c80bd45ff8b68ac28f62f67a01bbc12dfc61da50746a0adf3d02c06a86da33f7

Analysis

max time kernel
33s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Torix Tools.exe
Size 9.2MB
Sample260718-vg29vsbv7t
SHA256 c80bd45ff8b68ac28f62f67a01bbc12dfc61da50746a0adf3d02c06a86da33f7
MD5 8b6fadb0f35ad69fce7cd1253c082ac0
SHA1 075868b53486acc08d61820a5654f9f177a0eb39
SHA512 a592c08f007f3c32e56389a3a93d7929a71e78a80cc057f963065166b7c6096b7ed20c70f73913fdd7124c285cfd3b8087519915bc25364f61e9a043b860ec70
SSDEEP 98304:pBKd/8lvpWHyy4hU4oJarM0/IWb7SJqshzKa18VoDLS51DQbD8q8eIb:pEV8lvpoypO4A0IA7DsHCCDSEng
TLSH
T113A6AD1BA66901F4D0A6D138DA838C13F671748A473197EB3B9C46161FE7BE0BE39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5180	powershell.exe
1856	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5992	Torix Tools.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Torix Tools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Torix Tools.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Torix Tools.exe
File opened (read-only)	\??\J:	Torix Tools.exe
File opened (read-only)	\??\M:	Torix Tools.exe
File opened (read-only)	\??\N:	Torix Tools.exe
File opened (read-only)	\??\T:	Torix Tools.exe
File opened (read-only)	\??\A:	Torix Tools.exe
File opened (read-only)	\??\R:	Torix Tools.exe
File opened (read-only)	\??\U:	Torix Tools.exe
File opened (read-only)	\??\Z:	Torix Tools.exe
File opened (read-only)	\??\I:	Torix Tools.exe
File opened (read-only)	\??\V:	Torix Tools.exe
File opened (read-only)	\??\W:	Torix Tools.exe
File opened (read-only)	\??\X:	Torix Tools.exe
File opened (read-only)	\??\Y:	Torix Tools.exe
File opened (read-only)	\??\D:	Torix Tools.exe
File opened (read-only)	\??\H:	Torix Tools.exe
File opened (read-only)	\??\K:	Torix Tools.exe
File opened (read-only)	\??\L:	Torix Tools.exe
File opened (read-only)	\??\O:	Torix Tools.exe
File opened (read-only)	\??\P:	Torix Tools.exe
File opened (read-only)	\??\Q:	Torix Tools.exe
File opened (read-only)	\??\S:	Torix Tools.exe
File opened (read-only)	\??\E:	Torix Tools.exe
File opened (read-only)	\??\F:	Torix Tools.exe
File opened (read-only)	\??\B:	Torix Tools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Torix Tools.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4964	tasklist.exe
4316	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2952	cmd.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6096	cmd.exe
3760	net.exe
1968	net1.exe
1872	cmd.exe
4804	net.exe
2044	net1.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4232	timeout.exe
4544	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1628	Torix Tools.exe
1628	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5180	powershell.exe
5180	powershell.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe
5992	Torix Tools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1956	msedgewebview2.exe
4892	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	tasklist.exe
Token: SeDebugPrivilege	4316	tasklist.exe
Token: SeDebugPrivilege	5180	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 6096	1628	Torix Tools.exe	89
PID 6096 wrote to memory of 3760	6096	cmd.exe	91
PID 3760 wrote to memory of 1968	3760	net.exe	92
PID 1628 wrote to memory of 3576	1628	Torix Tools.exe	93
PID 3576 wrote to memory of 4132	3576	cmd.exe	95
PID 1628 wrote to memory of 1956	1628	Torix Tools.exe	96
PID 1956 wrote to memory of 716	1956	msedgewebview2.exe	97
PID 1956 wrote to memory of 468	1956	msedgewebview2.exe	98
PID 1956 wrote to memory of 468	1956	msedgewebview2.exe	98
PID 1956 wrote to memory of 468	1956	msedgewebview2.exe	98
PID 1956 wrote to memory of 468	1956	msedgewebview2.exe	98
PID 1956 wrote to memory of 6000	1956	msedgewebview2.exe	99
PID 1956 wrote to memory of 916	1956	msedgewebview2.exe	100
PID 1956 wrote to memory of 916	1956	msedgewebview2.exe	100
PID 1956 wrote to memory of 916	1956	msedgewebview2.exe	100
PID 1956 wrote to memory of 4572	1956	msedgewebview2.exe	101
PID 1956 wrote to memory of 4572	1956	msedgewebview2.exe	101
PID 1956 wrote to memory of 4572	1956	msedgewebview2.exe	101
PID 1956 wrote to memory of 4572	1956	msedgewebview2.exe	101
PID 1956 wrote to memory of 4572	1956	msedgewebview2.exe	101
PID 1628 wrote to memory of 2952	1628	Torix Tools.exe	102
PID 2952 wrote to memory of 4544	2952	cmd.exe	104
PID 2952 wrote to memory of 4964	2952	cmd.exe	105
PID 2952 wrote to memory of 4588	2952	cmd.exe	106
PID 2952 wrote to memory of 4316	2952	cmd.exe	108
PID 2952 wrote to memory of 4392	2952	cmd.exe	109
PID 2952 wrote to memory of 5992	2952	cmd.exe	110
PID 2952 wrote to memory of 4232	2952	cmd.exe	111
PID 5992 wrote to memory of 1872	5992	Torix Tools.exe	113
PID 1872 wrote to memory of 4804	1872	cmd.exe	115
PID 4804 wrote to memory of 2044	4804	net.exe	116
PID 5992 wrote to memory of 1212	5992	Torix Tools.exe	117
PID 1212 wrote to memory of 4836	1212	cmd.exe	119
PID 5992 wrote to memory of 4892	5992	Torix Tools.exe	120
PID 4892 wrote to memory of 5112	4892	msedgewebview2.exe	121
PID 5992 wrote to memory of 5180	5992	Torix Tools.exe	122
PID 4892 wrote to memory of 5908	4892	msedgewebview2.exe	124
PID 4892 wrote to memory of 5908	4892	msedgewebview2.exe	124
PID 4892 wrote to memory of 5908	4892	msedgewebview2.exe	124
PID 4892 wrote to memory of 5908	4892	msedgewebview2.exe	124
PID 4892 wrote to memory of 5560	4892	msedgewebview2.exe	125
PID 4892 wrote to memory of 3136	4892	msedgewebview2.exe	126
PID 4892 wrote to memory of 3136	4892	msedgewebview2.exe	126
PID 4892 wrote to memory of 3136	4892	msedgewebview2.exe	126
PID 4892 wrote to memory of 4664	4892	msedgewebview2.exe	127
PID 4892 wrote to memory of 4664	4892	msedgewebview2.exe	127
PID 4892 wrote to memory of 4664	4892	msedgewebview2.exe	127
PID 4892 wrote to memory of 4664	4892	msedgewebview2.exe	127
PID 4892 wrote to memory of 4664	4892	msedgewebview2.exe	127
PID 5992 wrote to memory of 1856	5992	Torix Tools.exe	128

C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe
"C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\cmd.exe
  /c "net start w32time"
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:1968
- C:\Windows\system32\cmd.exe
  /c "w32tm /resync /force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:4132
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-features=MojoIpcz --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=1628.4260.5447471162003307468 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView /prefetch:4 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8e36f5fd8,0x7ff8e36f5fe4,0x7ff8e36f5ff0
    3⤵
    PID:716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1736,i,3596447097447333153,9828098525654480356,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:2 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1960 --field-trial-handle=1736,i,3596447097447333153,9828098525654480356,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:3 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1736,i,3596447097447333153,9828098525654480356,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:8 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --enable-gpu-memory-buffer-video-frames --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3348 --field-trial-handle=1736,i,3596447097447333153,9828098525654480356,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba /prefetch:1
    3⤵
    PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4544
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq LoaderNeon.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- - C:\Windows\system32\find.exe
    find /I /N "LoaderNeon.exe"
    3⤵
    PID:4588
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Loader.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Windows\system32\find.exe
    find /I /N "Loader.exe"
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe
    "C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe" --post-update
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Windows\system32\cmd.exe
      /c "net start w32time"
      4⤵
      System Time Discovery
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\Windows\system32\net.exe
        
        net start w32time
        5⤵
        System Time Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4804
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start w32time
        6⤵
        System Time Discovery
        
        PID:2044
  - - C:\Windows\system32\cmd.exe
      /c "w32tm /resync /force"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /resync /force
        5⤵
        
        PID:4836
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-features=MojoIpcz --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=5992.3668.14500640476329902089 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView /prefetch:4 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7ff8e36f5fd8,0x7ff8e36f5fe4,0x7ff8e36f5ff0
        5⤵
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,4567440704105516266,14876116857862788176,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:2 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1836 --field-trial-handle=1756,i,4567440704105516266,14876116857862788176,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:3 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:5560
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1756,i,4567440704105516266,14876116857862788176,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:8 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:3136
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --enable-gpu-memory-buffer-video-frames --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3408 --field-trial-handle=1756,i,4567440704105516266,14876116857862788176,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55 /prefetch:1
        5⤵
        
        PID:4664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1856
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7d5423fab0bc688fe408ae455cf60ad90cd6398b0ebb0c5a535b34f8e429bcb9
MD5 dfea0acb42134448419e78d8a8221a92
SHA1 96596f18f5c130782bf5dd87402489f20b804151
SHA512 52c8f889df7c8183d579ed08e8e0cf86bd7b36589206473fd3b5d949e7bcc2525f2e6d1a6951d114b63bfa4e403e90d9244101644d7ded63c0465c5ea3bede7b
TLSH
T1A7217633F3DC8214C899013A10DDAC1036B687CB40DECF9B6B85E159A42F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

LoaderNeon_new.exe

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\LoaderNeon_new.exe
Size 12.5MB
SHA256 a55a573d367ccd368833c6fb4d28f0ac9443b87f412ffa76a72bd0b7f723b0ba
MD5 f63544294d7694f5a3c75484fe72081a
SHA1 0e11e379eabcb92cfc6e62071a66206d5358e009
SHA512 b88ea41506aab97f04485518f86e681941f593614cdc909f0b7fb59d8c0a918e9abf59ed2fee855befc510d1d17f4c4b3b62385bbf725653371de627bf968b21
SSDEEP 196608:tJOM8vfZy/PzBwReQ+v22aw8F/6Q7++f+YZWvcQ77b0Mlku7c:zO9vEwHXhFNf+YZIcQ/b3lVc
TLSH
T168D6BE0B965901F8C0BAD0789A478D53FA7174894335A7EB379C49136FE2BE4BA3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.bat

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat
Size 2KB
SHA256 e4747dee863418a19bf6551f17fcf439f2a8ec0b4d1a673673c53f0ea000c8ac
MD5 b43b34ce1100dc144b16200e87b45be4
SHA1 4ee404943101bb177899d910b2c979a498e656d7
SHA512 ccdb5f4e9bc3b0fde85e3c8b285b7314ae4a17167943915c423478b1eef5b2ac01208e042fd6fb774baf52ee0d50d2153204febbd34e94e9efeb0b898b8d451d
TLSH
T1CC41BE06529BCFAB0455997B5BA6928CE4FE880F5F05B7033A64C80D678640FFECA7C4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ttgypjlh.jur.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttgypjlh.jur.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7ad96ce297a16040011956f8245c2dd6ebf4fd752c26bd5570dffc34092c7c8a
MD5 8bead44948be8eab8c081996d8703431
SHA1 17a1df3b5231967e38e18214eae1d90f3fc9d94d
SHA512 ef9909e383a5684005ddee3dcb28ddb4eb48b2332836b7a8ad1756c62b635ab7496a3b36fdbc1900dc39f9025435ab319086d95e8213a25108048170884331cb
TLSH
T1F7D0122733014134C0606073505371494501D20B810A4201982CD95D2ADC0500A07C51
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e7980e84ca76ac66b68d3787d944313329675f1489262c5e772b11bc31b6507f
MD5 e5bbfb9e5ab31f6558aca20d7ad44ee4
SHA1 6321f9ba9ecebe78d9eeb17a9ada34ae72af1b08
SHA512 86ea11aede4190959ef167667e9c9f83b88a7877e0a2fa239324166d24a71205f9ab84e1272abf4291e8fe731b19e35fb5051dabff838823b26c522bbc20b6d7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State
Size 2KB
SHA256 08e69a37963b47474a29785efce849c5f4d6d318597cf03b1d7782101884ea16
MD5 4fa26496c39898056848c42935d85ad0
SHA1 839918ed817c454a4c010912112bc2b327179c84
SHA512 ee7d318ec5fdd81297cac3ebe59fadfc76294f7fe6e55243a1f077e801670b91697394ae6ec5fa5963e3932661ed9bf1375ad3a74c78915020c32d9aa550921e
TLSH
T1255186736C18AA7799A39A05790A3F53EE7A4066AF522F64EBDC1B0C01DB64C1347C72
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State
Size 3KB
SHA256 cb4168a54feb7a5537155a7c86b0a46fb60287574f36729665522ca92492cc51
MD5 408faf3d4118106fec4345d45cebdd2f
SHA1 c0cb7d8e98460caf8e8d3a4ff98713a4fc7fcae7
SHA512 8efe2d81eabd6df6431eb0f975f59a05f8200bd9832a049c02d8258a6f9c0ed4847e460bafa110fb869d3b924b1d9d9b21059ade66efdec3002101bed8fabc79
TLSH
T12671847B5C64E9775DA39A05B8493B42FBA54027AA813FA4E6EC0F0C01DB7881353C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State
Size 15KB
SHA256 ed71bf7946473b7d9f557e1d4444a96c74554040e6b1773c44abcbb9c11d2e1f
MD5 6f58dd279ad34e47d00e045cd771cb52
SHA1 18c0390d45c57382f3011e1be9b8b2027b7b7228
SHA512 1f0290db78b45cc4d66f579b9275f0ce75b952721ba0ed68fc8a18fd4d22eaa8bf2a960fde8af029b63a8932f4cd4fcd8e6bdee469e84ec1db4f8b28839e8bf3
SSDEEP 384:vsrv+89zHqlDNP9oid93NBSn0pIYKOubyNo:0rv+4UNbd9JtMbyNo
TLSH
T13A72AD73A97CF633A9B39905B48A7A077FB860A656C20BF0E5981F8D01DE0C92317D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597083.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State~RFe597083.TMP
Size 1KB
SHA256 94893c0bb4912445086ed00043de63063429de97e31dcc60af5c630f349e12ba
MD5 8147bf93c6f206aa512492bb9ef08aec
SHA1 fdcd619a319f05434c9e20c7626b0ed892c137c5
SHA512 9a2741075a1d5fcc6ffc471489387691632973000640aed159410854806d3039f6303095de0e5ae8fc0a462219e4834057bf59120778a6dcfb79c3fb7b8be229
TLSH
T1403162B39C98AA326C56A60771057AC3FE22006A9B414F54B6DC0A0D02EB54C572FC32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f664a9e6a0e9be19f92ed7a48fe9e2230a8aeddc6022b45e6a614d9f63500849
MD5 257244b10150ea50f2a81d297f586fd5
SHA1 285efd7f5853302706a1ed6838f873948decb5c7
SHA512 e9789282827b94229b43e955cf18ee072fe1c31a98cd9f1fc1bcedb52a9d3212d74a1cb15574ef44b4745c2c709c174143bdfb9300f873640302d1c0e8decb37
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 484db324425afe52e963ab365917d71e42f1b104da4f61286c62facc9644ecd5
MD5 5b0f6abff5b166bd5934dcd0e96c6143
SHA1 932d8ea96c9b8d714801412057c9c25a886d58ff
SHA512 d317a08b0b3c3ca554b359cc4e0b09694c2b84bda6d16d891d453b9abb2e4fa602e9339e3a5a53ad58b8fdacca415a5151b18f1cfffbfed52a413b0ad8e0c06a
TLSH
T1FAD01217724E05B8C01020B7010361084E00D60F40064040B438851D2E440594902841
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4744172059fbe110458875d496a515f766705557c48f32cbf4a2ff576501f3fe
MD5 6d5bfe5074e76c1d28456943f6e9f344
SHA1 d70991affc7ec2d4ecd2925b9375a82e185aaadf
SHA512 b75ce1ab165a11889c86065b8d2649257f10913938c6bd7489a8b3e5647bb9eb500f0d08d0bd7440591d61682f19fdd34d8e3cda61f50cc344095e26b50ef47b
TLSH
T1F521668F56724C8BCF23A2361ACC0CB1BEB76178DE4B5F86592A487485983CACC59536
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e97c.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e97c.TMP
Size 48B
SHA256 e76abc04291c1d5141d471fd5a2d0731af30e281c0c9caf36bc3680f9c740be5
MD5 30626c968c1a1f58a9568dbde8c5362c
SHA1 793ba25de7afe1cf8ee5eb00b7aef4c11f5a8bb5
SHA512 6bb0bba11b028f91d985a79033e38f6ccf8476945730d109fce25fbc2e5c4d0d5b7640cb9da0c16aa635cc4202badc79056d014517f9cac8a8cf053ac8943bd9
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 fe16c66ba5975003799f73a946b4904c331061a3b1bf930461fc8327f9a77cb2
MD5 437f39b1ea49b8abb89c122c5baa9eba
SHA1 c8b763220bd869c4d0d1f4e3549c85d2a6a3e8cd
SHA512 c136d19211488277bc7870594a707330a59a7de4224ded489a6053988798d1e31eb88ae3448ca03449eaef620092e24248684c7e0e1922016a3c495df58b6e2b
TLSH
T11CF059EA84BEE43750B85D7E1C047D14AE7FF8308441A4FCDB62C22CA0A08B35743417
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59e9ba.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity~RFe59e9ba.TMP
Size 522B
SHA256 eeead11f28b29cb40df13409a68580e59fa46fece1de94954b26601258b05b7f
MD5 250da4820431ad42eb983fa92220d04d
SHA1 3b07afe12f372c626f76b53579810b3921823684
SHA512 bc2bdcf90cc87edeb09de03fb7f5b164b735d0e41e595ed77fc4cae217f8037a60158118ce9b3c5485f07f8ed8ffff15d934599b75639a3cbcedcc0d69389e9e
TLSH
T102F059AA94BEE43640784D7F1C447D14AE7FF4708441A8F8DA62C62CA0608B35743417
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 da6937b5d4921d68665482ae46c3ff9afad9fad21ab2aa39b388304e51914958
MD5 fc9297f6d576c49480f09f345de3df34
SHA1 431aec4f17ffaa1cb664f43fd30308f7d4a95abe
SHA512 7bfe6b6052d325f3e514282e50c1662444872db048dbf26ef4468aba741d6ab6f6ad17137299bf1b8fc393e59fd5cb5198f9760a0664286a1d663bfc64c75cde
SSDEEP 96:stb/dKv5TYb9CYk7o5h16ZqUs7/x+6MhmuecnLJ1eBUe2jK+gIiFQ28XM1C7K:stjgZhYconUsV+FTLJQBUbONFQG6K
TLSH
T138D1A6025E28B87B4CC6F619BA39FA53D2F9603261D51D98E7F8461C18EB6DD6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59e96c.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences~RFe59e96c.TMP
Size 6KB
SHA256 2bbebe823952f7c80f892f0ac5442329aa1a3f47cec4c93bde24ec4eb8e57a82
MD5 3d421ed990d418f0ff62f4ac77d103eb
SHA1 5e0ef39e55794e5020ee4531afcd6d2fd0a91eea
SHA512 220d6fe150a90f486bd004ad21433c56494edf9ede58b18823fe0d00c84b04d20e0a1d8593b24a804764f5cc69ee5ac9b48c1eef8adee7aeda35c8d1413491b2
SSDEEP 96:rb/dKv5TYb9CYkfdo5h16ZqUs7/x+6MhmuecnLJ1eBUe2jK+gIiFQ28XM1C7K:rjgZhYQonUsV+FTLJQBUbONFQG6K
TLSH
T1E4D1A5025E28B87B4CC6F519BA39FA53D2F9602261D52E98E7F8461C14EB6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 2KB
SHA256 aa86d1bf928076b3f29e3f50cf1be73c1c6d9b22ac51e69b381e89c3ee8a0b02
MD5 4ef86ec29137f011c041f1b62e47d11b
SHA1 7f23d5185aca9b03641f3fe93b9e34139c490249
SHA512 60d526b096a1f5de05469ca714b0997c9adacf812f859783ae2c240d4e6f3b9443cf5d06d17da29cc0be0a75ccdf6e9238d864c563d4d45d13452e4a7e5d83be
TLSH
T1175175736D20BA3795B79B057D4A7E63CE754066AB921FA4ABDC0B0C11CB94C1303C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 3KB
SHA256 00f8e56cd9699e527ad855f50877bb81dcbd5893f67f064a45a9e40cdc71a966
MD5 b1d287f2429cd88ad7a7c11eaba67adb
SHA1 45adcbcfa3de19a4d8facafff0d75e151d77f0fa
SHA512 3e0ad344ed76ee3cd348a8cf13a4f43239d751499830abd62de73bcf490a602b7917e385e8502abcb22bb138b2419a41c96c1cc801e9f904e039a1dd1355ad48
TLSH
T1C27166775D60B93749B3DA057C863A56EBA54037EAD16FA9DAEC0F0C11C76481313C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 3KB
SHA256 1afc01eb24d4e8deb0453f02dc62ebeeb1a5293f6fd4621402415c2cd7060c94
MD5 d7c7372361f0e62d6849fda0ac47cd04
SHA1 f933f3687869330b911e02664ed4f2e1e83af5fc
SHA512 4d4876b93ee21baa0b32f7e4a0555849e3910eb12fa6256bd4079ef72fef824a9a99eee25fe92fc8f2ef0189565c997f43f6f74856d70f3e767432506ee92d13
TLSH
T1D48184375970B92749F3EA057C4A3B53ABA45077AAD16FE9EAEC0F0C11CB6880313812
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 15KB
SHA256 c1e49b3e1056c12f6da215297ee9b3d306cc5f6a544cd535d14e1ee619d55ec4
MD5 e26fea657d23e09bbc9a7978c9d3997c
SHA1 4176c10d4db29e37d2557764ff2cf1f07aa8452d
SHA512 2546c1e956f8401bc72817059a5e8cfbabe5a5a38d938e99547620645e096a7409e916a1b818d9936e4560ac16ea887730ccec5008b380f282468cf066f8eed0
SSDEEP 192:iCsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vnNBS17v5eoDU9:Lsrv+89zHqlDNP9oid6NBS3TvZp3R9Ne
TLSH
T17372AE33D53CA6379DB3D909B44A7A176F7860A766C20AF4EAD91B4C41DA4C92307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe599021.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State~RFe599021.TMP
Size 1KB
SHA256 b27126e8cd2ccc44e31161c501c59860da4a97a0e9e614408d41f5e86e8da54f
MD5 0c4e042327798a517828f5c997903134
SHA1 111cd271e1dabf4e0db0178cc86cfc471c81cfb6
SHA512 274a2754c2f94b2591d18e569a474f22725553a0662c7dfc1058e214dc1f72074fa2ed053c086f57ea6298f235d190b5882eb30311a3f3e13f7c9c71bff67d45
TLSH
T1FD3174B399607B32A8A6BB0639457AE78E30007B97A14F9876DC460C11DB84C862BC31
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-291-0x000001D274E90000-0x000001D274F37000-memory.dmp

Download

memory/468-21-0x00007FF904910000-0x00007FF904911000-memory.dmp

Download

memory/1628-0-0x00007FF61E440000-0x00007FF61ED76000-memory.dmp

Download

memory/1856-586-0x000002316EF80000-0x000002316F070000-memory.dmp

Download

memory/4572-250-0x0000022B7B6F0000-0x0000022B7B797000-memory.dmp

Download

memory/4572-104-0x00007FF904910000-0x00007FF904911000-memory.dmp

Download

memory/4664-619-0x00000174EFB80000-0x00000174EFC27000-memory.dmp

Download

memory/5180-578-0x00000263B9110000-0x00000263B9134000-memory.dmp

Download

memory/5180-573-0x00000263B9380000-0x00000263B9432000-memory.dmp

Download

memory/5180-379-0x00000263A0D80000-0x00000263A0DA2000-memory.dmp

Download

memory/5180-580-0x00000263B9690000-0x00000263B9780000-memory.dmp

Download

memory/5180-577-0x00000263B9110000-0x00000263B913A000-memory.dmp

Download

memory/5180-574-0x00000263B90D0000-0x00000263B90DA000-memory.dmp

Download

memory/5180-572-0x00000263B90B0000-0x00000263B90CE000-memory.dmp

Download

memory/5908-618-0x0000018304F00000-0x0000018304FA7000-memory.dmp

Download

memory/5992-294-0x00007FF67FF20000-0x00007FF680BAC000-memory.dmp

Download

memory/5992-628-0x0000021657FD0000-0x00000216580C0000-memory.dmp

Download

memory/5992-581-0x0000021657FD0000-0x00000216580C0000-memory.dmp

Download