cb67bf4123318602a77c8e4f64297c1a1a44c0715e2b5e39b3c0518057e2e857

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Arcana.exe
Size 11.7MB
Sample261110-eham8syxct
SHA256 cb67bf4123318602a77c8e4f64297c1a1a44c0715e2b5e39b3c0518057e2e857
MD5 7cb52aa05db66a6d74aa7c39b10bca2e
SHA1 778bec3ab757a7fa24564608505c1556e36c70ed
SHA512 c879678bd470a7485332ee952d73eb7e9bf8d3b982a9971e4b4f51ddfaaf6f515b4fe4ed5481eb5192ed63d4f26643087ed4ebfed4dfc803ae36c5933f84df33
SSDEEP 196608:SM+LStLE8rjHlDUcYr60MTZ3dpvREMq8H9z02M0S6wC1BHsLZZN3YdZA:SCB/l4pMNnhjHrM04C1BMlZN3YdZ
TLSH
T1EDC69D43F7A290E8C56AC034935A6232FA317C4947357AEB2BE44B253F65F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	5556	Arcana.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4120	.Arcana.iuqpmamsilfnqjugmmkhyyjwlxnahnwa.__selfdelete__.exe

Executes dropped EXE 2 IoCs

pid	Process
4120	.Arcana.iuqpmamsilfnqjugmmkhyyjwlxnahnwa.__selfdelete__.exe
1140	Arcana.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Arcana.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Arcana.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_1427511906\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_1427511906\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_1427511906\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_1427511906\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_1427511906\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\_metadata\verified_contents.json	msedgewebview2.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5444	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Arcana.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Arcana.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6084	msedgewebview2.exe
6084	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4080	msedgewebview2.exe
4080	msedgewebview2.exe
3928	msedgewebview2.exe
3928	msedgewebview2.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
5556	Arcana.exe
5556	Arcana.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5556	Arcana.exe
1140	Arcana.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 4080	5556	Arcana.exe	88
PID 4080 wrote to memory of 200	4080	msedgewebview2.exe	89
PID 4080 wrote to memory of 2920	4080	msedgewebview2.exe	90
PID 4080 wrote to memory of 2920	4080	msedgewebview2.exe	90
PID 4080 wrote to memory of 2920	4080	msedgewebview2.exe	90
PID 4080 wrote to memory of 2920	4080	msedgewebview2.exe	90
PID 4080 wrote to memory of 3720	4080	msedgewebview2.exe	91
PID 4080 wrote to memory of 1348	4080	msedgewebview2.exe	92
PID 4080 wrote to memory of 1348	4080	msedgewebview2.exe	92
PID 4080 wrote to memory of 1348	4080	msedgewebview2.exe	92
PID 4080 wrote to memory of 1976	4080	msedgewebview2.exe	93
PID 4080 wrote to memory of 1976	4080	msedgewebview2.exe	93
PID 4080 wrote to memory of 1976	4080	msedgewebview2.exe	93
PID 4080 wrote to memory of 1976	4080	msedgewebview2.exe	93
PID 4080 wrote to memory of 1976	4080	msedgewebview2.exe	93
PID 4080 wrote to memory of 3028	4080	msedgewebview2.exe	94
PID 4080 wrote to memory of 3028	4080	msedgewebview2.exe	94
PID 4080 wrote to memory of 3028	4080	msedgewebview2.exe	94
PID 4080 wrote to memory of 3028	4080	msedgewebview2.exe	94
PID 4080 wrote to memory of 3028	4080	msedgewebview2.exe	94
PID 5556 wrote to memory of 1368	5556	Arcana.exe	95
PID 5556 wrote to memory of 4120	5556	Arcana.exe	97
PID 5556 wrote to memory of 1140	5556	Arcana.exe	98
PID 4120 wrote to memory of 5444	4120	.Arcana.iuqpmamsilfnqjugmmkhyyjwlxnahnwa.__selfdelete__.exe	99
PID 1140 wrote to memory of 3928	1140	Arcana.exe	101
PID 3928 wrote to memory of 4676	3928	msedgewebview2.exe	102
PID 3928 wrote to memory of 1500	3928	msedgewebview2.exe	103
PID 3928 wrote to memory of 1500	3928	msedgewebview2.exe	103
PID 3928 wrote to memory of 1500	3928	msedgewebview2.exe	103
PID 3928 wrote to memory of 1500	3928	msedgewebview2.exe	103
PID 3928 wrote to memory of 5664	3928	msedgewebview2.exe	104
PID 3928 wrote to memory of 5944	3928	msedgewebview2.exe	105
PID 3928 wrote to memory of 5944	3928	msedgewebview2.exe	105
PID 3928 wrote to memory of 5944	3928	msedgewebview2.exe	105
PID 3928 wrote to memory of 4148	3928	msedgewebview2.exe	106
PID 3928 wrote to memory of 4148	3928	msedgewebview2.exe	106
PID 3928 wrote to memory of 4148	3928	msedgewebview2.exe	106
PID 3928 wrote to memory of 4148	3928	msedgewebview2.exe	106
PID 3928 wrote to memory of 4148	3928	msedgewebview2.exe	106
PID 3928 wrote to memory of 5064	3928	msedgewebview2.exe	107
PID 3928 wrote to memory of 5064	3928	msedgewebview2.exe	107
PID 3928 wrote to memory of 5064	3928	msedgewebview2.exe	107
PID 3928 wrote to memory of 5064	3928	msedgewebview2.exe	107
PID 3928 wrote to memory of 5064	3928	msedgewebview2.exe	107
PID 3928 wrote to memory of 2144	3928	msedgewebview2.exe	111
PID 3928 wrote to memory of 2144	3928	msedgewebview2.exe	111
PID 3928 wrote to memory of 2144	3928	msedgewebview2.exe	111
PID 3928 wrote to memory of 2372	3928	msedgewebview2.exe	112
PID 3928 wrote to memory of 2372	3928	msedgewebview2.exe	112
PID 3928 wrote to memory of 2372	3928	msedgewebview2.exe	112
PID 3928 wrote to memory of 6084	3928	msedgewebview2.exe	113

C:\Users\Admin\AppData\Local\Temp\Arcana.exe
"C:\Users\Admin\AppData\Local\Temp\Arcana.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Arcana.exe --webview-exe-version=0.11.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5556.4720.5955375463252883349 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView /prefetch:4 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff97b745fd8,0x7ff97b745fe4,0x7ff97b745ff0
    3⤵
    PID:200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,7059130059960772756,8376313319673639431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2092 --field-trial-handle=1772,i,7059130059960772756,8376313319673639431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1772,i,7059130059960772756,8376313319673639431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3356 --field-trial-handle=1772,i,7059130059960772756,8376313319673639431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f /prefetch:1
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4056 --field-trial-handle=1772,i,7059130059960772756,8376313319673639431,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f /prefetch:1
    3⤵
    PID:3028
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
  2⤵
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\.Arcana.iuqpmamsilfnqjugmmkhyyjwlxnahnwa.__selfdelete__.exe
  "C:\Users\Admin\AppData\Local\Temp\.Arcana.iuqpmamsilfnqjugmmkhyyjwlxnahnwa.__selfdelete__.exe" 1920 C:\Users\Admin\AppData\Local\Temp\.Arcana.qslwteofunzkmpzkkwtrqakgyclrfahe.__relocated__.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c exit
    3⤵
    - Executes a command shell one-liner
    PID:5444
- C:\Users\Admin\AppData\Local\Temp\Arcana.exe
  "C:\Users\Admin\AppData\Local\Temp\Arcana.exe" --after-update
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Arcana.exe --webview-exe-version=0.11.4 --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1140.5880.4647255703047968631 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView /prefetch:4 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c4,0x7ff97b745fd8,0x7ff97b745fe4,0x7ff97b745ff0
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1736,i,14614086376010374339,17413559233838197583,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1736,i,14614086376010374339,17413559233838197583,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2552 --field-trial-handle=1736,i,14614086376010374339,17413559233838197583,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3500 --field-trial-handle=1736,i,14614086376010374339,17413559233838197583,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f /prefetch:1
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3868 --field-trial-handle=1736,i,14614086376010374339,17413559233838197583,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4636 --field-trial-handle=1736,i,14614086376010374339,17413559233838197583,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4764 --field-trial-handle=1736,i,14614086376010374339,17413559233838197583,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView" --webview-exe-name=Arcana.exe --webview-exe-version=0.11.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4784 --field-trial-handle=1736,i,14614086376010374339,17413559233838197583,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7bb9926abd30efabd4b3c9692a9b083152e56f8f
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.Arcana.iuqpmamsilfnqjugmmkhyyjwlxnahnwa.__selfdelete__.exe

Path C:\Users\Admin\AppData\Local\Temp\.Arcana.iuqpmamsilfnqjugmmkhyyjwlxnahnwa.__selfdelete__.exe
Size 11.7MB
SHA256 cb67bf4123318602a77c8e4f64297c1a1a44c0715e2b5e39b3c0518057e2e857
MD5 7cb52aa05db66a6d74aa7c39b10bca2e
SHA1 778bec3ab757a7fa24564608505c1556e36c70ed
SHA512 c879678bd470a7485332ee952d73eb7e9bf8d3b982a9971e4b4f51ddfaaf6f515b4fe4ed5481eb5192ed63d4f26643087ed4ebfed4dfc803ae36c5933f84df33
SSDEEP 196608:SM+LStLE8rjHlDUcYr60MTZ3dpvREMq8H9z02M0S6wC1BHsLZZN3YdZA:SCB/l4pMNnhjHrM04C1BMlZN3YdZ
TLSH
T1EDC69D43F7A290E8C56AC034935A6232FA317C4947357AEB2BE44B253F65F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Arcana-0.11.4.exe

Path C:\Users\Admin\AppData\Local\Temp\Arcana-0.11.4.exe
Size 11.7MB
SHA256 2ff6d6c1f73f2832db950a980cf3258bd41b9e410667c08ca0c084c4bcd5c4d8
MD5 3573264dc1eabba6ee13776a24400c13
SHA1 6907fa662741fb04098900a850aa1371c3ec09e6
SHA512 b5ac85e7713c8c6fd1d605c991f1b15392c1eca7abcdc9a0b5c8ebb104cdae2b80c8457218fccf6561cdf7545c956cbe06f6201016bb26d0a1077596e32dc3f2
SSDEEP 196608:4lBj8H+e2D5DUcYr60MTZ3dpvREMq8H9z02M0S6wC1BHsL4ZN8cKCHNap:sQHo54pMNnhjHrM04C1BM8ZNVbHI
TLSH
T122C69D43F6A291E8C16AC035935A6233FA317C4907357AEB2BE44B213F65F906B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0902bf4d-08e8-442d-8fcf-af8b0eb5b74b.tmp

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\0902bf4d-08e8-442d-8fcf-af8b0eb5b74b.tmp
Size 2KB
SHA256 31fc7b57e0d1cebcade89e7f679e2e8299633eef027834a319fb2575cddad8ac
MD5 6d1592083963b9a2b4bd640733becb52
SHA1 dd7ba0a5c74e6e37d90da9df0ea918090042718b
SHA512 ce05a1d67907ab690292ab327cf5dbd9d6ab121bb9669225ffebf6afadc899dc9ddb6466d3c9272d731b92ac2f60c62eec6d1b2882b0ef839abf3c3c02365cbd
TLSH
T1EC5154336D64EB3799F286147E5A6F17EE3A5161A6522F508ADD0B0C01D764C1389C3B
MD5 SHA1 SHA512 TLSH

Submit Download

235c0875-6b37-41f4-a8ef-293228a6f379.tmp

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\235c0875-6b37-41f4-a8ef-293228a6f379.tmp
Size 6KB
SHA256 2a08780edaf55651ba5aee3482cb2fd57828e946fe3cda1184db775b3915d336
MD5 1187680bfb39e33e42169335c5108376
SHA1 181f44209826218831f6dd27a9887d665e6a5cfa
SHA512 a167d2b0a5f3e1d7dc9aaf613c34f5ffd7cea5e3e40a7d0ad386c96b94a095201a47faba785196bfc0cf4d0615f6fc5e2f55d8418e2926f3ea7fe9936a104d37
SSDEEP 96:eB3NkGSCkABfZhDzm88kh/cI9URLl8DotoN5u5BOebo618pZdZeiz01C9V6rjAPP:y3NBSC74seiDUaiOA63oBxBDz+
TLSH
T108D1F83668A5EE775DF2D8047F292B0BBAB59163D4843FA4C6EC1F1F01D72881382826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a26d340-7843-4fcb-866e-350e9006be09.tmp

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\2a26d340-7843-4fcb-866e-350e9006be09.tmp
Size 5KB
SHA256 c48e2dcb494f8e43cd899f1890f6ad990bc360eab9fe5e6204d3eabf6aa6558d
MD5 cb70a615bc30a789136c458bc29c8c38
SHA1 3c5a492bedaabfedf6b387e49fe2776d1a797322
SHA512 1854dadf6bf2288707063bb58dca5101f3378047e13be2f1ddaf97863886af3b378f9054e6926f1811e68118c39cd1c9f1182d52f9837a1492421b74dc183303
SSDEEP 96:eB3NkGSCkABfZhDzm88kh/cI9URoDotoN5uMBOebo618pZdZeTQ01C9V6rjALnqa:y3NBSC74seoDUapOA6WJBs
TLSH
T124C1E63269A5EE37ADF2D8047E552B0BEA759063D4843F94CAEC1F0E01E7288138182B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a658b1a471b037f08075df35e6cb26eeb70903aa15bf2e613baaa382f399d182
MD5 44f7288ef9c4af378e8054addd385411
SHA1 947119278ecaa1dcf82d41b5284f988bcdae167c
SHA512 bc6de5a632e3e20c861af27c8a55d064e0a9fae59a0ecad90436da6ed22d9f2a4ae5bb160de63314d02499a7743eb7b069185950a97e793ffee74397c1e82aae
TLSH
T188D012323B020178C41130730107F6091C01C20B400A4088542C8A1E5E584600907441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 02af9869caaa6abe92d1593098473e329202c30bc02a413cfe437182e58188c3
MD5 fd417edcf30f5d31a2080bd78dfb6f1c
SHA1 cee5a85f712adb0c7d09f4eb5b3233d2d192e9b1
SHA512 20cdbddac0fa4258512e24692c8fc700d960b0647bd67df60627e989131446d6311a7656117345e0b02b0e45bf2e794a85fd92a2ffb8ab2ddeb0c7de85075c11
TLSH
T14BD02B3B36550138CD11B173120AAA891E41C60B408281D9446CCE1FA91C0340E03481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7c713cba380d83053b7a5b2bc85f83a6cbfdce0d3e8eb22c2711d2bfd3bc6f9d
MD5 4d7308730c75aa4a84fcdebdd7d50222
SHA1 fe8769373cff1af2367766589b8417689d8983e0
SHA512 bf8115c111bba6e9a05257240d9b7b63c431dea1840dcc3970f8ea4b65e5894efdd1f580bb9135612383b10bf02aeff1f08e297bd048e60a73286f9ef12f99e4
TLSH
T166D02B3B3A550138CD11B2721209AA891F41C50B408282D9446CCE2BAD1C0340E03481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b47316ded2292441d70008a6784baa4183badaa6667f89283f93006d93f6b851
MD5 1a32b421390236c49d26fde664aa71f8
SHA1 813148b065c7f9febbb254231cf0c748a53051c2
SHA512 c01dc653818d5f4b3cadcc1795c4fd36883d426410919b090f9e15b0e93997b68c8c74a30df07381d3bda90dfd4c73142a91bfcee6a884f081df93f713af87fe
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

89b891f1-8642-46d8-81bb-8cf2d4c29949.tmp

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\89b891f1-8642-46d8-81bb-8cf2d4c29949.tmp
Size 6KB
SHA256 1cc911eba6303d73d468ab27e136f147fac462be0c62343e3f3d1c365dfaaa01
MD5 d16bde302d17268c6ecb7850ff7bc28a
SHA1 f5acd071d5d3596c8e8ebbf6c7d032fe286b642e
SHA512 078c182515322fafc7d6af2a4f7eb3b09e6f2e98308c07a4d8f716fb91ea6a7f90adfd82913ac97c9cba190ff9604c96e181bd308f4ded82fc2555ccf19c5ec6
SSDEEP 96:st1p/dP/3SbbDok+W8Hdo5h16Z0ds7/x+6MhmuecJdkpulje4K+gClD28XM1C7K:stXFZy+ondsV+Fddkp2jUI5G6K
TLSH
T188D193069E28B97B4CC6E519FE35BA17E2F9506274D51E58EBF8492C04EB6CC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9020efb1-3fcd-4927-9abf-34e3b7fcf80c.tmp

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\9020efb1-3fcd-4927-9abf-34e3b7fcf80c.tmp
Size 6KB
SHA256 e9b0d8f4de9ed9ea0dae4bb93aa7ca4553871f7f3c898bec9d46b79e5295826a
MD5 ba105116352ac6deb5e05925de60ff08
SHA1 045ba5e7b188def35c5c096627fb476f8137a007
SHA512 8824854f724fc7766f966eaf4274a9807c0e1bd9dc89c6bbbda7be5bda2cfe5d1ff92d1ef2b85b8317a82f6ef25672afedf04a9cf136a18b0882a1836b0c1cd8
SSDEEP 96:st1p/dP/3pGbbDok+W8Hdo5h16Z0ds7/x+6MhmuecJdkpulje4K+gC/c28XM1C7K:stXFPy+ondsV+Fddkp2jUIkG6K
TLSH
T1A2E1A3065E24B97B4CC7E519FE39BA17E2F9506270951E58EBF8492C04EBACC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

087e5ef36615a694_0

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\087e5ef36615a694_0
Size 1KB
SHA256 3bc9ed2a8594ed1360f8d4bdf079923aaf4b44a0535e55e2005c41e5e46fb25a
MD5 f53c4f80c5b9ccbd19683a1f2017c9f7
SHA1 7f4e636e31cac2c9da9085df1c663ac7f09325bb
SHA512 09c78e9d7289baa2480990fe26800cfe09a7d89ea527da3efa1b4e813a703bb0b3e44166bd108dd1639439ab661512a803669f36a7e115b974d0dff1bbf34b2d
TLSH
T1BD31B65DE3417B41C23442B383E3053A2A7564A28788F3031351F623744EBA46E4270A
MD5 SHA1 SHA512 TLSH

Submit Download

4f2c6535d4818c9a_0

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\4f2c6535d4818c9a_0
Size 241B
SHA256 f0cbce18d9c502ea52c5296b98c742948f32e2cd595ab31e57fbf2b1e54f0949
MD5 9a3ba405d92e70ec6071a9cc4402454a
SHA1 72b34814299753762d444077f12c5bbbaba5a7f6
SHA512 a27c12d9cebd0c50fd5ac3247ea18ecf9bd98911f766fc0d1935f4f177b86d4ba1defd4222225550c4b84af10eb33bee3be2b20fa7b9fa2c513e27046147ab41
TLSH
T166D0A78F84200488C1EA4DF58AFF4E17834348E0149CD9665072F861075552CF815700
MD5 SHA1 SHA512 TLSH

Submit Download

63511b4e0f0712e0_0

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\63511b4e0f0712e0_0
Size 243B
SHA256 b1ee53a8ed8331b84b6ebd093d52be23544b537478a408ddefeccbc65db2e6ee
MD5 02390469033708ab8dcd13e0471c6b41
SHA1 2011d9eb3d31373506b821b17304b502d8b4b841
SHA512 baa99a03ca4dbe06088935834fafea9e9de0541df569f63719b5f77b8d1297cdf0d63711d707b3cfb811098a19378e850cde2f02802e4932e4498f94d5d99b8d
TLSH
T17CD0A74F85A48404DA99EAF45E9E4D16C307C4F0253DC5434010DCAA61D1D6C395876C
MD5 SHA1 SHA512 TLSH

Submit Download

73df65b64a9fc4a6_0

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\73df65b64a9fc4a6_0
Size 245B
SHA256 c56e4f8e4810428be18e3f400321724f296e031ca3328aa81645db4ca9c440bd
MD5 7b7015527181b7f053ad94507da0d7df
SHA1 d0043a9bf0ab86228c9316305de5083ba408a169
SHA512 dac244c35cfda07cb290019615db729cb08c7b363cf3874bd5ea48dbdbf419fefa2d3c9e7b599fc28062f9114795ad66b91639e81c3f56acb843db0ac5fa0967
TLSH
T12CD0238FC7669850D554D8F4DBEF4EAFC315C0E4005DA843500EED7540875F87628351
MD5 SHA1 SHA512 TLSH

Submit Download

7f35871c7dd0c632_0

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\7f35871c7dd0c632_0
Size 243B
SHA256 6e21b2a2f7a71bed11b99dd395e6dc1239181778c5b6da9c5b2ac6bc8022ab0f
MD5 9fe198eb0b388dad6ca11fddc29a1d72
SHA1 e234400a22425d77f3ca6931ae6d91309b72dc27
SHA512 b03643abf627380eab10bef8d4d5e5a4fd4d3f5486f669ebea57c44297942ab7ed2a9d55a50d6afd6a8bd61801a92953522079efb99f405da2937c870cac5c12
TLSH
T1ACD0A79F51B11888C9B49AF4DBEF4946D327D1D212A888576481F49121C1218B05B314
MD5 SHA1 SHA512 TLSH

Submit Download

843f8e394496a9dd_0

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\843f8e394496a9dd_0
Size 4KB
SHA256 e573061b9c7ef173229f1a39f73ad89f81ae996248a00b4cd0373aa10ea79404
MD5 48d21132ea0360ecd2d024920898ae70
SHA1 148185594c45dea92acc6dcbd4034ba3298aabc9
SHA512 2ce14cdadefd1aa443878d162500615de250d0c08cf1841a799cf667a146865c7045a625a44b7369791cf0e13e6d6d42c5f999b168e08cf949d23eccbc2c3329
SSDEEP 96:Ji69N7ElzLe2BGu6EDne5Q2whF/EGM2TzPMxW0g6EGxJ:8WNiLGudbeCJMg0gd0
TLSH
T16FB111E59B09FF16C170193382D3453A2735E8C917899B0B6364E7725C4EAED4DB834E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a46cc49349f10b19_0

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\a46cc49349f10b19_0
Size 246B
SHA256 4878fa1a05a707bebf47fc020f90e2f3c7b3d84b0dc47910c97e7d151768e549
MD5 d28a1935f51d42d5832e57be99589239
SHA1 a3b463caeb63ad73f7eba9a17637c5c36b4a1352
SHA512 734001b0144e1cd6c08fa2af98d9a7f56dc93167f9153bd924ace20d16b95636c0774bc4258dd13f5c9c17a17f3107afbaacfb76cf40906ebc7044b1374a15a7
TLSH
T1D3D0A79FD734D84DC11759B4F7DE4E558702D4D0039E95526118E49151D1264F815319
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 216B
SHA256 fc3768e0f015f7b833ce37cb8c66bdf2114121b3d10c4ffc6b38f433b302a369
MD5 fc4aa852d4e073a4fcaea28daa45781f
SHA1 9a4a5adc5b08c6e2d5e8ad6d044dd6dbbda4201c
SHA512 5ffcf6cecbebe8b9e61658fed2b1b1971d69c8ce737663a3041c4e49d0580ac57bce5f39c6af036c00735599775cbe1b8c713bbe65a767b7acd4b8c8e8e0c328
TLSH
T193D08C31D87EE568C790407025E2394A73F20C740B3F5F1048E3DAF188BA7244192885
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 216B
SHA256 653da61414a09ff92dbad6cac39571c521d06ae25b52c20edb42ed1b63de0ecf
MD5 5c396e9b9a52f668a66e7a6922dc49a7
SHA1 004e23d82066dd34a20a7b5b4f58bd218eb5a7ed
SHA512 0c601bc375447c4f7fb8591b18edcc2c9b6f09a7f2a24df4e3338e8593ea5027334a9eac25ce5f6d8c8bdf5910098e780ae1cdc05a22fc22ee0aa5969995abb3
TLSH
T11CD0121984BD9520C3934871F352794963B11D701B53072148DF9A5078F66104173456
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c7b612930dc236a433e2e0f8bf0b56ccd5363ff3e7a17e61197ad5d159c307c6
MD5 6e20e972c80dd215a35c81ad5be54721
SHA1 64e38ba0de068d62488ba4a509bdaf9c0b8fbb64
SHA512 3dd81743e57e64fa3ca0382e7e49d5c3cc7d0d17e80dc49636c22ac5d20eb4702a29db7d19c6bf2c48af25fbf2ead2339df6dd8b669c8d07166c2ea41a17a35e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 2068e7f66dbfd1868a780a2f93a095c037bf5c40714290234ebeddf7dfca190c
MD5 0ef8845b0357296bd37d260b7e1fafb1
SHA1 e3ed7ae7c679d6792c3cbff2f1b579faafdfd3c7
SHA512 3fc53778e0cf2c431e97b887b51789ff8f69c532e90d4d1e15c03c64b012802a188d1786399f6c7a95b0e4ab4a67201836392edf707f5e1889a016da48d8690b
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\History
Size 164KB
SHA256 be0f82bd6ba3616086f1b3a26e233849238643ff75d35f9e07ed7cbbad1234ab
MD5 cbe87a0fd86da614e3c8076550abfc3e
SHA1 f28d126c284e47b0726d9c507c5cea01231f6f87
SHA512 d0834e9784af643166c3141d8effaf9bc9b879a5bb01cbc56d12ea3277a3fdddc31c606af8c57d512ed827ab1335bca652abe992ef1c58c2ffa98fb326716f9e
SSDEEP 96:8BkvLqL/uejzH+bF+UIYysX0fxQp97sEHt/DfLVVVN6zRk/E07lou:8BkDqL/tH+bF+UI3iWGVsWNVVV632B
TLSH
T135F30D5E6F643202CDBD923669E748F3997DF03F47232A856C6104B5CEE2656B02C4FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Preferences
Size 6KB
SHA256 e2886e51788a87588de803e9d13131672538e178b9201a07d1b5fc9bc82f809e
MD5 b1aa356c6adc17c61d035f7996cfe794
SHA1 10ad6eaaccb7ba1a646928c06048d35827c68314
SHA512 56e2ec75b661a1f6d9ee8048284c1ee03bf66dde319e2e3b7ba9e0fb805050b2ca19af8a6d2e8aa878bd3c305eb94c6dd83d9624932c1c5df9140d83748c8dd3
SSDEEP 96:r1p/dM++/3Swb9okwdo5h16Z0h1s7/x+6MhmuecJhptMkkje4K+gCINI8XM1C7K:rXOb8DonrsV+FdXtwjUIeg6K
TLSH
T1D8D193065E28B97B4CC6E519BE35BA17E2F9502234D51E58E7FC892C08DB6CC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 db2ca0eba8127e683d969cce7f32c8fc00c5e37ab53748fd17bec3fbfb135207
MD5 bd771560b4fbb47abd9953a28d90b122
SHA1 981af84b3881b93b7bea1e60280abb91c532ecc7
SHA512 ab61b0c72178a424ff335c3081510c4bf71897cba37837279429af41b61860f05952614364e848dffe94e5956ceedca223cedcf6e7ae613d5bcf58f01132e973
SSDEEP 96:vhi/Plf/ROo1pkF5d1hi67VaTEv9V5h5pg5+e0DwuGZLBjDmWv1P1v:Qfv5y9ljjGnfPF
TLSH
T19AC1B7A3052CC574BF444BEBED393ACAE96600DF99D5480696E2C44806C1FFD21DE4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 88e45a99422b04ae6279c7d013bec837ab628f7d6e3deab530eb2b77d4860e2b
MD5 21ec52f808fdb8e69d0a0dbe625d2cab
SHA1 00590a66f7306b9e8a9395fc2d5da82ae0de3400
SHA512 01b2cc3199debc3a14d5b0f052ede4a81ff1ef2e568fe7fd2509ceb23d356f10cfa319a1153e1437aa033e13c72c18da6770e119b17ec0202823797c0bb93d7f
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 84c491419abdd469b54698c6823921f2558bb26705086f384ec2ade196b2b606
MD5 cb826a07ee1e132958c0a0fd471dfd08
SHA1 874ed35daf6ace14878b8ec5fcda76485babfe5a
SHA512 5170e52b87632c6529d8e0f2f59afd45aed2b3b5012f4eb2a8bd527db9fb5cce20c5469d03cb9a632f4216fe627ed21b7953aab0eb8253f70fef282022c6b7f9
TLSH
T136B012847B88913BD0D90E3E07C4CBE16330E203B900150348888F210FA73E42E208D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Site Characteristics Database\LOG
Size 313B
SHA256 c8e2a580f621c69030884845a18bc5c3ae2ae94adfa43edf9c37cfabfe50764b
MD5 59b2cf7a4ceedb9c7fcf23554d617afa
SHA1 ccda635bf3a1a7a75a967a8a765bf5ef78a6d02f
SHA512 d57da49553fe055d78600982c6baf02cb16757519c6e68677b56c2814ced4b5216c749f3762e23987e1081b56338b567d169bc676598988647ecca55d452a335
TLSH
T18BE02620E5C98A2727CA04AF0A72A30CC6667041FBCD17170F94EF88290B884B952700
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Sync Data\LevelDB\LOG
Size 287B
SHA256 0b204293fdacd4e4b767b98d1d807271eb1eea7f177ab2c23d5e3fbce4655a93
MD5 5f500924c2ee37e653ba130d23703510
SHA1 0dbd00924b92b04e5810263433ae4099a4b4322b
SHA512 6b9aa58edacb80cb6ea13d2043b20fd1c472ac1a891b021fafc12a93b3f6d886cd1b02ade8f84fd67d139af1c9123f501183ae1e6535fde8b13aabf68f45b36f
TLSH
T11DD0C230E5C485764AC8C9DB49B5A35DC6B0B855FBCD3B8E4F84EE482847549F970241
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Visited Links
Size 128KB
SHA256 2359ab37a06db1b053d3a4d90f30843fdc983cb8db10ffbfabc21edb7f13b380
MD5 37fd5b1f79abca8597225a08de95c97f
SHA1 9469a6b3906580f812d92b2c3e9b11c8d43e89b7
SHA512 107fc34c6da91271d514f31097fc4c7d73725488562e5ddd814580869f3a525b28344e13a6e72b76b582ce4a770684847163cb89d713e116e3bb1acefc6bbf3d
SSDEEP 3:ImtVfS5WpUlCNfblXl:IiV6+tT
TLSH
T1E8D3021207C55449C44550390AA0081C25AA410D552214461A366A1145D03062D1D553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\shared_proto_db\LOG
Size 285B
SHA256 94222405939f53207a7810645745e534cbf0f98b677b6c9bfc797b0059238f2a
MD5 ffb035b350bc86d5aa949101bdff3de5
SHA1 30488dd00e6dc43000815704a14c3f5ea91560ef
SHA512 b4d7528a0bf7d9ec59f7f386b057774120f5258157df2ab7ec637e958dd67da3dc86c998786d015daea5d8d9e567e4b6e7ed5a707dfbcecf524f2e09d28a7118
TLSH
T16DD0C211F885842B96E9499B18725389D7553456FF8C2E4F0F80DE4C284794AB961301
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\shared_proto_db\metadata\000003.log
Size 392B
SHA256 43ce1f02eb464b31ace742c30b3c86bd2f08f120541514ce4fd1b58f5ace1c65
MD5 d5aa634953f3d849b711f7cf29d1df87
SHA1 300eddc5f838ac20568f869c37131c4754331f40
SHA512 8ec1d472a319c3cc03be72d1c496b1e969dad497c28708873cc86b2a7d71642edb52297f65617f73842c762182e65313892fa70f784b500c0d17ca3259dd84f3
TLSH
T10EE02B07F320C400E00A827A103AA7220334E4459FB8ED0F4C3941102FB350E0D4F7D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Default\shared_proto_db\metadata\LOG
Size 303B
SHA256 72185b040032660f01fadc5d8c1eef3bd08d5c4d0a86df6f78b0c4cfeb976bfa
MD5 244856444c6813aceae9bcd42fc81831
SHA1 a42bd54120b8417ca5c6cb9ea00b333ceaaaa88f
SHA512 c36263eb2e0b27502168affad1ec34353f5ab851e16923f956923ad3d4c9cd7365b4122589aaac569d24396fa194cfb33effbbefd31d2e2a1d6ee64eebeeb9f5
TLSH
T1C5E0CD10F85884AB4A95459B04B15399D7553456FF8C1F4B0F84CE4C5847986B956301
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Local State
Size 1KB
SHA256 d9eeb7911768f2e77315c60cb37c39a109f461228cc696f4f36ee7236f540282
MD5 1cf287ce4b721af072a4110d85001f26
SHA1 8ebca9e2bcdf9d9240b51b83a7e6a2e32f124408
SHA512 09d465c3ac733cd8be08d0cafc1cf8e8775a0ce4a2840f7506330cbfeef8a0dcf50877555137a5d4bd80723cf3e709e95de9de0d3d4f8f919b81e2b98df4e8ab
TLSH
T11D21427299B4AF36BCB1A1512B56AB0BAE360067A1515E0016DD0B1D02E720C97AD83B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\PKIMetadata\72.0.0.0\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\ShaderCache\index
Size 256KB
SHA256 7e0bd9d9d7171db7b134df511bbb1d07648c64fd985f1025c0a795f884e413b0
MD5 749f363f063d8b4b3c658fe2adf60822
SHA1 1a4c7a54e1e0f5e23eab59800f0ba09db79e3053
SHA512 c66dc2fd5367b4b42d1732c569608ed1c7329632ad6133d081fc5eba6c95a64342f07828b1061bc1ff338b3d7bd32d7c4398361aa8fabe6ace7080d63b883af0
SSDEEP 3:LsOllllklkXlYymtll:LsUlPfmt/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

a384ff61-508f-4354-843a-22908651c02d.tmp

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\a384ff61-508f-4354-843a-22908651c02d.tmp
Size 3KB
SHA256 6bd638ea08dff571bc3e1bb527cbc1ac92378d74bcfdeaf02c9da56b0ba29507
MD5 cb2e673f3fd3aef319cf52faa531c447
SHA1 dea04eeb8c840ad3b716ec997b4ba5c7f1e25499
SHA512 6ea8d6bf45ea42e030101f16c41cf3f878133fd41a95ff3f3e402e2938df2fb599905d229142b19aa618dd12b6e7cae4e1303b312eb84e2c0bb57b30d3bd5a56
TLSH
T19861543669B4EA3B5DF2DA047A862B06F7765023E5953F94CAEC0F0D01D72881385C2B
MD5 SHA1 SHA512 TLSH

Submit Download

ecc63f81-7464-4c65-a940-982f2556d04f.tmp

Path C:\Users\Admin\AppData\Local\com.erone.arcana\EBWebView\ecc63f81-7464-4c65-a940-982f2556d04f.tmp
Size 16KB
SHA256 7b05a92561a0e9e62c07cfaf2295656630f49b4d035936e4bbed18ae0d8698ef
MD5 61be21ef533c32cd13535f6b0ff0d567
SHA1 68c613fad8e7f6b2ed6e71bf22d4e4dfa80cad26
SHA512 be3ceeb156075f6417a33a7303e63dad641dac5c8146423690cb35029901872730c011b5091d8c3b4ded5710a52bd9178173548dbd39bb34f17d9e6e25d25c33
SSDEEP 384:W+OBqImmJvGBLx3NaFMJFB3NBS7pPmyBDzkg6r+:DcvGtlNBG+Ta
TLSH
T1EE729D3A2CA5AE673CF7C509BB89274BDBB65253C0C47BE4C9EC9F0F116B1441382865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_1427511906\crs.pb
Size 284KB
SHA256 340643d368df6700a082071385780ba1d8212f35696137b0a44dd8538fa25ee1
MD5 280a97fbbf2e4b70813f616b487143d5
SHA1 804cd67da601cc1a9c248ee59ecb3585e7a0a625
SHA512 47beb2b1f2bd640d24e7793c313c38b42e3e394be9a4eb88c94ac261c5131a1585b39a2431e39326c9197aea29198fc0f60e1c737d354d71cc0f7e0a57c5cf68
SSDEEP 6144:KKqggR3NpUvYpVW+J2aKH66k8G1nT+uuBw1hhd0piFlXGq9V9t:KWsNpUvC2pIYTsTGG7
TLSH
T1C554CF960F383D12BFD2DEE466CCE93B3D79B6E06A6928162111C4F159927E07D8C42F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_1427511906\ct_config.pb
Size 24KB
SHA256 a7371e9e40f287ebfd8c444633ff1eef0cc3050b015f761dd16ed5ae8fa1f35f
MD5 84a749aff1727eb9f4c907b1fb1ab051
SHA1 117b3ada2b80e5e03c560fe4b8eef5e8e6a7d760
SHA512 dfc2c3c565cfd5194be7029184db9a5cf5ee50b3a510da52e509e7e630ec963107ff57d65324aac9983f67158b6cacf8c6d03113cae79dbb37b2a413b57627d3
SSDEEP 768:8oIO1NNHA5uAbuOCri7GrZ7gl3u6ksYCjMPI:c+OuAbXGjhsYCQQ
TLSH
T142B2A7BF61159F001753D50896F52BB6E133A3D6C8F3697DB1E28008F1872E961E867B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_1427511906\kp_pinslist.pb
Size 10KB
SHA256 71798e7f16d50ccfe2428fbc868f81949f592fbf7b8a64db4753e3fbba8a0d57
MD5 25b685289453d58201e61d13670b7105
SHA1 e3305c5defd136f91236ef6f06cc1536bceb4f38
SHA512 9fb8df9033e7ffb5a47b7a54b8f497a68a839976894a682d21d9d7e52ee8bd3bbc048ac2fb7a53b69d9ca807b42d1feeb17ad1e5eddacd27b46e72dc149dbeaa
SSDEEP 96:nxleRkDB0rBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gNn:3/DCrBnYQ5jlMacFwn2c9x
TLSH
T1A722F1B37904F99390E7E0BE1041F49AE937436540ADF98A528C4A7635F1F0729BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_1427511906\manifest.fingerprint
Size 66B
SHA256 d6eff41b92a45577a8985604359af6d1bdbac85d6e9dfe19438e8efc1bf01f9c
MD5 f6f7a2d4983e6c4b8331d71d5a6a7acb
SHA1 b62c452a4627992b16959d022e0cee50c0a0f294
SHA512 ac5b99ca8f28cab92572bfb5a9c3f4369ce2581d450f5f39d3f16e742f291e275e110f35be78596387e8ef4ac66117d0d878b47ef813df76c5259393c869f18f
TLSH
T1D5A0228B0E20A883300C300EE888B002332B030000882A0CF0F08EC0E8B80C8032E830
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\_metadata\verified_contents.json
Size 1KB
SHA256 a6ce8c1d0d27c54034e67a83270bf3fd2bdfcc45ffc4b9084357169c00c90f77
MD5 42b331a107b7320d16f115eb7872b3c5
SHA1 3438a81f13c76becc7eb8bf0a7881088e5ad358b
SHA512 afc9393c7a63ec8d95c708eab601ab76887e4600a03b10f3c8c6e6c78c1c48d8b8bc6f059f8f38e66f1e54c5040656b75b6d46b91a795f76dbb5d3c6ac59b333
TLSH
T12F31B7414DD5369EA14E42245AB873AB9F0E71B372C8A51DA9C5900CF4F914ACBD308F
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\_platform_specific\win_x64\widevinecdm.dll
Size 21.9MB
SHA256 e1f9ad648017e2cb0f0cd798d815dc51012b279ba32571e7b6eb5120b0ed2c05
MD5 046fdd0c07bbac0c160b03a2cea5ad4b
SHA1 fbe9107b962ff2c77070579a8769ce7188c4b473
SHA512 0a3e385a3d27883e6495e4cb4fd20bd5dd0c61176e04df2762fca9d13847c9ae88de7ac57648732ce6d6cce27f2eb9da4dbf9c54d1953504de784c4cb35c8fd2
SSDEEP 393216:DKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHk:MWCmz0dwJIkpqCw
TLSH
T15A37E14AE35350E9E81ECDF0866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\_platform_specific\win_x64\widevinecdm.dll.sig
Size 1KB
SHA256 868171d91275d1e180a452621f66428afec0a9288ab96344ce92fc904ac1f70d
MD5 c7bf17a2f118fdb4a4344196706b6393
SHA1 d07695b35bf2f4bd746586fe56ce2ae9d7c99f69
SHA512 11abb5b2ea4120df63216ac38aa85c8deaa7d96b9e0a8867b8f281b0652211f4600bd4107d182f3ea0c657d8a1675ff56d0279837a7c33410a7968f2c5a9a754
TLSH
T1742108F4A215A94A7F50C142053DE827CF3E8AC12C6188B644BFC23628EE7C00F8457C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\manifest.fingerprint
Size 66B
SHA256 56d1fe98928ebd4be664fc103e35673a15c2dfa98ff241478bbd39beb15a0754
MD5 bef72178d2d9f61006676a8323ac4a20
SHA1 281541cc22aaab5d71703791192ef66ee2e831ba
SHA512 ee3664c72ee9a894249799b642ed8c1f10b7a7a422d1277d7097f43b4f892d7b267200d323f861bb90b0436262da13dd3c674c4425dfdc264c1cce3755a593a3
TLSH
T154A022CE0CC208BC30008300FC8C8B222000282823280022F8A023CA32EF30AB000C02
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3928_2049164345\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1976-77-0x00007FF99A940000-0x00007FF99A941000-memory.dmp

Download

memory/2144-573-0x00007FF99B600000-0x00007FF99B601000-memory.dmp

Download

memory/2144-574-0x00007FF99B610000-0x00007FF99B611000-memory.dmp

Download

memory/2920-27-0x00007FF99A940000-0x00007FF99A941000-memory.dmp

Download

memory/4120-335-0x00007FF713CB0000-0x00007FF714865000-memory.dmp

Download

memory/5556-265-0x00007FF608280000-0x00007FF608E35000-memory.dmp

Download

memory/6084-636-0x000002DA11B00000-0x000002DA11B01000-memory.dmp

Download

memory/6084-644-0x000002DA11B00000-0x000002DA11B01000-memory.dmp

Download

memory/6084-647-0x000002DA11B00000-0x000002DA11B01000-memory.dmp

Download

memory/6084-646-0x000002DA11B00000-0x000002DA11B01000-memory.dmp

Download

memory/6084-645-0x000002DA11B00000-0x000002DA11B01000-memory.dmp

Download

memory/6084-643-0x000002DA11B00000-0x000002DA11B01000-memory.dmp

Download

memory/6084-642-0x000002DA11B00000-0x000002DA11B01000-memory.dmp

Download

memory/6084-638-0x000002DA11B00000-0x000002DA11B01000-memory.dmp

Download