59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe
Size 14.7MB
Sample260714-dcf3dse13w
SHA256 59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e
MD5 0353987584421e98013aa06872b97360
SHA1 e0d63bfd6b06076258c3e047c430c2f6f97517b8
SHA512 32ca5eea6f600e10ba43eeb69dfa022dd353417cb5660337aaa05e18731d645dd55aa79b62f23e094004fa3865b1d5df0e39469c4229b6b6fd29db1bbf3f87fb
SSDEEP 98304:y6LjlQvZcHOaKY83T6lVzfCPisggmkhjfCcaFfkN/2vAKqbGr37JG9Kcm2wlvFON:y6LjlQ+m93O+A/2wvO2bX9G1
TLSH
T17CF6E561BB9B996CD05BC4B483478A76497130CB0B35B9BF448496382F6EBF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1035497553\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1035497553\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1092169564\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1035497553\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1035497553\metadata.pb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2948	msedgewebview2.exe
2948	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4344	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2472	59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4344	2472	59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe	87
PID 4344 wrote to memory of 3616	4344	msedgewebview2.exe	88
PID 4344 wrote to memory of 5560	4344	msedgewebview2.exe	89
PID 4344 wrote to memory of 5560	4344	msedgewebview2.exe	89
PID 4344 wrote to memory of 5560	4344	msedgewebview2.exe	89
PID 4344 wrote to memory of 5560	4344	msedgewebview2.exe	89
PID 4344 wrote to memory of 936	4344	msedgewebview2.exe	90
PID 4344 wrote to memory of 6008	4344	msedgewebview2.exe	91
PID 4344 wrote to memory of 6008	4344	msedgewebview2.exe	91
PID 4344 wrote to memory of 6008	4344	msedgewebview2.exe	91
PID 4344 wrote to memory of 1748	4344	msedgewebview2.exe	92
PID 4344 wrote to memory of 1748	4344	msedgewebview2.exe	92
PID 4344 wrote to memory of 1748	4344	msedgewebview2.exe	92
PID 4344 wrote to memory of 1748	4344	msedgewebview2.exe	92
PID 4344 wrote to memory of 1748	4344	msedgewebview2.exe	92
PID 4344 wrote to memory of 2440	4344	msedgewebview2.exe	96
PID 4344 wrote to memory of 2440	4344	msedgewebview2.exe	96
PID 4344 wrote to memory of 2440	4344	msedgewebview2.exe	96
PID 4344 wrote to memory of 2664	4344	msedgewebview2.exe	97
PID 4344 wrote to memory of 2664	4344	msedgewebview2.exe	97
PID 4344 wrote to memory of 2664	4344	msedgewebview2.exe	97
PID 4344 wrote to memory of 2948	4344	msedgewebview2.exe	98
PID 4344 wrote to memory of 484	4344	msedgewebview2.exe	99
PID 4344 wrote to memory of 484	4344	msedgewebview2.exe	99
PID 4344 wrote to memory of 484	4344	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe
"C:\Users\Admin\AppData\Local\Temp\59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2472.2640.13919571879626605108 /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView /prefetch:4 /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x50,0x7ff96a9a5fd8,0x7ff96a9a5fe4,0x7ff96a9a5ff0
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView" --webview-exe-name=59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,7674331454126509939,17301458258481344048,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView" --webview-exe-name=59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1784,i,7674331454126509939,17301458258481344048,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView" --webview-exe-name=59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1784,i,7674331454126509939,17301458258481344048,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView" --webview-exe-name=59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1784,i,7674331454126509939,17301458258481344048,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c /prefetch:1
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView" --webview-exe-name=59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=1784,i,7674331454126509939,17301458258481344048,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView" --webview-exe-name=59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4360 --field-trial-handle=1784,i,7674331454126509939,17301458258481344048,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView" --webview-exe-name=59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4576 --field-trial-handle=1784,i,7674331454126509939,17301458258481344048,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2948
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView" --webview-exe-name=59bc986583ee41ff695cc557eabc02d7f5f56d133dd2f233e6657594f582004e.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4512 --field-trial-handle=1784,i,7674331454126509939,17301458258481344048,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d5a5bff5520f6f4ef975bdb2026558bcf7a5aa0c
    3⤵
    PID:484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0a7a29433f0f5d7829429f2a6543ab4bb3c9598df123466378ea2e71c2efa61e
MD5 8c2624f39f02fad48cf917cd0e69d5dc
SHA1 49e4dcdb7cfd67046c9f61a75a1ee8f4d1290ff2
SHA512 8c34deb82946e943455f96d813d4cf653678d821c19b266c089925c101e87b9990c7e4cd8e0df0e457956fcad42ee35825ce9744aaeea1cdf1993b98ad704513
TLSH
T17BD024333307413CC43430331C43710CDC01C11F40054015543CC51D7F044500F134C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e98694c1c5ce4e3bff98f7a2b91e1e7d3b0f41c8a872ffa5b8f51f8ee972ef23
MD5 192fac5345b10bfb1193e6a8afe94c86
SHA1 cbf82c614f27762938250ab0e05daaf2d9922e7a
SHA512 742f79d80b2c5ad2642af67b3f99912c4da1da578fce861eb534ab68d930ab9f06e30c655ec7590886a96e2613821f7274ad26ac68511cd4b61e6ba84a9b65e3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9f43cec10783bfa8cdc62cc87dd019d4ee4939fb6a524debd5a5547b18144429
MD5 cbdb5ead5fc1bbf1e598dffd64ea514b
SHA1 6503c2d357736d503e7296ff557a62da6d8c8c88
SHA512 cb05d0d72452f36005f127f49d19f829890473e4565f7ecb3722c3474d9ee5545862d835afc02b74fdf5f65a591dd33fd365500aed88c9857dd1000c93617b00
TLSH
T15EA0021651910062C1902B7896E2064C36315FB01A93A601A5E485F5CA70B64F186440
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5917c4.TMP

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5917c4.TMP
Size 48B
SHA256 6c8375122cca19b61ba87d0a5888c2b35784f555a80046dcea6225efb3efb945
MD5 bf7e3b0b3488e541960a0e2e97a64c12
SHA1 d405ab8ec29df0b7f381f7b507242c625340e0c1
SHA512 db3d4c6971aeceff753d862604d1104a0a1149d31b67da43182ffd487fe0bd3d773fb6888ab85568fe6ef1b349c575677507f6fe9849dff8c7424c08eb06c28c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Default\Network\Network Persistent State
Size 236B
SHA256 ebf0227bc213f4b1cdb16330e2e056547ef42c1c71999a2f4fc0e0e83d14901d
MD5 a68b589508fe8f1d7d4d6ed293d4a857
SHA1 3e4a7b481381d1cb38c1937adc68d1aa67d037f2
SHA512 1dd3248222873b96ee5ff937a2fb635f58a8b4c1fe7f924e105ba3d6f583b2580a427101e77c52199b365991b62536410bc248e1d93d8a8ab71134b38406111d
TLSH
T137D097A28270A8FF074183A02A246C0BCA7F0002521C4E3ACAA87B764BA20B8D02080B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59dd75.TMP

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Default\Network\Network Persistent State~RFe59dd75.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Default\Preferences
Size 6KB
SHA256 ae93b747a0e40261295d17ccd1007fb4df35c601a560165f757187df46f8f818
MD5 07683af91e8b1ee7244f8768497eb1a4
SHA1 8893b7df2ded9831419033ccbeedc54e77041a1c
SHA512 d90862c562397979a5b473a666006a5ace9a7f1b1dde70e92e49ab63eeed2546b58e9d98c70d77c64d9c755ac93d96feaf2f9d2ff51162eea24f3aa9c8bf26bb
SSDEEP 96:st1/dTZ7G1VFb9fkso5h16Z0ys7/x+6MhmuecJdC1eje0K+gQ+28XM1C7K:stpR2f3onysV+FddCQjsu+G6K
TLSH
T187D1D9025E2869BB4CC7E519BA357B57E2F9A07261D12D4CE7F84A1C09EB6DC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b72f2713-0993-4c3a-ad50-ff43a80c2cdc.tmp

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Default\b72f2713-0993-4c3a-ad50-ff43a80c2cdc.tmp
Size 6KB
SHA256 97473de1ca954ec13cb7e78ee74e8c06c2a303d15be01eb194bf8e1ba8a508ad
MD5 7cdd902ad9232de5e4335557fe19174a
SHA1 cfe68cc0ef491f3beb4ea0a5f9945e99a7c4bb4b
SHA512 fa6dcaacd095766838058451875566272cfeb0e5bf10f7f51c59e6453e2049147ac908c43d2d530f38c457906aefd66dbed539985c7c26889d0b58d9b044a62e
SSDEEP 96:st1/dTZ01VFb9fkso5h16Z0ys7/x+6MhmuecJdC1eje0K+gM+28XM1C7K:stpRwf3onysV+FddCQjsK+G6K
TLSH
T181D1B7025E2869BB4CC7E519BA357B5BE2F9A07261D52D5CE7F8461C09EB6CC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Local State
Size 2KB
SHA256 40a425a737155fe43bf2ee44bc5790ef04fbf3a3d36a45aad004c20774f2bd61
MD5 e7c8430d4d5e632e3dfbf93ba86dc510
SHA1 e467b26ce65e08f1abec3cb5e52559c3530c4be1
SHA512 9cace398a5380eafff9e5e0bc333310ba33328b6b99d10a5bde862f5f9537ff6df299261f345e4603b8db9aafcade3fddd30eac63892cf38101ff0bfcc459517
TLSH
T1855184336C506A3B96E296197D0A7F57DEB950A59B523F189BDC0B0C05DBA4C2303C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Local State
Size 15KB
SHA256 7261f5095fa49a0c9dc73f00db02809b98e02578795b7aaf6641b77e4e7cf2bb
MD5 2616293646b0748598fe170a4bd1a0b6
SHA1 a31654e136b025fdab67419572fa02a4c0842b54
SHA512 e8aa8e0c0e16290fbea1cf3ae853d2426b6b527cec0ee18ecc12e062cc4a3777c1a637d750c0fd4a09e8f01da0497baa7468acb6584094682aae25500afd66c5
SSDEEP 384:esrv+89zHqlDNP9oid6NBS/KJFvwhwyMisdkNf:Jrv+4UNbdmXyMisCNf
TLSH
T1D772B033B43866379EF2D905F84AAB0B7BBC609A56C25B64D9985B8C42DF4CD2307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Local State
Size 3KB
SHA256 db0730d25a70795da8f2d20815b793c70d561d6cbb649e65219242f17b4ceac1
MD5 2bf7a1d295525a796578f2fc82d0a194
SHA1 35e3a43354340ac3a9a777670ebf4a1bef43580f
SHA512 a4dfe310bd777cd58362b6ae30888733d6e0bc1e505e7776ac024ec631343e5bc29e2a3af769b674efd478e6a6ef053ac0096c5661a3c2796ce9df3ca0facfb7
TLSH
T1C571967B69A0A93B4AE396197C453B4BE7A55066D9923F58DAEC0F0C01D778C1343C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58c58d.TMP

Path C:\Users\Admin\AppData\Local\top.ehre.modfied\EBWebView\Local State~RFe58c58d.TMP
Size 1KB
SHA256 55521db18da48c55bf915ee7609717bbcb4b7cd56a1907f3fd5b4cb392fd9f58
MD5 5ed53494099dd55dccabf2d87549eb9d
SHA1 2fac144bec3a7ac45edc4ce17df6fdd8c6f05a18
SHA512 7dd389b19a9b006e234a3b135208c287bcf2778f140129831140c5ce651ccdaff78c8483d059b6ccc720ab63979fae2dbeefc187ac02d4fda8f5f9c35a743b24
TLSH
T1DA3199B299D01E37AD56731B3A057ECBDF6510AA82421F086ACC470C16E758C572BC32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4344_1074813065\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1748-77-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download

memory/2440-243-0x00007FF98B160000-0x00007FF98B161000-memory.dmp

Download

memory/2440-242-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download

memory/2948-322-0x0000024E5A680000-0x0000024E5A681000-memory.dmp

Download

memory/2948-321-0x0000024E5A680000-0x0000024E5A681000-memory.dmp

Download

memory/2948-320-0x0000024E5A680000-0x0000024E5A681000-memory.dmp

Download

memory/2948-319-0x0000024E5A680000-0x0000024E5A681000-memory.dmp

Download

memory/2948-318-0x0000024E5A680000-0x0000024E5A681000-memory.dmp

Download

memory/2948-317-0x0000024E5A680000-0x0000024E5A681000-memory.dmp

Download

memory/2948-313-0x0000024E5A680000-0x0000024E5A681000-memory.dmp

Download

memory/2948-311-0x0000024E5A680000-0x0000024E5A681000-memory.dmp

Download

memory/5560-26-0x00007FF98CD10000-0x00007FF98CD11000-memory.dmp

Download