856dbc31e64b9bacc7361d1a16801b8fb374d7e5c4a7a445456d06477820a7a3

Resubmissions

04/05/2026, 09:53

260504-lwtftsfz8s3

04/05/2026, 09:50

260504-ltwheabw6q6

Analysis

user interaction
yes
max time kernel
61s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shallot-sandbox.exe
Size 1.4MB
Sample260504-ltwheabw6q
SHA256 856dbc31e64b9bacc7361d1a16801b8fb374d7e5c4a7a445456d06477820a7a3
MD5 e3cbc1df82e1f637a09f61831a920c44
SHA1 9a53fd893383cbe66e10f87d5f90a5cc45a7e930
SHA512 4703c74a1d9ea3e553cfdfe21b6c0557a2627aa2cd8d477f98bf86e55a0c6f64840429679c88e6fc04c680058a1ecce019be8a71207fe7837f6f1a1cd0b1135d
SSDEEP 24576:CsES7U51gqrIqVGAKR1JL7hQ3RfJgJq0zejRnJiJ96G2n:pESoCqrAAKR1JL7hQ3BJgJq0yjR+Wn
TLSH
T1C3657C43F69282E8C02AC0779316A233FA76788D07213AE75695D7243E6DFD0DB39794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	shallot-sandbox.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\devmgmt.msc	mmc.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_fsreplication.PNF	mmc.exe
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\c_smrdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_ucm.PNF	mmc.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	mmc.exe
File created	C:\Windows\INF\c_sslaccel.PNF	mmc.exe
File created	C:\Windows\INF\c_scmdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_swcomponent.PNF	mmc.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File created	C:\Windows\INF\oposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	mmc.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	mmc.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	mmc.exe
File created	C:\Windows\INF\c_scmvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	mmc.exe
File created	C:\Windows\INF\c_media.PNF	mmc.exe
File created	C:\Windows\INF\c_netdriver.PNF	mmc.exe
File created	C:\Windows\INF\c_fsencryption.PNF	mmc.exe
File created	C:\Windows\INF\dc1-controller.PNF	mmc.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystem.PNF	mmc.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	mmc.exe
File created	C:\Windows\INF\c_fshsm.PNF	mmc.exe
File created	C:\Windows\INF\xusb22.PNF	mmc.exe
File created	C:\Windows\INF\c_monitor.PNF	mmc.exe
File created	C:\Windows\INF\c_smrvolume.PNF	mmc.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe
File created	C:\Windows\INF\c_linedisplay.PNF	mmc.exe
File created	C:\Windows\INF\rdcameradriver.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File created	C:\Windows\INF\remoteposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\wsdprint.PNF	mmc.exe
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_processor.PNF	mmc.exe
File created	C:\Windows\INF\rawsilo.PNF	mmc.exe
File created	C:\Windows\INF\c_camera.PNF	mmc.exe
File created	C:\Windows\INF\c_holographic.PNF	mmc.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\ts_generic.PNF	mmc.exe
File created	C:\Windows\INF\c_display.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File created	C:\Windows\INF\c_firmware.PNF	mmc.exe
File created	C:\Windows\INF\c_proximity.PNF	mmc.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	mmc.exe
File created	C:\Windows\INF\c_volume.PNF	mmc.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	mmc.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	mmc.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	mmc.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	mmc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223618358750544"	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2208	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2372	mmc.exe
Token: SeIncBasePriorityPrivilege	2372	mmc.exe
Token: 33	2372	mmc.exe
Token: SeIncBasePriorityPrivilege	2372	mmc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3824	shallot-sandbox.exe
3824	shallot-sandbox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2372	mmc.exe
2372	mmc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 2208	3824	shallot-sandbox.exe	84
PID 2208 wrote to memory of 3620	2208	msedgewebview2.exe	85
PID 2208 wrote to memory of 4456	2208	msedgewebview2.exe	86
PID 2208 wrote to memory of 4456	2208	msedgewebview2.exe	86
PID 2208 wrote to memory of 4456	2208	msedgewebview2.exe	86
PID 2208 wrote to memory of 4640	2208	msedgewebview2.exe	87
PID 2208 wrote to memory of 2000	2208	msedgewebview2.exe	88
PID 2208 wrote to memory of 2000	2208	msedgewebview2.exe	88
PID 2208 wrote to memory of 2896	2208	msedgewebview2.exe	89
PID 2208 wrote to memory of 2896	2208	msedgewebview2.exe	89
PID 2208 wrote to memory of 2896	2208	msedgewebview2.exe	89

C:\Users\Admin\AppData\Local\Temp\shallot-sandbox.exe
"C:\Users\Admin\AppData\Local\Temp\shallot-sandbox.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=shallot-sandbox.exe --user-data-dir="C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3824.1696.17398330785536005344
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x11c,0x7ffc1ed6b078,0x7ffc1ed6b084,0x7ffc1ed6b090
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView" --webview-exe-name=shallot-sandbox.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,3793120713706580947,9687285575108631626,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView" --webview-exe-name=shallot-sandbox.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,3793120713706580947,9687285575108631626,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView" --webview-exe-name=shallot-sandbox.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2040,i,3793120713706580947,9687285575108631626,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView" --webview-exe-name=shallot-sandbox.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3680,i,3793120713706580947,9687285575108631626,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:2896

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:216

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ddd8e9baac65a8936859bd36913285b5c5264b9121d283e72a7cc4da23462478
MD5 7d484d09e77d6e345efb0eb0fc73acb1
SHA1 f1cd9ca302a1e477b61100d255cf0c4cc1ce005a
SHA512 6ad5f991b2b12778d76411573d1841faa7d11561196f22577cc446bd5946196c9423da60efc3e52d4aa33daa11c9f004b66f2c5236afb4907bc412176935749b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3c6e03952009a56939da3061cb4aefcc6d50179ad9fc4f29a8878e6ba9a330cc
MD5 8e99dda9bbb1c5f49e570a5a94cff00c
SHA1 e63e9713887e2d431f8b8e27960871d0ed97cdec
SHA512 9105cca15ac7831d48344adaf18d3584e9c80a275ebdd1c56247d3d42eb710e62d4ff74de30f5b2a69b36ebd0a30bc73829599f1a20c9c8f6160d1a3146d17c9
TLSH
T1CFD024133F571734C01135330033714D1473D35F44054000547DC51D1F344541D43441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

573fbd3f-fa52-4e12-865c-b38c5dfb1f81.tmp

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\573fbd3f-fa52-4e12-865c-b38c5dfb1f81.tmp
Size 6KB
SHA256 42ed28b24b8a356a1d790ac0f98c447770b32c6ee861cbbde5e1832949f56ba9
MD5 a1fcf6309ca79a620129a1371268fd14
SHA1 b063894b15c02315d469b2504d79bf8cf27d8e2d
SHA512 2c758256edd7bbd77b90ab786b2a8fb418fc0f4f7b7cc715c7ee899be7c5e35f9acd887b69e277b01f7b6fc176ee6ebc97d5fa21f45e5aa2a2aeae9ab3966b81
SSDEEP 192:st00UbwhfQZ8pag5/S+WitqSwdNZwXBM8:stFQWXx/VFwts+8
TLSH
T14BD198439E2869774CC7E259BA35FB52E2F5206166D44E98ABFCC61C08E66CC330790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8b3f69f5764616a37174e19ccac7bbe661b2083d1992aff654ab9220c83d6fab
MD5 53698ce1c1fac16196c560bc4a8917b9
SHA1 f83e2a475be3a0f6258b100b357ea490d56fbd58
SHA512 62359a6c2c385a8d8ef6332e8d2328148dca03c176da23e67f5a6e8bd602531846c0b5b6bcecc65e69b7971a33d9ee4717671278d214b019f7b662ba346aa1ad
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2b11da9dd1aa22213990cabdc4686c645a918ff39161b2c4d2d91db0b8619d2e
MD5 e54e5f22dfd62424a5c48bb52ea13e41
SHA1 3fd5316f0c093f3774d02abb752e6d5ca90b113b
SHA512 b71c038c0495e69735e0e8d565db5143f7d57d67709839c1220d9ea974a23491a4f4f2a8dab150f27ba94cd530fb90d32081dc031fca743aeb4ff18915617eda
TLSH
T10DA002A4228094DBC5546778D0C55380733C4F9546634E1295A140AD8E753805157142
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 f29800580455ff73a120ef37e1d095008b5835d19a03329d65c5be84b2f45e99
MD5 ffb2bd7cc4cf44895fe4db0d724da7cc
SHA1 78ae4412c02856568acb9034608060b835ae4fb4
SHA512 c88482a85558b807c97fce3f1715d27c1b885f2553b047583ea87558cebe69cc64fdb53938c047a716d9a0619906d4821a3ca7657d2906ff90842b8059f88af3
SSDEEP 3:LstlNllkll/lyl:LsX3lEt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\Preferences
Size 6KB
SHA256 4b50bebf7939c34bf72d13583b55d2a5c61ebd552450d4d7d62266e26024657c
MD5 3cd355269b1f93e181b2e759f3a46f66
SHA1 0a0f71f5ca0aaf819ffdea7cd6a00bbba170b15d
SHA512 14c60f8446c08b8c635d06c9bc12be12a05b1e5f5333a51878459ffda11a50d18c23ffc2604954ab32e9eb2ab5de7ec8895737e0235c6595824777deb4193d6b
SSDEEP 192:st00Ubw0fQZ8pag5/S+WitqSwdNZsXBMC:stFQrXx/VFwto+C
TLSH
T1F8E1A8439E2869774CC7E2597935FB12E2F5506266D44E98ABFCC60C05E66CD330790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Local State
Size 16KB
SHA256 6cad014cfea6c06e1fb2362694cbdf078e2ddab7d6eb1e9b0b0958cfa0dc9581
MD5 de31ad86185934dc278a283a22896b5b
SHA1 cf934957df073337de52e861c151f2c4371a5ed6
SHA512 046b3dbe4d0ce320a61b3f21f0428c10e9afe6942dbfd7b2d8e47d195bd2b4a0261e821e8444dc355a6febc6734af3f1ddcf010611a06a81d9b3a833d20ff97e
SSDEEP 384:zUfTPLdSWCUkEaV8DNYi0qnSXaqZv6NbkeinzEui6S:sTRMUVai1SKqvLzg6S
TLSH
T10072AE63AC34DA2B18BAD955E617370B99F8D054C2E52F0EDDEE9F0E06D62C81312C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Local State
Size 1KB
SHA256 63648437d5d5ed4873715b8907119a0cb71937f53dbb88f690f1d951c9010cc8
MD5 957a60f655a0af74f47e62d401b22a1d
SHA1 43bdc056a666c3820e10d9e4843ade2cf0645a27
SHA512 f3ff107506800be0872b6aa40cdbca976a0211cf8cce0a1de70fbc920fc8142ab4b708b4e75e00ea0b944232524477f44c7ace7b7845257af9fcb909b137eac5
TLSH
T1AF316573D4546F375892E185F245BB1B2FB0506A92914F04A2CE8F1D22FF1CD6626C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Local State
Size 2KB
SHA256 4ad8562f40df3f749862a5f2e3a9719c1ec2caaf612fa3609ca6ad211a3a3df8
MD5 81f5a3473bb6a9934dc487e6dc112825
SHA1 3b22d89ca1344a941eff59b7711a91e3482b3bdb
SHA512 be577d57d6207e3bb0354e7e3366fb31c343b8aa95dc7b6e95efc3b0759e8e379606f171debc13541e1eb8dbebab5d7d823dcdcb56c02fe9224f494dca8510fb
TLSH
T1F0519733A814AB3789E3D684B94A7B16AF75906597911F5096DE4F0C11EF19C2302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Local State
Size 3KB
SHA256 00962472444f9575cbd9581bc45095ca2f153d4b81cbbc8fc623d60a57f04aa8
MD5 a0b135da265432ac87b8e325228e7270
SHA1 29887f17ebf8824a0d810d549f632b9e10afe9df
SHA512 bf72bc78418cbbfc0c14dbbd8923d307bf8e2d61ef016cee23a17a162f5f9c96f4cb299d91198ec2bc3daf51368fe9e0f230e8a8dd8867543ffcb51ee404568c
TLSH
T14771A733A564AA374DE3D944F9853B167BA55027E6D13F95D6ED0F0D01EB2C82341C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Local State
Size 16KB
SHA256 5ed691226800e2748829260ba92ae7e4c4605c759eb8d62a74bbeae2740a2701
MD5 0052357a2ba0a09c35d7b417ccc69a75
SHA1 9a15f861b2c24575332a797ba1f39b20645c54bf
SHA512 67bf4407a6ceb3c83b9b0973527a74289d58baa558373edb3bac4acece23fb0d6e5d140659991c56c3c1995b901368526a6875e09bb10e09f6e78256010c8bf6
SSDEEP 384:zlfTPLdSWCUkEaV8DNYi0qnSXaqZvsNbkeinzEui6S:dTRMUVai1SKqvFzg6S
TLSH
T10F72AE63AC349A6B18BED955E617370B99F8D054C6E52F0EDDEE9F0E06D61C80322C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58561a.TMP

Path C:\Users\Admin\AppData\Local\shallot\shallot-sandbox\webview\EBWebView\Local State~RFe58561a.TMP
Size 1KB
SHA256 2a25f5d0d438c2f8aa9b0120d71c1dafdc553d39a507daf9fcd1e08277e2287a
MD5 f78338555550ca07d79dc7d929e946ff
SHA1 fc2decec73c1715d93850f9b8f0fd1801fa28798
SHA512 b773f15b68e37ed4f3f3cf638f109de5413770ca9c5d42b9a49ef76a078a9c7d642ef213ea1e91334a1b672b1273b249b959962dc9ba07e2fa82e66867325478
TLSH
T156216273C0546F37A9929495F202B70A2FA0606992904F08E2CE9B1922EF0CD5636C3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/216-322-0x0000000002070000-0x00000000020B5000-memory.dmp

Download

memory/2000-98-0x00007FFC39E90000-0x00007FFC39E91000-memory.dmp

Download

memory/2000-97-0x00007FFC3AA20000-0x00007FFC3AA21000-memory.dmp

Download

memory/2208-224-0x000001FB2AFC0000-0x000001FB2AFEC000-memory.dmp

Download

memory/2208-225-0x000001FB35AB0000-0x000001FB35AD7000-memory.dmp

Download

memory/2208-226-0x000001FB35AE0000-0x000001FB35B1B000-memory.dmp

Download

memory/2372-334-0x0000000005440000-0x000000000551A000-memory.dmp

Download

memory/2896-144-0x00007FFC3ADF0000-0x00007FFC3ADF1000-memory.dmp

Download

memory/4456-36-0x00007FFC3ADF0000-0x00007FFC3ADF1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads