Analysis

  • max time kernel
    154s
  • max time network
    199s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/10/2026, 15:20

General

  • Target
    RiftManager.exe
  • Size 333.8MB
  • Sample261022-sqrtdaaf49
  • SHA256 e91f58281bc10df5a9d01f9c09583538c5425df3ab79b95e1c92d19cf05edc55
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in Windows directory 4 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RiftManager.exe
    "C:\Users\Admin\AppData\Local\Temp\RiftManager.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5828
    • C:\Users\Admin\AppData\Local\RiftManager\4.6.10\start_rift.exe
      C:\Users\Admin\AppData\Local\Temp\RiftManager.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Users\Admin\AppData\Local\Temp\RiftManager.exe
        C:\Users\Admin\AppData\Local\Temp\RiftManager.exe web 52328
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Users\Admin\AppData\Local\RiftManager\4.6.10\start_rift.exe
          C:\Users\Admin\AppData\Local\Temp\RiftManager.exe web 52328
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of AdjustPrivilegeToken
          PID:1500
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=start_rift.exe --webview-exe-version=4.6.10.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3024.1980.17243371228574274812 /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:4008
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView /prefetch:4 /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa0a095fd8,0x7ffa0a095fe4,0x7ffa0a095ff0
          4⤵
            PID:3436
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView" --webview-exe-name=start_rift.exe --webview-exe-version=4.6.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,1865322346337903472,15205928531024914438,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838
            4⤵
              PID:4992
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView" --webview-exe-name=start_rift.exe --webview-exe-version=4.6.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1860 --field-trial-handle=1736,i,1865322346337903472,15205928531024914438,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838
              4⤵
                PID:2540
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView" --webview-exe-name=start_rift.exe --webview-exe-version=4.6.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1736,i,1865322346337903472,15205928531024914438,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838
                4⤵
                  PID:5068
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView" --webview-exe-name=start_rift.exe --webview-exe-version=4.6.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3500 --field-trial-handle=1736,i,1865322346337903472,15205928531024914438,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838 /prefetch:1
                  4⤵
                    PID:5048
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView" --webview-exe-name=start_rift.exe --webview-exe-version=4.6.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3912 --field-trial-handle=1736,i,1865322346337903472,15205928531024914438,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838 /prefetch:1
                    4⤵
                      PID:3332
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView" --webview-exe-name=start_rift.exe --webview-exe-version=4.6.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4056 --field-trial-handle=1736,i,1865322346337903472,15205928531024914438,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838 /prefetch:1
                      4⤵
                        PID:5284
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView" --webview-exe-name=start_rift.exe --webview-exe-version=4.6.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=1736,i,1865322346337903472,15205928531024914438,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838
                        4⤵
                          PID:1332
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView" --webview-exe-name=start_rift.exe --webview-exe-version=4.6.10.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1260 --field-trial-handle=1736,i,1865322346337903472,15205928531024914438,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:9406867ef44562a7458a3ff7e9c824bc289ba838
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4588

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        VCRUNTIME140_1.dll

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\VCRUNTIME140_1.dll
                        • Size 48KB
                        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _brotli.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\_brotli.pyd
                        • Size 836KB
                        • SHA256 44f02bcf2b15519a487cf653e16b5f9c65f26d0be559592878988ad47148fc5e
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _bz2.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\_bz2.pyd
                        • Size 85KB
                        • SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _cffi_backend.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\_cffi_backend.pyd
                        • Size 177KB
                        • SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _queue.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\_queue.pyd
                        • Size 35KB
                        • SHA256 2a7bb0a53e86ae4982a6f64e2570137829a0be66537bb1c166913af273edbf0c
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _uuid.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\_uuid.pyd
                        • Size 27KB
                        • SHA256 35f26f7f55ded30da92ed30258fb9624a7398ba3eadee134813133c560fcbbae
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _wmi.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\_wmi.pyd
                        • Size 39KB
                        • SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        orchestrator.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\chardet\pipeline\orchestrator.pyd
                        • Size 10KB
                        • SHA256 a3cfc6f895e5cb8c7505dddda89e18d7d0f4db942748f2d9b2f6d55cf555f8fb
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _rust.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\cryptography\hazmat\bindings\_rust.pyd
                        • Size 8.7MB
                        • SHA256 fe5c4cdb5512f792fb0f5b3ce0cd8c1484614851d56ff5d1e7215213eb9e0bca
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        libcrypto-3.dll

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\libcrypto-3.dll
                        • Size 5.0MB
                        • SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        libffi-8.dll

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\libffi-8.dll
                        • Size 38KB
                        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        libssl-3.dll

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\libssl-3.dll
                        • Size 776KB
                        • SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _psutil_windows.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\psutil\_psutil_windows.pyd
                        • Size 69KB
                        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        select.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\select.pyd
                        • Size 32KB
                        • SHA256 56441c3148743a0890986ccdf93fea8174155b0ee84db2493151f075d8e7c51a
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        unicodedata.pyd

                        • Path C:\Users\Admin\AppData\Local\RIFTMA~1\46818D~1.10\unicodedata.pyd
                        • Size 740KB
                        • SHA256 58013696b4f08717aee2885aefa24031f4b18b3e62faa8125248cc3e0a86af2a
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        qt_en.qm

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\PySide6\translations\qt_en.qm
                        • Size 33B
                        • SHA256 494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf
                        • MD5 SHA1 SHA512

                        QtWebEngineProcess.exe

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\QtWebEngineProcess.exe
                        • Size 755KB
                        • SHA256 aad51e3c4714441c98d850f537a6b0f964e16d4b33a8adf18f49b0e7fb515f99
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        VCRUNTIME140.dll

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\VCRUNTIME140.dll
                        • Size 117KB
                        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _asyncio.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_asyncio.pyd
                        • Size 76KB
                        • SHA256 13b374175108c266f4a5bdf907f990d0ccd5b486d0313856e08a60ba9bf856cf
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _ctypes.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_ctypes.pyd
                        • Size 139KB
                        • SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _decimal.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_decimal.pyd
                        • Size 284KB
                        • SHA256 1f4a8ca9814508d3597992173fdf4db312f3b970f6baeb053b9d8c3087f907e7
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _elementtree.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_elementtree.pyd
                        • Size 135KB
                        • SHA256 557da5278599b51f1c0a53b2ffc617a05a21be23a2a6b862a5b5ce04667c5f70
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _hashlib.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_hashlib.pyd
                        • Size 67KB
                        • SHA256 58c5c9ff93f989e2a233b8c5e06420ea73dd6c013e1f08d996fb0f2828eba0aa
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _lzma.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_lzma.pyd
                        • Size 157KB
                        • SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _multiprocessing.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_multiprocessing.pyd
                        • Size 37KB
                        • SHA256 a88475c4cba47977eef5756c217c79441c53cf57d0b05441de87744313e2898b
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _overlapped.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_overlapped.pyd
                        • Size 56KB
                        • SHA256 43b9e0bdc41646fc363f144bf050600dab647ce9e7c251a2b6d0e75358cb10cf
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _socket.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_socket.pyd
                        • Size 85KB
                        • SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _ssl.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_ssl.pyd
                        • Size 180KB
                        • SHA256 06f51fbe150c831af619890eea2d9fca9ce8b49758bfe3f382883551c592e6b3
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _win32sysloader.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_win32sysloader.pyd
                        • Size 14KB
                        • SHA256 2ce1de2dea3fee1ec8f548860e7f070597d25a31a942212c118c79b16fe74b38
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _zoneinfo.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_zoneinfo.pyd
                        • Size 50KB
                        • SHA256 65fad0efc2524e411c65919288835bb8781926bf9e7a5f92912b6ffa393a226b
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _zstd.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\_zstd.pyd
                        • Size 491KB
                        • SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        _bcrypt.pyd

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\bcrypt\_bcrypt.pyd
                        • Size 298KB
                        • SHA256 898d1fe05e287d66bd379f26eb49d27a260f14666c7dc8b1719dae8c489abff0
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        icudtl.dat

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\icudtl.dat
                        • Size 10.0MB
                        • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        mfc140u.dll

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\mfc140u.dll
                        • Size 5.4MB
                        • SHA256 643ce7fe6a203c53a96a00f272a1a5b42d5b0c320c84364a6fe866307a19bb65
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python3.dll

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\python3.dll
                        • Size 72KB
                        • SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        python314.dll

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\python314.dll
                        • Size 6.5MB
                        • SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        Bamako

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Africa\Bamako
                        • Size 148B
                        • SHA256 d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997
                        • MD5 SHA1 SHA512 TLSH

                        Dar_es_Salaam

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Africa\Dar_es_Salaam
                        • Size 265B
                        • SHA256 c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968
                        • MD5 SHA1 SHA512 TLSH

                        Harare

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Africa\Harare
                        • Size 149B
                        • SHA256 444ed3a710414bc6bf43eb27e591da49d3be3db153449a6a0c9473f7e39fdbcb
                        • MD5 SHA1 SHA512 TLSH

                        Kinshasa

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Africa\Kinshasa
                        • Size 235B
                        • SHA256 cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846
                        • MD5 SHA1 SHA512 TLSH

                        Blanc-Sablon

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\America\Blanc-Sablon
                        • Size 246B
                        • SHA256 8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497
                        • MD5 SHA1 SHA512 TLSH

                        Coral_Harbour

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\America\Coral_Harbour
                        • Size 182B
                        • SHA256 91ac80fe976931c490d058c8ce8b5d71ffa6d4961f6ca13ea9c153f0b0bccea0
                        • MD5 SHA1 SHA512 TLSH

                        Shiprock

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\America\Shiprock
                        • Size 2KB
                        • SHA256 32e819c00a43b3c348f539d700d425504f20b8d068c16418d26fa9b693e775c9
                        • MD5 SHA1 SHA512 TLSH

                        Thunder_Bay

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\America\Thunder_Bay
                        • Size 3KB
                        • SHA256 a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f
                        • MD5 SHA1 SHA512 TLSH

                        Harbin

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Asia\Harbin
                        • Size 561B
                        • SHA256 64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6
                        • MD5 SHA1 SHA512 TLSH

                        Riyadh

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Asia\Riyadh
                        • Size 151B
                        • SHA256 a02287eee69f37c475a3e8a35c6a13e54d49671c2fa0bcc9bbfd82ab28b68543
                        • MD5 SHA1 SHA512 TLSH

                        Sydney

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Australia\Sydney
                        • Size 2KB
                        • SHA256 42c3857585b16db2f8ffd47ba19faa60f473340de8d4fe9320ea7be861605906
                        • MD5 SHA1 SHA512 TLSH

                        Brussels

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Europe\Brussels
                        • Size 2KB
                        • SHA256 812f55aeb6e8cde9ddf4786e15eb4256b21e82cf5f5d28da1bad17d94570cac0
                        • MD5 SHA1 SHA512 TLSH

                        Copenhagen

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Europe\Copenhagen
                        • Size 2KB
                        • SHA256 5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701
                        • MD5 SHA1 SHA512 TLSH

                        Guernsey

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Europe\Guernsey
                        • Size 3KB
                        • SHA256 c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4
                        • MD5 SHA1 SHA512 TLSH

                        Sarajevo

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Europe\Sarajevo
                        • Size 1KB
                        • SHA256 3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a
                        • MD5 SHA1 SHA512 TLSH

                        Zaporozhye

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Europe\Zaporozhye
                        • Size 2KB
                        • SHA256 fb0ae91bd8cfb882853f5360055be7c6c3117fd2ff879cf727a4378e3d40c0d3
                        • MD5 SHA1 SHA512 TLSH

                        GMT0

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\GMT0
                        • Size 114B
                        • SHA256 6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d
                        • MD5 SHA1 SHA512

                        Christmas

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Indian\Christmas
                        • Size 185B
                        • SHA256 85fff93d57a041c1524bad028d2f340bb87e4c63ab7d0e27726f3737c5666649
                        • MD5 SHA1 SHA512 TLSH

                        Reunion

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Indian\Reunion
                        • Size 151B
                        • SHA256 a667613e16894702b038dbf18993467854880a3956cf263d265147bfe1fdba96
                        • MD5 SHA1 SHA512 TLSH

                        BajaNorte

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Mexico\BajaNorte
                        • Size 2KB
                        • SHA256 8c2e7b321726e6345912da396796bdb3672bfc4bd1a91c65ee58b38e004d4ca5
                        • MD5 SHA1 SHA512 TLSH

                        Auckland

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Pacific\Auckland
                        • Size 2KB
                        • SHA256 8000e3a323e8fd0212414e9426b020707a771c368ca0e151747f9ddb7b814b27
                        • MD5 SHA1 SHA512 TLSH

                        Truk

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Pacific\Truk
                        • Size 172B
                        • SHA256 9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0
                        • MD5 SHA1 SHA512 TLSH

                        Wake

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Pacific\Wake
                        • Size 152B
                        • SHA256 53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7
                        • MD5 SHA1 SHA512 TLSH

                        Arizona

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\US\Arizona
                        • Size 360B
                        • SHA256 8a5973d2c62e2cbf2520f2b44e4a2ee9d2f455c93f0f45bfdeb4533af1584664
                        • MD5 SHA1 SHA512 TLSH

                        East-Indiana

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\US\East-Indiana
                        • Size 1KB
                        • SHA256 90d2b2f4a8fd202b226187c209b020833300edec5ff86a463ccc685e8707532c
                        • MD5 SHA1 SHA512 TLSH

                        Hawaii

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\US\Hawaii
                        • Size 329B
                        • SHA256 7f03d1bf5264e7ab023a2ef9b997ddfc8cb6936692407c770762b9c549523f33
                        • MD5 SHA1 SHA512 TLSH

                        Samoa

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\US\Samoa
                        • Size 175B
                        • SHA256 7c262b62985863aad47f13b0ef5db2e5cc917b5d38002de9a2ea83ddb0883458
                        • MD5 SHA1 SHA512 TLSH

                        Zulu

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\pytz\zoneinfo\Zulu
                        • Size 114B
                        • SHA256 8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2
                        • MD5 SHA1 SHA512

                        Bamako

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Africa\Bamako
                        • Size 130B
                        • SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
                        • MD5 SHA1 SHA512 TLSH

                        Dar_es_Salaam

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Africa\Dar_es_Salaam
                        • Size 191B
                        • SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
                        • MD5 SHA1 SHA512 TLSH

                        Harare

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Africa\Harare
                        • Size 131B
                        • SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
                        • MD5 SHA1 SHA512 TLSH

                        Kinshasa

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Africa\Kinshasa
                        • Size 180B
                        • SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
                        • MD5 SHA1 SHA512 TLSH

                        Blanc-Sablon

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\America\Blanc-Sablon
                        • Size 177B
                        • SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
                        • MD5 SHA1 SHA512 TLSH

                        Coral_Harbour

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\America\Coral_Harbour
                        • Size 149B
                        • SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
                        • MD5 SHA1 SHA512 TLSH

                        Shiprock

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\America\Shiprock
                        • Size 1KB
                        • SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
                        • MD5 SHA1 SHA512 TLSH

                        Thunder_Bay

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\America\Thunder_Bay
                        • Size 1KB
                        • SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
                        • MD5 SHA1 SHA512 TLSH

                        Harbin

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Asia\Harbin
                        • Size 393B
                        • SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
                        • MD5 SHA1 SHA512 TLSH

                        Riyadh

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Asia\Riyadh
                        • Size 133B
                        • SHA256 46853e94276af2eea8e86c2f152a871c092df195dc51273b8fc7091faa4b461c
                        • MD5 SHA1 SHA512 TLSH

                        Sydney

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Australia\Sydney
                        • Size 904B
                        • SHA256 820d45a868a88f81c731d5b2c758b4ed000039b6260a80433f8e0f094a604b59
                        • MD5 SHA1 SHA512 TLSH

                        Brussels

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Europe\Brussels
                        • Size 1KB
                        • SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
                        • MD5 SHA1 SHA512 TLSH

                        Copenhagen

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Europe\Copenhagen
                        • Size 705B
                        • SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
                        • MD5 SHA1 SHA512 TLSH

                        Guernsey

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Europe\Guernsey
                        • Size 1KB
                        • SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
                        • MD5 SHA1 SHA512 TLSH

                        Sarajevo

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Europe\Sarajevo
                        • Size 478B
                        • SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
                        • MD5 SHA1 SHA512 TLSH

                        Zaporozhye

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Europe\Zaporozhye
                        • Size 558B
                        • SHA256 0589e80ddecebf9d3077898c12975d2be7393df2856ee9926c534763e1e26bf2
                        • MD5 SHA1 SHA512 TLSH

                        GMT0

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\GMT0
                        • Size 111B
                        • SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
                        • MD5 SHA1 SHA512

                        Christmas

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Indian\Christmas
                        • Size 152B
                        • SHA256 cdc8e2c282d8bc9a5e9c3caf2fc45ff4e9e5cd18f5dec8cb873340ad7c584d64
                        • MD5 SHA1 SHA512 TLSH

                        Reunion

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Indian\Reunion
                        • Size 133B
                        • SHA256 0d9ea5053e83188032a6fb4d301d5db688f43011e5b6b1f917a11b71a0da7b16
                        • MD5 SHA1 SHA512 TLSH

                        BajaNorte

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Mexico\BajaNorte
                        • Size 1KB
                        • SHA256 af9aea4aee505143fa5e847643c0ffe164190c38411010ac7f0b170f4098a6c8
                        • MD5 SHA1 SHA512 TLSH

                        Auckland

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Pacific\Auckland
                        • Size 1KB
                        • SHA256 0e06e7e55aedbc92ef5b3d106e7c392ab1628cfd8a428b20e92e99028a0bfbb9
                        • MD5 SHA1 SHA512 TLSH

                        Truk

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Pacific\Truk
                        • Size 154B
                        • SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
                        • MD5 SHA1 SHA512 TLSH

                        Wake

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Pacific\Wake
                        • Size 134B
                        • SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
                        • MD5 SHA1 SHA512 TLSH

                        Arizona

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\US\Arizona
                        • Size 240B
                        • SHA256 ae11453c21d08984de75f2efec04dc93178a7b4e23c5e52f2098b8bd45ccb547
                        • MD5 SHA1 SHA512 TLSH

                        East-Indiana

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\US\East-Indiana
                        • Size 531B
                        • SHA256 e678f42a13efbd7be0f26a9ce53e04b1c28a582eab05611cb01c16836432f07b
                        • MD5 SHA1 SHA512 TLSH

                        Hawaii

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\US\Hawaii
                        • Size 221B
                        • SHA256 1daa5729aa1e0f32cd44be112d01ad4cc567a9fe76d87dcbb9182be8d2c88ff0
                        • MD5 SHA1 SHA512 TLSH

                        Samoa

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\US\Samoa
                        • Size 146B
                        • SHA256 650d918751366590553063cd681592fdca8a09957e0ce2c18d6697ec385ef796
                        • MD5 SHA1 SHA512 TLSH

                        Zulu

                        • Path C:\Users\Admin\AppData\Local\RiftManager\4.6.10\tzdata\zoneinfo\Zulu
                        • Size 111B
                        • SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
                        • MD5 SHA1 SHA512

                        FontManifest.json

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpolzrbm29\assets\FontManifest.json
                        • Size 3KB
                        • SHA256 c83af9d367579168623bdcb328ab7155c6871c4e306784ea1452407e957d93bd
                        • MD5 SHA1 SHA512 TLSH

                        index.html

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpolzrbm29\index.html
                        • Size 3KB
                        • SHA256 002c33e7e89ea2bbcca41c800035e461b1f07d673af6777dbe6c6d0feddeb137
                        • MD5 SHA1 SHA512 TLSH

                        0d149d20-4b93-41e2-b3f2-b3e05afa7d85.tmp

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\0d149d20-4b93-41e2-b3f2-b3e05afa7d85.tmp
                        • Size 16KB
                        • SHA256 bae37370f52e699947bf8dc73ac22caf8a4dec549469fba5ecfa718bbacc85de
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        48b0aaa1-c7d0-42f0-9e1c-f90e65b53327.tmp

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\48b0aaa1-c7d0-42f0-9e1c-f90e65b53327.tmp
                        • Size 3KB
                        • SHA256 7f1dc69d197e7833aa18778ba4473e64bd8b95f5e2fe89a2ef271965ba08ecea
                        • MD5 SHA1 SHA512 TLSH

                        651eb98c-be61-4562-a832-ddb1237e7f4a.tmp

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\651eb98c-be61-4562-a832-ddb1237e7f4a.tmp
                        • Size 2KB
                        • SHA256 7b191b941744fbfd611a84c419df3ef0256a1d46289a41a97a84ff951574929d
                        • MD5 SHA1 SHA512 TLSH

                        91e768ea-a13a-42e7-b1d8-589bbd67c3eb.tmp

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\91e768ea-a13a-42e7-b1d8-589bbd67c3eb.tmp
                        • Size 3KB
                        • SHA256 89ee4d2ced53f523281799847b04cbf39735169ffde971e5d6da1238c72d54e0
                        • MD5 SHA1 SHA512 TLSH

                        settings.dat

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 022e1b409f5857f2b786fdd2a2dd1f3c815c827de8e9f180bd8b4c56b11da985
                        • MD5 SHA1 SHA512

                        settings.dat

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 6c843a4da1344007f19e8715854a809243dc71ab9424a230f34195f301edcd61
                        • MD5 SHA1 SHA512 TLSH

                        2b0c605d-7017-45cb-b524-5922e4922911.tmp

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\2b0c605d-7017-45cb-b524-5922e4922911.tmp
                        • Size 4KB
                        • SHA256 8e4b64a8f9325c0086d051646e6f85e265a2b80979125085652ab1234300b43c
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        5f8156dc-4163-4c8e-ba6e-9b2defbad8d4.tmp

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\5f8156dc-4163-4c8e-ba6e-9b2defbad8d4.tmp
                        • Size 5KB
                        • SHA256 29eb1a0b02a1bd5c5ef30e4b226d9f1c8efabc9d8784d353d4ce12a400be2205
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        879b1a5f-115d-4a57-92f1-115f414e93d4.tmp

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\879b1a5f-115d-4a57-92f1-115f414e93d4.tmp
                        • Size 4KB
                        • SHA256 29d16061dcbbe2e8c3a35db189af20c7eaba0e4ec9ad89d5cbd5c2a719821d9f
                        • MD5 SHA1 SHA512 SSDEEP TLSH

                        data_0

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\Cache\Cache_Data\data_0
                        • Size 8KB
                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                        • MD5 SHA1 SHA512 SSDEEP

                        data_1

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\Cache\Cache_Data\data_1
                        • Size 264KB
                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                        • MD5 SHA1 SHA512 SSDEEP

                        data_2

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\Cache\Cache_Data\data_2
                        • Size 8KB
                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                        • MD5 SHA1 SHA512 SSDEEP

                        data_3

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\Cache\Cache_Data\data_3
                        • Size 8KB
                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                        • MD5 SHA1 SHA512 SSDEEP

                        MANIFEST-000001

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\Extension Rules\MANIFEST-000001
                        • Size 41B
                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                        • MD5 SHA1 SHA512

                        4c00b6eb-0b4c-4fab-b204-5790c48cb88c.tmp

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\Network\4c00b6eb-0b4c-4fab-b204-5790c48cb88c.tmp
                        • Size 111B
                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                        • MD5 SHA1 SHA512 TLSH

                        Network Persistent State

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\Network\Network Persistent State
                        • Size 59B
                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                        • MD5 SHA1 SHA512 TLSH

                        SCT Auditing Pending Reports

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\Network\SCT Auditing Pending Reports
                        • Size 2B
                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                        • MD5 SHA1 SHA512

                        CURRENT

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Default\Sync Data\LevelDB\CURRENT
                        • Size 16B
                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                        • MD5 SHA1 SHA512

                        Local State

                        • Path C:\Users\Admin\AppData\Local\Temp\tmpqjlsd18p\EBWebView\Local State
                        • Size 1KB
                        • SHA256 ce81cef101f275867d0b2d9a6964eed24d7595f883c692548b911840cb6628c9
                        • MD5 SHA1 SHA512 TLSH

                        manifest.json

                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4008_708536398\manifest.json
                        • Size 108B
                        • SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
                        • MD5 SHA1 SHA512 TLSH

                        memory/1500-2521-0x00007FFA109B0000-0x00007FFA10CE2000-memory.dmp

                        memory/1500-2525-0x00007FFA0D710000-0x00007FFA0DAC9000-memory.dmp

                        memory/1500-2524-0x00007FFA0FAE0000-0x00007FFA0FF99000-memory.dmp

                        memory/1500-2523-0x00007FFA0DAD0000-0x00007FFA0E11A000-memory.dmp

                        memory/3024-2510-0x000002C97AB10000-0x000002C97AB18000-memory.dmp

                        memory/3024-2512-0x000002C97AB60000-0x000002C97AB68000-memory.dmp

                        memory/3024-2520-0x000002C97AB50000-0x000002C97AB5E000-memory.dmp

                        memory/3024-2519-0x000002C97B320000-0x000002C97B3C2000-memory.dmp

                        memory/3024-2516-0x000002C97AB50000-0x000002C97AB58000-memory.dmp

                        memory/3024-2506-0x000002C97AA60000-0x000002C97AA6A000-memory.dmp

                        memory/3024-2507-0x00007FFA29F00000-0x00007FFA29F0A000-memory.dmp

                        memory/3024-2508-0x000002C97AD00000-0x000002C97AD74000-memory.dmp

                        memory/3024-2509-0x000002C97AB30000-0x000002C97AB4A000-memory.dmp

                        memory/3024-2511-0x000002C97AB20000-0x000002C97AB28000-memory.dmp

                        memory/3024-2518-0x000002C97AB50000-0x000002C97AB58000-memory.dmp

                        memory/3024-2513-0x000002C97ACC0000-0x000002C97ACE2000-memory.dmp

                        memory/3024-2514-0x000002C97B730000-0x000002C97BCEA000-memory.dmp

                        memory/3024-2522-0x000002C97B280000-0x000002C97B288000-memory.dmp

                        memory/3024-2515-0x000002C97AB50000-0x000002C97AB58000-memory.dmp

                        memory/3332-2686-0x0000016F417A0000-0x0000016F41849000-memory.dmp

                        memory/4992-2754-0x0000020F1BEE0000-0x0000020F1BEE1000-memory.dmp

                        memory/4992-2770-0x0000020F1BF50000-0x0000020F1BF52000-memory.dmp

                        memory/4992-2708-0x0000020F1BE00000-0x0000020F1BE05000-memory.dmp

                        memory/4992-2707-0x0000020F1BE10000-0x0000020F1BE13000-memory.dmp

                        memory/4992-2714-0x0000020F1BE30000-0x0000020F1BE31000-memory.dmp

                        memory/4992-2717-0x0000020F1BE40000-0x0000020F1BE44000-memory.dmp

                        memory/4992-2716-0x0000020F1BE50000-0x0000020F1BE52000-memory.dmp

                        memory/4992-2719-0x0000020F1BE60000-0x0000020F1BE62000-memory.dmp

                        memory/4992-2722-0x0000020F1BE70000-0x0000020F1BE72000-memory.dmp

                        memory/4992-2721-0x0000020F1BE60000-0x0000020F1BE61000-memory.dmp

                        memory/4992-2720-0x0000020F1BE50000-0x0000020F1BE54000-memory.dmp

                        memory/4992-2725-0x0000020F1BE60000-0x0000020F1BE64000-memory.dmp

                        memory/4992-2713-0x0000020F1BE10000-0x0000020F1BE1A000-memory.dmp

                        memory/4992-2712-0x0000020F1BE30000-0x0000020F1BE35000-memory.dmp

                        memory/4992-2705-0x0000020F1BDF0000-0x0000020F1BDF1000-memory.dmp

                        memory/4992-2724-0x0000020F1BE80000-0x0000020F1BE82000-memory.dmp

                        memory/4992-2732-0x0000020F1BE90000-0x0000020F1BE95000-memory.dmp

                        memory/4992-2736-0x0000020F1BE90000-0x0000020F1BE94000-memory.dmp

                        memory/4992-2735-0x0000020F1BEA0000-0x0000020F1BEA2000-memory.dmp

                        memory/4992-2733-0x0000020F1BE80000-0x0000020F1BE8A000-memory.dmp

                        memory/4992-2759-0x0000020F1BF10000-0x0000020F1BF12000-memory.dmp

                        memory/4992-2703-0x0000020F1BDF0000-0x0000020F1BDF2000-memory.dmp

                        memory/4992-2762-0x0000020F1BF20000-0x0000020F1BF22000-memory.dmp

                        memory/4992-2779-0x0000020F1BF80000-0x0000020F1BF82000-memory.dmp

                        memory/4992-2777-0x0000020F1BF60000-0x0000020F1BF64000-memory.dmp

                        memory/4992-2776-0x0000020F1BF70000-0x0000020F1BF72000-memory.dmp

                        memory/4992-2774-0x0000020F1BF50000-0x0000020F1BF57000-memory.dmp

                        memory/4992-2773-0x0000020F1BF60000-0x0000020F1BF64000-memory.dmp

                        memory/4992-2771-0x0000020F1BF40000-0x0000020F1BF44000-memory.dmp

                        memory/4992-2710-0x0000020F1BE20000-0x0000020F1BE22000-memory.dmp

                        memory/4992-2768-0x0000020F1BF30000-0x0000020F1BF37000-memory.dmp

                        memory/4992-2767-0x0000020F1BF40000-0x0000020F1BF44000-memory.dmp

                        memory/4992-2765-0x0000020F1BF10000-0x0000020F1BF14000-memory.dmp

                        memory/4992-2764-0x0000020F1BF30000-0x0000020F1BF32000-memory.dmp

                        memory/4992-2761-0x0000020F1BF10000-0x0000020F1BF11000-memory.dmp

                        memory/4992-2760-0x0000020F1BF00000-0x0000020F1BF04000-memory.dmp

                        memory/4992-2757-0x0000020F1BEF0000-0x0000020F1BEF4000-memory.dmp

                        memory/4992-2756-0x0000020F1BF00000-0x0000020F1BF02000-memory.dmp

                        memory/4992-2753-0x0000020F1BEC0000-0x0000020F1BEC4000-memory.dmp

                        memory/4992-2752-0x0000020F1BEE0000-0x0000020F1BEE2000-memory.dmp

                        memory/4992-2748-0x0000020F1BEB0000-0x0000020F1BEB4000-memory.dmp

                        memory/4992-2747-0x0000020F1BEC0000-0x0000020F1BEC2000-memory.dmp

                        memory/4992-2745-0x0000020F1BEA0000-0x0000020F1BEA4000-memory.dmp

                        memory/4992-2744-0x0000020F1BEB0000-0x0000020F1BEB2000-memory.dmp

                        memory/4992-2742-0x0000020F1BCA0000-0x0000020F1BCA4000-memory.dmp

                        memory/4992-2741-0x0000020F1BEA0000-0x0000020F1BEA2000-memory.dmp

                        memory/4992-2739-0x0000020F1BC90000-0x0000020F1BC95000-memory.dmp

                        memory/4992-2738-0x0000020F1BCA0000-0x0000020F1BCA3000-memory.dmp

                        memory/4992-2750-0x0000020F1BED0000-0x0000020F1BED2000-memory.dmp

                        memory/4992-2704-0x0000020F1BDE0000-0x0000020F1BDE4000-memory.dmp

                        memory/4992-2698-0x0000020F1BDC0000-0x0000020F1BDC5000-memory.dmp

                        memory/4992-2696-0x0000020F1BDC0000-0x0000020F1BDC1000-memory.dmp

                        memory/4992-2700-0x0000020F1BDE0000-0x0000020F1BDE2000-memory.dmp

                        memory/4992-2701-0x0000020F1BDD0000-0x0000020F1BDD4000-memory.dmp

                        memory/4992-2697-0x0000020F1BDD0000-0x0000020F1BDD3000-memory.dmp

                        memory/4992-2695-0x0000020F1BC80000-0x0000020F1BC81000-memory.dmp

                        memory/4992-2549-0x00007FFA37E60000-0x00007FFA37E61000-memory.dmp

                        memory/5048-2635-0x00007FFA37E60000-0x00007FFA37E61000-memory.dmp

                        memory/5048-2689-0x000002870ECA0000-0x000002870ED49000-memory.dmp