebugPrivilege	3712	tasklist.exe
Token: SeDebugPrivilege	4224	tasklist.exe
Token: SeDebugPrivilege	2000	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3560	RyuuManifestToolV2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 5380	3560	RyuuManifestToolV2.exe	80
PID 5380 wrote to memory of 1996	5380	msedgewebview2.exe	81
PID 5380 wrote to memory of 5284	5380	msedgewebview2.exe	82
PID 5380 wrote to memory of 5284	5380	msedgewebview2.exe	82
PID 5380 wrote to memory of 5284	5380	msedgewebview2.exe	82
PID 5380 wrote to memory of 4204	5380	msedgewebview2.exe	83
PID 5380 wrote to memory of 5728	5380	msedgewebview2.exe	84
PID 5380 wrote to memory of 5728	5380	msedgewebview2.exe	84
PID 5380 wrote to memory of 4908	5380	msedgewebview2.exe	85
PID 5380 wrote to memory of 4908	5380	msedgewebview2.exe	85
PID 5380 wrote to memory of 4908	5380	msedgewebview2.exe	85
PID 3560 wrote to memory of 3232	3560	RyuuManifestToolV2.exe	86
PID 3560 wrote to memory of 6116	3560	RyuuManifestToolV2.exe	87
PID 3560 wrote to memory of 1832	3560	RyuuManifestToolV2.exe	88
PID 3560 wrote to memory of 2400	3560	RyuuManifestToolV2.exe	93
PID 3560 wrote to memory of 5620	3560	RyuuManifestToolV2.exe	94
PID 3560 wrote to memory of 5968	3560	RyuuManifestToolV2.exe	97
PID 3560 wrote to memory of 5216	3560	RyuuManifestToolV2.exe	98
PID 3560 wrote to memory of 1276	3560	RyuuManifestToolV2.exe	101
PID 3560 wrote to memory of 2644	3560	RyuuManifestToolV2.exe	102
PID 3560 wrote to memory of 3372	3560	RyuuManifestToolV2.exe	105
PID 3560 wrote to memory of 2936	3560	RyuuManifestToolV2.exe	106
PID 3560 wrote to memory of 2920	3560	RyuuManifestToolV2.exe	109
PID 3560 wrote to memory of 2100	3560	RyuuManifestToolV2.exe	110
PID 3560 wrote to memory of 5384	3560	RyuuManifestToolV2.exe	113
PID 3560 wrote to memory of 4120	3560	RyuuManifestToolV2.exe	114
PID 3560 wrote to memory of 4896	3560	RyuuManifestToolV2.exe	117
PID 3560 wrote to memory of 4284	3560	RyuuManifestToolV2.exe	118
PID 3560 wrote to memory of 4212	3560	RyuuManifestToolV2.exe	121
PID 3560 wrote to memory of 3144	3560	RyuuManifestToolV2.exe	122
PID 3560 wrote to memory of 3240	3560	RyuuManifestToolV2.exe	125
PID 3560 wrote to memory of 3936	3560	RyuuManifestToolV2.exe	126
PID 3560 wrote to memory of 1204	3560	RyuuManifestToolV2.exe	129
PID 3560 wrote to memory of 1540	3560	RyuuManifestToolV2.exe	130
PID 3560 wrote to memory of 3136	3560	RyuuManifestToolV2.exe	133
PID 3560 wrote to memory of 5064	3560	RyuuManifestToolV2.exe	134
PID 3560 wrote to memory of 2884	3560	RyuuManifestToolV2.exe	138
PID 3560 wrote to memory of 2900	3560	RyuuManifestToolV2.exe	139
PID 3560 wrote to memory of 5300	3560	RyuuManifestToolV2.exe	142
PID 3560 wrote to memory of 5660	3560	RyuuManifestToolV2.exe	143
PID 3560 wrote to memory of 4864	3560	RyuuManifestToolV2.exe	146
PID 3560 wrote to memory of 1812	3560	RyuuManifestToolV2.exe	147
PID 3560 wrote to memory of 104	3560	RyuuManifestToolV2.exe	150
PID 3560 wrote to memory of 5668	3560	RyuuManifestToolV2.exe	151
PID 5380 wrote to memory of 4220	5380	msedgewebview2.exe	154
PID 5380 wrote to memory of 4220	5380	msedgewebview2.exe	154
PID 3560 wrote to memory of 5928	3560	RyuuManifestToolV2.exe	155
PID 3560 wrote to memory of 6064	3560	RyuuManifestToolV2.exe	156
PID 3560 wrote to memory of 5796	3560	RyuuManifestToolV2.exe	159
PID 3560 wrote to memory of 928	3560	RyuuManifestToolV2.exe	160
PID 3560 wrote to memory of 5912	3560	RyuuManifestToolV2.exe	163
PID 3560 wrote to memory of 3396	3560	RyuuManifestToolV2.exe	164
PID 3560 wrote to memory of 4896	3560	RyuuManifestToolV2.exe	167
PID 3560 wrote to memory of 3124	3560	RyuuManifestToolV2.exe	168
PID 5380 wrote to memory of 4644	5380	msedgewebview2.exe	171
PID 5380 wrote to memory of 4644	5380	msedgewebview2.exe	171
PID 3560 wrote to memory of 3952	3560	RyuuManifestToolV2.exe	172
PID 3560 wrote to memory of 3412	3560	RyuuManifestToolV2.exe	173
PID 3560 wrote to memory of 5948	3560	RyuuManifestToolV2.exe	176
PID 3560 wrote to memory of 4136	3560	RyuuManifestToolV2.exe	177
PID 3560 wrote to memory of 1984	3560	RyuuManifestToolV2.exe	180
PID 3560 wrote to memory of 3724	3560	RyuuManifestToolV2.exe	181
PID 3560 wrote to memory of 5716	3560	RyuuManifestToolV2.exe	184
PID 3560 wrote to memory of 5064	3560	RyuuManifestToolV2.exe	185

C:\Users\Admin\AppData\Local\Temp\RyuuManifestToolV2.exe
"C:\Users\Admin\AppData\Local\Temp\RyuuManifestToolV2.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=RyuuManifestToolV2.exe --webview-exe-version=1.3.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3560.2432.4977196033542921714
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffa3944b078,0x7ffa3944b084,0x7ffa3944b090
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView" --webview-exe-name=RyuuManifestToolV2.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1668,i,6861984085982870174,11996686655518120692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:2
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView" --webview-exe-name=RyuuManifestToolV2.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1380,i,6861984085982870174,11996686655518120692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView" --webview-exe-name=RyuuManifestToolV2.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2256,i,6861984085982870174,11996686655518120692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView" --webview-exe-name=RyuuManifestToolV2.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3500,i,6861984085982870174,11996686655518120692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView" --webview-exe-name=RyuuManifestToolV2.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4348,i,6861984085982870174,11996686655518120692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView" --webview-exe-name=RyuuManifestToolV2.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2140,i,6861984085982870174,11996686655518120692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView" --webview-exe-name=RyuuManifestToolV2.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=752,i,6861984085982870174,11996686655518120692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView" --webview-exe-name=RyuuManifestToolV2.exe --webview-exe-version=1.3.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4256,i,6861984085982870174,11996686655518120692,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
    3⤵
    PID:1700
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam /v InstallPath
  2⤵
  PID:3232
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6116
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1832
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5620
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5968
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5216
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3372
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5384
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4120
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3240
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3936
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5300
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5660
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:104
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5668
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5928
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6064
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5912
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3124
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4136
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3724
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5716
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5292
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5588
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:660
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4224
- C:\Windows\system32\tasklist.exe
  "tasklist" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\CertificateRevocation\6498.2025.9.4\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6378502bec6d2ad5a506dbd3eeb616f934304184d578bf7380ae6f03432fd4cd
MD5 5a6959951c03c86c71ae0f1f0a72e05b
SHA1 9078e8fe9db71b57e033e0bc8bcb1395650547f2
SHA512 4355ad805b21f695f1951035a878e8ac7a6095348d630b89efca490d253350b47c2daccf3f69c99c6b313ab17de629e645bc8930b67058c7d6dd663eeec58377
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3a22b2c7bad0802a13debc6268bc2fc3e800fe431b9bc27e97191f35fead6896
MD5 e48a64860398869d6e14280b9cd7e6ff
SHA1 a2d921c84165a87a2a038b74485b3ac38bcde38b
SHA512 d2cda0076d20efe46be47474824048b08ece7470fb8fe485fa2f092a9e71ecaface56707a70d617a01a0e5e94ea31f5c3aa2093e23bff92c08c43bc21a4f65eb
TLSH
T1D1D01232B24115B4C41821330943610D0400D10BC089C6005829951D1F040A049064A1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 52413c551dbec1f2dd36b027a502d8e6c12494bc1acef51d81bc3c5af6356578
MD5 e1df64fcf991879fda00bca30c54d86b
SHA1 fbcbaccfe934ebe17bf32dba69172911621647f0
SHA512 d3594e50f1e694e6160d7e0b59e7a8f7978825a02fc1a8991c5e1be785d7a85f1554736045c6695a43811d97841b5b594d685bea663fbe796f26e99020930d47
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3db517aac90f61fc1f71addd3952a883e11741106a59e10178c1cfbba45c56f4
MD5 bdaeba9b9742f1890e5921e061c38c5c
SHA1 14be7ba815507f958a6f497ff212b8133c650182
SHA512 76a4364f497f5879661eb6308b79765cfd57769cedf736d8394a65465657840c7eb7975a935040aec8676e1be4e9a91567c5d2a6b1e915d8549e11c5d6484162
TLSH
T1B6A002A503C91FDBC2149B7034D5028872F0891543171A9581D52E77A9D534DC305831
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59913a.TMP

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\Network\Network Persistent State~RFe59913a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\Preferences
Size 6KB
SHA256 ecf6122bdddb51500add1dee19b12aa904b597487538a1329b6d02ce3575c117
MD5 b20f7b54fa31d0603b2838dc44ecdebe
SHA1 2f884513ecfef99b8edf8c6e0bfcd3b96d329532
SHA512 deca0fad46a3c8815cf49031cbbdfb0d603eb37221713613057c1e63898b0e71a618ed35ce13501917805c317f97052c3ed614e053c1aa52d41aeb41a5a650a1
SSDEEP 96:stc05Gtkfb9mvQ4ffQZ8i0vhErktxm/7qx+WVHMSm+uecJGN1idQjC+g8EqMOB:stc0Mo4fYZ8paGU/S+WiTGNwdjTqMC
TLSH
T1EAE1A8029E6879774CC7F6197A35BF52E2F6106261D50E98EBFCC61C05E66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

fcee7ceb-d223-48f1-90a9-63d9a4469d9a.tmp

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Default\fcee7ceb-d223-48f1-90a9-63d9a4469d9a.tmp
Size 6KB
SHA256 bacddafa68eae97258fb004b5250b5a80b8536ddb4e20ccc27602aabef0ae50a
MD5 08f4d9dd31d416cc8b158d8a32517b58
SHA1 5624e91ff09e7a76e6d23262e060a02892a72352
SHA512 b0302b32c03e865530d2402424d286a2a46e0ce4a08daf3afae41c0ade00743f1e807d499eb9bf338bfd6c9a86663d35de6a7c129524c845217f8c87d7059f6f
SSDEEP 96:stc05Gtkfb9m3ffQZ8i0vhErktxm/7qx+WVHMSm+uecJGN1idQjC+gu3SqMEB:stc0MHfYZ8paGU/S+WiTGNwdjVqM8
TLSH
T197D198029E7879774CC7E61A7E35BB52D2FA106161D40E98EBFCC51C05EA6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Local State
Size 1KB
SHA256 c4aaee09d19d6255190db5547e9a17e22e164d5a4459334b0b4e0263b42e1e8a
MD5 a48ef30cbf883731e206eab5e1da5e35
SHA1 e508f3dce75a275bafb8a7c3cf2a770cfcad640d
SHA512 0bd736a11bbd15f33b00e0955a849d8d5ff7a9ec7548ccdcd451fc0319d492b35bcbd791ae7a860623c686f3eedfba855d7a5bf4a5514d1b31e0f3c94e9a6295
TLSH
T190318771F8541F7558436182A746BB876E31116E81104E98D4DC4F2C02EF28DD325E33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Local State
Size 2KB
SHA256 384652e76e4bd6d174d7c83048d81ea534324f071a905b2402f432c4fe753f8d
MD5 7b4a54cbc6cc2dd5b8aa8ec4fc2a2041
SHA1 167b595f7b63d91284d5300bcc114fb4cbf430c4
SHA512 5a06e5329b6043eacb662dda001b6eba124bcbf10139a66a5274dc509eb06b781d4dfa3816e0f40fd48ed0bb68e882aa6b5052fd2e8fd93d64733739b0c03cd2
TLSH
T16A51D732FC48AF7B88A35545BA493F139A3211A996652FA4D9EC1F1C02DF29C5302E37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Local State
Size 3KB
SHA256 bbb714f47fcc1f4432c09d881dbf06d5d8a025b2780c41816e0bd2eb0cb13e4d
MD5 361a7fe8337601e7732931076008ca9c
SHA1 a2cb47793b00c6724bd29330c119c82f6c0e3ee5
SHA512 0aedc78e01a8718c459350295e4f0c1d8f4dad63b8d790858de8b2c0071fe80c18d383f65cbae6c7363a038c424865675910a22d8211f18c34cac41294241412
TLSH
T1AD71A636B964AA3B4DB39941B9853B06B661113BD5943FE8D9EC0F1C02DB3C81341D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Local State
Size 16KB
SHA256 5dae32670a6bf9184591057c956b3d4b7448e18dbf2ee545fed2606fa3ee37a3
MD5 bac0a899205e02c04d32809652aca4d5
SHA1 6188a7cf937140ede2b31ffc63d569fa161b99ad
SHA512 63a23c3abe5166b3be341d777eeba025d2302091dcbf08dd42ea72872cb90b26d79b663ef0ac082787e82c3f89eaaed82091895077a61765c8cd82ffb170ab2e
SSDEEP 384:zS+aQikB+z/xvxjg/qhEbNbz31KhooB2UkT9zy:h/UxvxjgC+PqB2UeFy
TLSH
T123728D3AA5697F2754F3E5057A4D0B4BDBB598A680C16FB889ED6F0D039B3D80302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Local State
Size 16KB
SHA256 310d578a0e5d49574d3e6560b23f84d70f6b4c25827c0c4a7a2cf2121da11aef
MD5 b81e4aeb51e60363a0ff6dd07b117e2d
SHA1 e5394399ab8075f830f93cee559313c122b49745
SHA512 fe8430689cf9deca5edaf19468624ca094d47946b35f77863e009023379a2442fe2cefb28cbd55bc4354b97acb58abf629b40cc6e9f63880e3416b01bed03989
SSDEEP 384:zE+aQikB+z/xvxjg/qhEbNbz31KhooB2UkT9zy://UxvxjgC+PqB2UeFy
TLSH
T116729D3AA5697F3354F3E5057A5D0B4BDBB598A690C12FB889ED6F0D039B3D80302E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe586a9c.TMP

Path C:\Users\Admin\AppData\Local\com.ryuu.manifest-tool\EBWebView\Local State~RFe586a9c.TMP
Size 1KB
SHA256 ea51153059153ea98666fd1f3226030e35290956f17991723e9ec1989b28adec
MD5 06f83414f4c9da360ce69e0bec913c4b
SHA1 b19e66b7afd7bb680343ef49f2796fe3a71a0e6f
SHA512 06300cd4cb182ad1379d977c03a73205f75710ba6c980b7988916abffc3f00d5fbfeca85ccd2382419e359fccb6da1b9e18adc57d1c44709c602837514746153
TLSH
T1C8218475E8986F7A98426082A642FBCB2E6111BE51248B5CD4DC5F2D03EF5DDC322E33
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1714099735\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1786811609\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5380_1929837639\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3184-343-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/3184-345-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/3184-344-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/3184-349-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/3184-355-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/3184-354-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/3184-353-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/3184-352-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/3184-351-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/3184-350-0x00000164ECC80000-0x00000164ECC81000-memory.dmp

Download

memory/4908-139-0x00007FFA485D0000-0x00007FFA485D1000-memory.dmp

Download

memory/5284-24-0x00007FFA485D0000-0x00007FFA485D1000-memory.dmp

Download

memory/5380-201-0x000001DB656E0000-0x000001DB666E0000-memory.dmp

Download