efb020c1d7efe57e4dcafb1adce0fb719b5adeeb6054b30d98db4bca0a16dc6d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BetterTwttr_1.0.1_x64-setup.exe
Size 7.6MB
Sample260928-hdan8axcpg
SHA256 efb020c1d7efe57e4dcafb1adce0fb719b5adeeb6054b30d98db4bca0a16dc6d
MD5 b438025ed2ddce1774f0f9d96a26f104
SHA1 1cabb7170b8249812a3c5ffc50b896a9dd7741d7
SHA512 427bf6ecadeee654ed3b1acf242c3ba01425964aed0faa96888b3485e5ff26bc24d3be62f7c4cae7391b9b38859a75687a804d5c0b6f54b461ec132096259b3d
SSDEEP 196608:rxwGrFVw9SZfRb1o++DQzusD9BL6NY779xkavToxCtunRu26j:rxfrFTZfl1VWQysDvLX79xkiEtncl
TLSH
T175863300716D6ABAD40B7FBC558A990BBC674B212949EB49438867768CCBCFBD8730C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3512	better-twttr.exe

Loads dropped DLL 5 IoCs

pid	Process
2368	BetterTwttr_1.0.1_x64-setup.exe
2368	BetterTwttr_1.0.1_x64-setup.exe
2368	BetterTwttr_1.0.1_x64-setup.exe
2368	BetterTwttr_1.0.1_x64-setup.exe
2368	BetterTwttr_1.0.1_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	better-twttr.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_137658116\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_151478642\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_137658116\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_151478642\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_151478642\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_151478642\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_151478642\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_137658116\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_435586861\Part-NL	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	better-twttr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	better-twttr.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BetterTwttr_1.0.1_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{3727126B-8745-404E-B8C2-FF97A7079064}	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2368	BetterTwttr_1.0.1_x64-setup.exe
2368	BetterTwttr_1.0.1_x64-setup.exe
3748	msedgewebview2.exe
3748	msedgewebview2.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4732	msedgewebview2.exe
4732	msedgewebview2.exe
4732	msedgewebview2.exe
4732	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	2368	BetterTwttr_1.0.1_x64-setup.exe
Token: SeImpersonatePrivilege	2368	BetterTwttr_1.0.1_x64-setup.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4732	3512	better-twttr.exe	93
PID 4732 wrote to memory of 4696	4732	msedgewebview2.exe	94
PID 4732 wrote to memory of 5800	4732	msedgewebview2.exe	95
PID 4732 wrote to memory of 5800	4732	msedgewebview2.exe	95
PID 4732 wrote to memory of 5800	4732	msedgewebview2.exe	95
PID 4732 wrote to memory of 5800	4732	msedgewebview2.exe	95
PID 4732 wrote to memory of 3204	4732	msedgewebview2.exe	96
PID 4732 wrote to memory of 3872	4732	msedgewebview2.exe	97
PID 4732 wrote to memory of 3872	4732	msedgewebview2.exe	97
PID 4732 wrote to memory of 3872	4732	msedgewebview2.exe	97
PID 4732 wrote to memory of 1456	4732	msedgewebview2.exe	98
PID 4732 wrote to memory of 1456	4732	msedgewebview2.exe	98
PID 4732 wrote to memory of 1456	4732	msedgewebview2.exe	98
PID 4732 wrote to memory of 1456	4732	msedgewebview2.exe	98
PID 4732 wrote to memory of 1456	4732	msedgewebview2.exe	98
PID 4732 wrote to memory of 3424	4732	msedgewebview2.exe	99
PID 4732 wrote to memory of 3424	4732	msedgewebview2.exe	99
PID 4732 wrote to memory of 3424	4732	msedgewebview2.exe	99
PID 4732 wrote to memory of 3424	4732	msedgewebview2.exe	99
PID 4732 wrote to memory of 3424	4732	msedgewebview2.exe	99
PID 4732 wrote to memory of 4212	4732	msedgewebview2.exe	100
PID 4732 wrote to memory of 4212	4732	msedgewebview2.exe	100
PID 4732 wrote to memory of 4212	4732	msedgewebview2.exe	100
PID 4732 wrote to memory of 4212	4732	msedgewebview2.exe	100
PID 4732 wrote to memory of 4212	4732	msedgewebview2.exe	100
PID 4732 wrote to memory of 5840	4732	msedgewebview2.exe	101
PID 4732 wrote to memory of 5840	4732	msedgewebview2.exe	101
PID 4732 wrote to memory of 5840	4732	msedgewebview2.exe	101
PID 4732 wrote to memory of 3456	4732	msedgewebview2.exe	102
PID 4732 wrote to memory of 3440	4732	msedgewebview2.exe	103
PID 4732 wrote to memory of 3440	4732	msedgewebview2.exe	103
PID 4732 wrote to memory of 3440	4732	msedgewebview2.exe	103
PID 4732 wrote to memory of 3440	4732	msedgewebview2.exe	103
PID 4732 wrote to memory of 3440	4732	msedgewebview2.exe	103
PID 4732 wrote to memory of 4956	4732	msedgewebview2.exe	107
PID 4732 wrote to memory of 4956	4732	msedgewebview2.exe	107
PID 4732 wrote to memory of 4956	4732	msedgewebview2.exe	107
PID 4732 wrote to memory of 1276	4732	msedgewebview2.exe	108
PID 4732 wrote to memory of 1276	4732	msedgewebview2.exe	108
PID 4732 wrote to memory of 1276	4732	msedgewebview2.exe	108
PID 4732 wrote to memory of 3748	4732	msedgewebview2.exe	109
PID 4732 wrote to memory of 4356	4732	msedgewebview2.exe	110
PID 4732 wrote to memory of 4356	4732	msedgewebview2.exe	110
PID 4732 wrote to memory of 4356	4732	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\BetterTwttr_1.0.1_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\BetterTwttr_1.0.1_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368
- C:\Users\Admin\AppData\Local\Better Twttr\better-twttr.exe
  "C:\Users\Admin\AppData\Local\Better Twttr\better-twttr.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3512.4264.1310148273032763938 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView /prefetch:4 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffc529c5fd8,0x7ffc529c5fe4,0x7ffc529c5ff0
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2444 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3452 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849 /prefetch:1
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4060 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849 /prefetch:1
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4184 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849 /prefetch:1
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5008 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4972 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
      4⤵
      Modifies registry class
      PID:3456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5044 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849 /prefetch:1
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4864 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4924 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5236 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3748
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView" --webview-exe-name=better-twttr.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2904 --field-trial-handle=1740,i,3322250443836854402,16473872610038629064,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:8cac433c781cb9ff3a2ac350e689f11885706849
      4⤵
      PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

better-twttr.exe

Path C:\Users\Admin\AppData\Local\Better Twttr\better-twttr.exe
Size 21.2MB
SHA256 98d1a6f42bad1ad906ead937326d5a16dfd2b90a1549b118a1ad655576fae89a
MD5 a54b5132d261d0f03163a1f570bd3f6b
SHA1 f56859af6eed067ef7799dbbc18e582f79d66e0c
SHA512 1f4f497251aaed37b26bd0a97957b68bc1f658e98f31e2cfb2e921f057e63863d2aaedfb120668cd562cd69d71543de003217f49984da15b0f21ba2a8a857696
SSDEEP 393216:BboS6T70xP6ZcV6YzHmVC0TGVLqZNFmtoqn:BboS6T70xP6ZcV6YzHkv4LYqn
TLSH
T1EB2718257A5A996CD09BC474834B8A724A3130DB0B35B9FF449496393F7EBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6b71943cb6c85403164b6ee6f594cda1ab12f64fbb88bf92013707959320048b
MD5 e93b12a757a5b4448769077e6d7567f4
SHA1 db180f8ca597fb869e9b45ee46ec574f687705be
SHA512 55f7c716fe197d019c3d950d2cd590d5dc280bbfc9fc1e39811d0ee6fa971d2bf344bb3458dde2e4f5f168d31eaf73b0e1db8320f7fb9b06b21a8d2aa4077cbb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 93099625084653f3c293114983ce5a442cfa3de63ad500ed92750d7d59852c94
MD5 3e0c3eb22d9609b276cc7e6dce40873d
SHA1 6b2cc5778ff250c272f718de01098d42dd5a33a8
SHA512 ba2d6742b06fb2c912ff142ea18f5206454b9ff44b46064e2ca1d126bce0f552a7542ae6786e9d9927e45d68d32509761c7cf7a91bc1e1a588f86cb8efcec08a
TLSH
T15AD0122233210134C010217300C2B5491802C20F444580CCA43C991D1E044540913841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

6a35d429-61b6-435a-9607-2862e3acf5ac.tmp

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\6a35d429-61b6-435a-9607-2862e3acf5ac.tmp
Size 6KB
SHA256 f6dc9e515aee02358b246a96fedf1eabe492a8f8bd421f275395b14dcc0c7781
MD5 e9cbee53717a01566311a6ec6635e4f7
SHA1 383b6825edb177734a2709287f4ab0b8f3f0c997
SHA512 65a8671e46a14c6490f0e347a5512240519de1098f3bd5c54eb03260111c1d2231d14dc6bc5fe2fc7915780ae1ce6d0b0933be87eaa27f9a9ac3d536d9f471d4
SSDEEP 96:st+/dMqu5mb9Rk4zo5h16Z0hSs7/x+6MhmuecJVL1Ce31efxZe5K+gR+28XM1C7K:stGunOnzonhSsV+FdVLYe3QfxZbb+G6K
TLSH
T1E4D1A5025E68B9BB4CC6E515FA29BA16E3F9507260D51E9CEBFD852C04DAADC2307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 13KB
SHA256 0b80e67902c7bdb1f87d93b0a76ab711b5325a28a88f1394fa69e9a12e202dba
MD5 d3010732dc289d680a70f77eba0d8374
SHA1 eeb383f390949651b6d47424d3506704cd62a725
SHA512 cb62fbfcf8a187ed2b09e847500287bfe8fc34d42e136ed99621ca152eaba9f9fb3e78b08cabe1dbd6ab6d1fed333c16c6119b2df41710b8d60b84e0a32816f9
SSDEEP 192:llXp2Vtlx44cRQznXYNVW8wIh6rUAzNKLzoSHwnq8J1lGOlZ:llXp2VtlLcRQznoNcHovZwnq8HlGk
TLSH
T1CE523A0E86D0142AC7FD953AA0D6A4B6F273759999F74CE1050471FEBEF4710E1C01E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59e8d0.TMP

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e8d0.TMP
Size 48B
SHA256 a52480401922632549e256937775cd6eb623fbb2562ab5e3a9b506eb6ee758f4
MD5 cdbdfff320693b9984e610fe2dc3ee2b
SHA1 3179e00d574de52e0ee2519e6eb8187cb9e3f771
SHA512 6e47188543bee7be3879d5805fbabf437690d85c4cd7f46998ccde2e886ec998a5c4b94039fca8c94b31d5e317b4be832c211976cfcdf859d6a810f6ef652c4f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 7eb3e9d2a8a47068054e6ab7da9766c8234193b507c835e7e432632076ad811e
MD5 9d9fdb5fc88685e6aab6a059444a5a0a
SHA1 37c4263e0341bb5edbf05ae3d0b66ba0939b4ce7
SHA512 77fc53c6753ff3e5859d46752be7002cccbf0315e45d81346d6b24dfbe24ea7763adbc5a70f86e528aa8a2edb9bdf22246420e7c9a9cf587b249e6892325f344
TLSH
T1B551DEF2D7E4063ECD4166F42A296D17CE6E0A2603583AA684C4FF8797F1430F2D095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8b3a.TMP

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Network\Network Persistent State~RFe5a8b3a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 9356c65773315fbfa2a1131fb2b72b7292355ed8c7903ad0b78a46c761976cda
MD5 91d6a3c385425b8dfd7ae10927fecafa
SHA1 e5b318bdb7fc99b43d53c70168fa113042cb290d
SHA512 4797e814c5cb8e585ec6918793dde2eb0729164107d1ad40234984002d29285b6206265a3b804e1d8231e30b5541e9a00e8f5add34d5ee7c604c9400caecf648
TLSH
T13D2191A7867EE437B42D09BB1E05F9056DBAB032464390F6DA57426CB0E09F35613023
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59cccc.TMP

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Network\TransportSecurity~RFe59cccc.TMP
Size 1KB
SHA256 5b68403bbf743ad8b7a23588f0a51072ba44f8db31c1ce126ec161dcad4d30df
MD5 4af76410a4f51a367feef6e99de9d5d9
SHA1 0609073a44ac5430a64a320e2966aec256109838
SHA512 7c3863fcdacc9c563f47f1386ccb92fe6e106b9197038d10efdecd07d67bd7582f77e37e9710efbd5e535aa21c9fbf34fabd0cbd7df470fdda982ee025494432
TLSH
T1A021AFA7857EE437F02C09BA1E05FA052DBAF432564790FBD95B426C70E48B31653022
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 5d69401b90984eab4e65b3e74396ffa01219d769e9e6a71e79e226852cf92e3d
MD5 c64791f91297e1ed3429c20668b9ae17
SHA1 3b512e983dea159b3cfb75278ea5db94ac9cba20
SHA512 f1eb92ead2166d0b1bb8772b21c5fc5ec29d2ed3ed5602595abfce2deafba6433be8960f3a4ceaaa602dbbc34f78856eb9657b84e9f37502e6115f8be4b3b54d
SSDEEP 96:st+/dMq1G5mb9Rk4zo5h16Z0hSs7/x+6MhmuecJVL1Ce31efxZe5K+gk+28XM1CO:stGu9OnzonhSsV+FdVLYe3QfxZbq+G6K
TLSH
T1F5E195025E68B9BB4CC6E519FA29BA16E3F5507261D51E9CEBFD852C04DAADC2303C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Local State
Size 15KB
SHA256 b3a9886344467069a95092c2f7aea99b5a50b80843171a3f1d0fc6690cad95fc
MD5 97ab86e174b4f850de159388678ae5f4
SHA1 42315101a41b2c2a6c5dc8d18fb283637c474239
SHA512 1eb1c256e02768ef8990a2019cddc3fa8ab8359abc12d97e679bea49db303e8528b0e2c53921a7b9acbff3af97e6e63d548f80ece8ce30e5d8acdf6894d2fed3
SSDEEP 384:n+aQikB+z/xvxjg/qhEnhNBS/zlcaW4F69zX:2/UxvxjgC+dP5FX
TLSH
T12A729E3755697D2399F3E505BA4D5B8BCBBD98B394C26EF84ABD4F0906C32E81342C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Local State
Size 2KB
SHA256 fe1b5b4746be9aeaf207df3ab54775a543e710a009fafcead0d9e2ba2cca351f
MD5 22d0599b15f6293ca918548959007fa7
SHA1 a59c0fe93394ecd050e273d455d756bd366db052
SHA512 a01d89de44d658080835873dd0830dfc7419d1a0433038ec7f1e8623d1d91974be6840127a6b56cb8d2436feed1a99c782ebe0c2aeb6e8d5f74ea2214599c5da
TLSH
T1D15195736920EAB7CDB38505B94F3F239B79506299522FD4A6DD0B1C00D756C2302C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Local State
Size 3KB
SHA256 7805a377f0be4113bc5d77977f28f5c032e6159773c6690458037baabf16dcd9
MD5 548261d4b19db446b72b8dbe727af614
SHA1 e21ef2e5b3eb8a97086cead21e77d8bcf147cf27
SHA512 822c41705785e75193d132ff5e7e9589db33540605d9a77eb17d75735501e87b7a43c90399ed80909138ad52b30062e1dab7ea6e1d1f9c0f0346dbc016d4bce6
TLSH
T1946187776970E9678EF3D905F98A2B17A7A95023E8813FD8D6ED0F1C00D76981342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5971ac.TMP

Path C:\Users\Admin\AppData\Local\app.bettertwttr.desktop\EBWebView\Local State~RFe5971ac.TMP
Size 1KB
SHA256 666c99810f9efb40bc8bad660c26b63a1d7703be82759aff0cc1702ed85b316c
MD5 b64d03a1da23148b00b909fc5582e1f5
SHA1 db1793379dcb2c764d26020481c414045d574bae
SHA512 3343528b04c6427516410c44a1582a6293b6406d5b15872b5be75460cf18c2c957e651fa29b6719f824d161238b32689ed2d723cf954c6ea7e08289cc4874d97
TLSH
T18E2195B3E5A05BB3ED97A142B54B7B271F391063C1404F8071DF4B2C10A355DE226C36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1456-153-0x00007FFC73C20000-0x00007FFC73C21000-memory.dmp

Download

memory/3748-952-0x000001A9CB440000-0x000001A9CB441000-memory.dmp

Download

memory/3748-942-0x000001A9CB440000-0x000001A9CB441000-memory.dmp

Download

memory/3748-944-0x000001A9CB440000-0x000001A9CB441000-memory.dmp

Download

memory/3748-948-0x000001A9CB440000-0x000001A9CB441000-memory.dmp

Download

memory/3748-950-0x000001A9CB440000-0x000001A9CB441000-memory.dmp

Download

memory/3748-953-0x000001A9CB440000-0x000001A9CB441000-memory.dmp

Download

memory/3748-949-0x000001A9CB440000-0x000001A9CB441000-memory.dmp

Download

memory/3748-951-0x000001A9CB440000-0x000001A9CB441000-memory.dmp

Download

memory/4956-894-0x00007FFC72B50000-0x00007FFC72B51000-memory.dmp

Download

memory/4956-895-0x00007FFC748E0000-0x00007FFC748E1000-memory.dmp

Download

memory/5800-60-0x00007FFC73C20000-0x00007FFC73C21000-memory.dmp

Download