6b113a59bf495cf9ef44a950993a58f8dabbf70a533c10b814f768db71d0f21d

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Writtt.exe
Size 16.3MB
Sample260813-mltvaaab95
SHA256 6b113a59bf495cf9ef44a950993a58f8dabbf70a533c10b814f768db71d0f21d
MD5 82df134a2dfb16441c0273bfade860ff
SHA1 edc7eae4e066b72d58d26837e088147e07cdc8d5
SHA512 8b699c7671c7de104a1d752fd814b01c774912235e53741852de1151be409e0f33764d25b47a76a21c57a0a327a2c0deea105e6eeddbb9f447ad70f663857d8e
SSDEEP 196608:bTzERo/MZg7ZShYnS3n8uFqyyxqwJM/oDoYOtcWFv57OoJPQAwA8CIYBxdJz3Ftm:bo/g7ZSynYLeJ
TLSH
T128076B47E86511F5C0AAC935C9A6D152BB307C888F2427D77B60FB642F72BD0AEB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Writtt.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1765835763\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1765835763\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1765835763\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_288942146\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_1789974724\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_288942146\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2068_288942146\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4172	msedgewebview2.exe
4172	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2068	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2068	4920	Writtt.exe	89
PID 2068 wrote to memory of 5088	2068	msedgewebview2.exe	90
PID 2068 wrote to memory of 5436	2068	msedgewebview2.exe	91
PID 2068 wrote to memory of 5436	2068	msedgewebview2.exe	91
PID 2068 wrote to memory of 5436	2068	msedgewebview2.exe	91
PID 2068 wrote to memory of 5436	2068	msedgewebview2.exe	91
PID 2068 wrote to memory of 3884	2068	msedgewebview2.exe	92
PID 2068 wrote to memory of 4196	2068	msedgewebview2.exe	93
PID 2068 wrote to memory of 4196	2068	msedgewebview2.exe	93
PID 2068 wrote to memory of 4196	2068	msedgewebview2.exe	93
PID 2068 wrote to memory of 5816	2068	msedgewebview2.exe	94
PID 2068 wrote to memory of 5816	2068	msedgewebview2.exe	94
PID 2068 wrote to memory of 5816	2068	msedgewebview2.exe	94
PID 2068 wrote to memory of 5816	2068	msedgewebview2.exe	94
PID 2068 wrote to memory of 5816	2068	msedgewebview2.exe	94
PID 2068 wrote to memory of 1828	2068	msedgewebview2.exe	98
PID 2068 wrote to memory of 1828	2068	msedgewebview2.exe	98
PID 2068 wrote to memory of 1828	2068	msedgewebview2.exe	98
PID 2068 wrote to memory of 1540	2068	msedgewebview2.exe	99
PID 2068 wrote to memory of 1540	2068	msedgewebview2.exe	99
PID 2068 wrote to memory of 1540	2068	msedgewebview2.exe	99
PID 2068 wrote to memory of 4172	2068	msedgewebview2.exe	100
PID 2068 wrote to memory of 3756	2068	msedgewebview2.exe	101
PID 2068 wrote to memory of 3756	2068	msedgewebview2.exe	101
PID 2068 wrote to memory of 3756	2068	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\Writtt.exe
"C:\Users\Admin\AppData\Local\Temp\Writtt.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Writtt.exe --webview-exe-version=0.1.3 --user-data-dir="C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4920.4092.324029824332152864 /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView /prefetch:4 /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0xa4,0x194,0x7ffe9f1e5fd8,0x7ffe9f1e5fe4,0x7ffe9f1e5ff0
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView" --webview-exe-name=Writtt.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,5228671372719401865,8382279088859450936,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView" --webview-exe-name=Writtt.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1912 --field-trial-handle=1768,i,5228671372719401865,8382279088859450936,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView" --webview-exe-name=Writtt.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1768,i,5228671372719401865,8382279088859450936,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView" --webview-exe-name=Writtt.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3492 --field-trial-handle=1768,i,5228671372719401865,8382279088859450936,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e /prefetch:1
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView" --webview-exe-name=Writtt.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4512 --field-trial-handle=1768,i,5228671372719401865,8382279088859450936,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView" --webview-exe-name=Writtt.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1964 --field-trial-handle=1768,i,5228671372719401865,8382279088859450936,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView" --webview-exe-name=Writtt.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4516 --field-trial-handle=1768,i,5228671372719401865,8382279088859450936,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView" --webview-exe-name=Writtt.exe --webview-exe-version=0.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=1768,i,5228671372719401865,8382279088859450936,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:f13737cac571ab3e35b1429d18f20ba641f4f31e
    3⤵
    PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3ce10a6d4d653c42d904365636dab5dfdeff9f5771936833c916c68822723d4a
MD5 c81c34f837aded7e154ac915a093fd7a
SHA1 f6bd413b0288c1bee6025d7f04c51f8052d7335a
SHA512 ef1d8ed05617e4795b38120a3ad9962b3a621412338930727be3e932f201ac76e27272cf482677183f8af9451d774474cab4d08ced71d65541bfe384828d7a05
TLSH
T119D0121276515634C0203033051361484800DA0F400580015429859E3E180A40D06842
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 206814a53b16f949b5706a079b78ed22c1476a5808329e24fa34e49effe558bf
MD5 0d95ce791d4241eab3ef0aca00c591ea
SHA1 42c060112e29b591bcf150bff901f4958c0334b5
SHA512 7818bba23fd5d01ac88ca5244dfb70cbabf8206a2c2ae218e372e74cc62629b3d9f9ac9d8138316c1cd1dd2973fe94e65e9dab003cdf0635010e628f2a8c5bc5
TLSH
T115D00410D5507510C154303545354140C5045D0410014101015100CD3C551540405401
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

49b9d8fd-633e-4f02-9fd6-962653e7a1e0.tmp

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Default\49b9d8fd-633e-4f02-9fd6-962653e7a1e0.tmp
Size 6KB
SHA256 76cd7f299c7cc855adbd28142894d4ebb2561573c0152cb636ad43d0a0715585
MD5 f16f80c2be6611fa081ae037a8f0c2f4
SHA1 168b5954d0ee244781d986a60a064914f04e9b67
SHA512 b02afed50e092dd2ee6a710efcbff351b871dbfd36911bdd18b463ed0e96b3237916bab49a3556837827f33165e461ddf89cb1217551f29243fc72d92530ee47
SSDEEP 96:stL/dFNSpOmb9Dkwo5h16Z5es7/x+6MhmuecS/r1eje4K+gACoo+28XM1C7K:stTVSFoKesV+F2/rQj8Io+G6K
TLSH
T154D163016E24797B4CC6F11ABB39BA17E3F5503275D51D98EBFC4A2C18DA6CC221790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 9b35381225d33622c66c5994b8056e3573d4af1496517ac1d6d16526894b70fe
MD5 ff70e9926237426ee82ed768ee95cf45
SHA1 87d8da1ff078f4ea878ef20b794711c2986296de
SHA512 5044ba440ec265199c48298ff2995582e89a6e6f94e38a4528f8f70ea37f659184e9b864c6d12a4f556ca17bad32129e07c59de6fd4e6e36b0985d4f525c87da
TLSH
T1C9B0023592061046C31CABB0BBDF5141B1734C3CC7670E1697E45EB9EBEABD0950B240
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594a4e.TMP

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe594a4e.TMP
Size 48B
SHA256 5320631055cb0b32c6a9562d6ef98c3849d7f87f308b1019e30dbb9b781e1d72
MD5 84f912a704a8dbc96004cec12d11b253
SHA1 ef1d06f7d783e7152260bfa15d503b58f27775d3
SHA512 4dbe0ba077a5394b80a4d94539b2e225d49f5b1ef6ffbcb20155cf31412465072440b8de27cf0c6706ed63e86333b635fa3b9f0fc48f0389e63ebf6314b300ac
MD5 SHA1 SHA512

Submit Download

8ee3d675-2b57-4316-aa49-9a5a49d55ce7.tmp

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Default\Network\8ee3d675-2b57-4316-aa49-9a5a49d55ce7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 c60f25af48e2df6fb95450dc220cff58f83167bcbc9df9fdf776762f4713eaff
MD5 fb3591dfa3eb4cd5100530b0a02289b7
SHA1 f1c42f723908648877757c9cd2c0b6de2de67d45
SHA512 db70f903b0fa6cfcdae1af12e05eeff99319700ad6b189de029775655c52b8c78964e107c4a8610c948994ff025e4fb64619bd902dc7f4183b8d6fea051e18f8
TLSH
T187016BB2C2E4C67D8C8113E467247923CD2E051952282E67CDEAFBEA9BE1071DB1060E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a0d40.TMP

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Default\Network\Network Persistent State~RFe5a0d40.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 8b23c5658d71fffbd2421e20cc9e13122d2be2c6ac58bf4e56af6b36f180d6bd
MD5 6b88a15fbae2cf70645ef5728fa52377
SHA1 7d87308da6399ec7ee05267e0cde925d793ab028
SHA512 f8e3e4b1748881783bf06c428e49423d3cc8577baab84b656e54f8f9cd4c9c63f5bb8004dc0d9e7333044d97846219d9e614a1f0dd9e8d0cb5611f453eec737b
SSDEEP 96:stL/dFNSgGOmb9Dkwo5h16Z5es7/x+6MhmuecS/r1eje4K+g3dECc+28XM1C7K:stTV4FoKesV+F2/rQj8y+G6K
TLSH
T18DD163016A24797B8CC7E11ABB397E13E3F5503275D51E98EBFC4A2C18DA6CC221790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Local State
Size 3KB
SHA256 c5f223c021c27d7343504fa1c74c96ca5b3f6e741d76c30a7679fedfb2f41c3a
MD5 0e615e4576ac4200eb5c8427b3e315c2
SHA1 cdede1ec0d3295c4df93298749aee099d3c4334e
SHA512 d695a4092edb779b3150445094eb5941d4c186fbe7a2415d268c6793320867fe6697457d63dda01fde43d8b3de9ac02c329de0b333bdabf4b8198f520d42cb88
TLSH
T1D16184337964AA779EF29A06B9862B23ABA45123E9913F95C9EC0F0C11D32981352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Local State
Size 15KB
SHA256 abcb466b0ef31f7cad4822f71429364eccf5b558d773ab608d7749fd05da9c98
MD5 64d5350f08fa3fe0a48cd13a61da4d6e
SHA1 9348c272e58df2d377b53d01fd416634bdf071c0
SHA512 f4e48e256cd5a452249609c2b61782778306cce7f5df1a5ec6194640894731b8258d383e480e84559c96879c49ed2cc4d7889d0b00afb2cab03c45ae675f5c40
SSDEEP 384:q+aQikB+z/xvxjg/qhEwNBSCruG7dI7k9zG:1/UxvxjgC+WbRI7kFG
TLSH
T19C72AF2B91697E23E5F7EA057A4D0B5BCFB894B251823EB84DFE5F0D16C33940302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Local State
Size 2KB
SHA256 bcafc351d44b99dba2105caba86f15e1ff5d087248a553979271df2481504957
MD5 61189828993c9009404a8351c844e8a5
SHA1 4999dc6338ba63daff0b012eb1fce850d551348e
SHA512 5ba81c376d0b20d74005ace62af95e057ffd8f9e07da7e8154464bbf25e0caea7de03621144e48a5750bcbbd30a34546559bc3327585f753dff7a3ba561eedff
TLSH
T13251657378146B769AF2964ABA4B3E33CF749152AE112F50D9ED0B1C11D755C1312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58f603.TMP

Path C:\Users\Admin\AppData\Roaming\Writtt.exe\EBWebView\Local State~RFe58f603.TMP
Size 1KB
SHA256 40b5c36eaeeec5452c6ede41cdc2ea0008aef27c4b0aabf54ebb542ca234005c
MD5 2c1f87274e1f4126ef7c89b45f4a52ef
SHA1 379e407e14a08177dfb2d6605c5b158082801a7c
SHA512 3ac3b39114051802c5ecb4230dc692c3ae59136d368b93bfd611697bc145fa7a5d428755d373b4ae0c00685ce4bf50625999e9245d6e2808877cb067bb5493b0
TLSH
T19B2165B3F4585BB1FDA2664B72476E778F30512786114F40D5ED8B1C21F345C963A836
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1828-229-0x00007FFEBED40000-0x00007FFEBED41000-memory.dmp

Download

memory/1828-230-0x00007FFEBF790000-0x00007FFEBF791000-memory.dmp

Download

memory/4172-309-0x0000018A6EB10000-0x0000018A6EB11000-memory.dmp

Download

memory/4172-307-0x0000018A6EB10000-0x0000018A6EB11000-memory.dmp

Download

memory/4172-316-0x0000018A6EB10000-0x0000018A6EB11000-memory.dmp

Download

memory/4172-318-0x0000018A6EB10000-0x0000018A6EB11000-memory.dmp

Download

memory/4172-317-0x0000018A6EB10000-0x0000018A6EB11000-memory.dmp

Download

memory/4172-315-0x0000018A6EB10000-0x0000018A6EB11000-memory.dmp

Download

memory/4172-313-0x0000018A6EB10000-0x0000018A6EB11000-memory.dmp

Download

memory/4172-314-0x0000018A6EB10000-0x0000018A6EB11000-memory.dmp

Download

memory/5436-26-0x00007FFEBE820000-0x00007FFEBE821000-memory.dmp

Download

memory/5816-112-0x00007FFEBE820000-0x00007FFEBE821000-memory.dmp

Download