c80bd45ff8b68ac28f62f67a01bbc12dfc61da50746a0adf3d02c06a86da33f7

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Torix Tools.exe
Size 9.2MB
Sample260723-c81agafe46
SHA256 c80bd45ff8b68ac28f62f67a01bbc12dfc61da50746a0adf3d02c06a86da33f7
MD5 8b6fadb0f35ad69fce7cd1253c082ac0
SHA1 075868b53486acc08d61820a5654f9f177a0eb39
SHA512 a592c08f007f3c32e56389a3a93d7929a71e78a80cc057f963065166b7c6096b7ed20c70f73913fdd7124c285cfd3b8087519915bc25364f61e9a043b860ec70
SSDEEP 98304:pBKd/8lvpWHyy4hU4oJarM0/IWb7SJqshzKa18VoDLS51DQbD8q8eIb:pEV8lvpoypO4A0IA7DsHCCDSEng
TLSH
T113A6AD1BA66901F4D0A6D138DA838C13F671748A473197EB3B9C46161FE7BE0BE39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1976	powershell.exe
460	powershell.exe
3424	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3552	Torix Tools.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Torix Tools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Torix Tools.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Torix Tools.exe
File opened (read-only)	\??\A:	Torix Tools.exe
File opened (read-only)	\??\P:	Torix Tools.exe
File opened (read-only)	\??\S:	Torix Tools.exe
File opened (read-only)	\??\U:	Torix Tools.exe
File opened (read-only)	\??\W:	Torix Tools.exe
File opened (read-only)	\??\E:	Torix Tools.exe
File opened (read-only)	\??\D:	Torix Tools.exe
File opened (read-only)	\??\G:	Torix Tools.exe
File opened (read-only)	\??\I:	Torix Tools.exe
File opened (read-only)	\??\L:	Torix Tools.exe
File opened (read-only)	\??\M:	Torix Tools.exe
File opened (read-only)	\??\T:	Torix Tools.exe
File opened (read-only)	\??\Z:	Torix Tools.exe
File opened (read-only)	\??\J:	Torix Tools.exe
File opened (read-only)	\??\K:	Torix Tools.exe
File opened (read-only)	\??\Q:	Torix Tools.exe
File opened (read-only)	\??\N:	Torix Tools.exe
File opened (read-only)	\??\O:	Torix Tools.exe
File opened (read-only)	\??\B:	Torix Tools.exe
File opened (read-only)	\??\H:	Torix Tools.exe
File opened (read-only)	\??\R:	Torix Tools.exe
File opened (read-only)	\??\V:	Torix Tools.exe
File opened (read-only)	\??\X:	Torix Tools.exe
File opened (read-only)	\??\Y:	Torix Tools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Torix Tools.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
952	tasklist.exe
4984	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3184_1776381175\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3184_1776381175\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3184_1776381175\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3184_1776381175\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4944	cmd.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5472	cmd.exe
896	net.exe
2856	net1.exe
2484	cmd.exe
4800	net.exe
5328	net1.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3048	timeout.exe
5820	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Torix Tools.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292483656123845"	Torix Tools.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5492	Torix Tools.exe
5492	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
1976	powershell.exe
1976	powershell.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe
3552	Torix Tools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2356	msedgewebview2.exe
3184	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	tasklist.exe
Token: SeDebugPrivilege	4984	tasklist.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	460	powershell.exe
Token: SeIncreaseQuotaPrivilege	460	powershell.exe
Token: SeSecurityPrivilege	460	powershell.exe
Token: SeTakeOwnershipPrivilege	460	powershell.exe
Token: SeLoadDriverPrivilege	460	powershell.exe
Token: SeSystemProfilePrivilege	460	powershell.exe
Token: SeSystemtimePrivilege	460	powershell.exe
Token: SeProfSingleProcessPrivilege	460	powershell.exe
Token: SeIncBasePriorityPrivilege	460	powershell.exe
Token: SeCreatePagefilePrivilege	460	powershell.exe
Token: SeBackupPrivilege	460	powershell.exe
Token: SeRestorePrivilege	460	powershell.exe
Token: SeShutdownPrivilege	460	powershell.exe
Token: SeDebugPrivilege	460	powershell.exe
Token: SeSystemEnvironmentPrivilege	460	powershell.exe
Token: SeRemoteShutdownPrivilege	460	powershell.exe
Token: SeUndockPrivilege	460	powershell.exe
Token: SeManageVolumePrivilege	460	powershell.exe
Token: 33	460	powershell.exe
Token: 34	460	powershell.exe
Token: 35	460	powershell.exe
Token: 36	460	powershell.exe
Token: SeIncreaseQuotaPrivilege	1976	powershell.exe
Token: SeSecurityPrivilege	1976	powershell.exe
Token: SeTakeOwnershipPrivilege	1976	powershell.exe
Token: SeLoadDriverPrivilege	1976	powershell.exe
Token: SeSystemProfilePrivilege	1976	powershell.exe
Token: SeSystemtimePrivilege	1976	powershell.exe
Token: SeProfSingleProcessPrivilege	1976	powershell.exe
Token: SeIncBasePriorityPrivilege	1976	powershell.exe
Token: SeCreatePagefilePrivilege	1976	powershell.exe
Token: SeBackupPrivilege	1976	powershell.exe
Token: SeRestorePrivilege	1976	powershell.exe
Token: SeShutdownPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeSystemEnvironmentPrivilege	1976	powershell.exe
Token: SeRemoteShutdownPrivilege	1976	powershell.exe
Token: SeUndockPrivilege	1976	powershell.exe
Token: SeManageVolumePrivilege	1976	powershell.exe
Token: 33	1976	powershell.exe
Token: 34	1976	powershell.exe
Token: 35	1976	powershell.exe
Token: 36	1976	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeIncreaseQuotaPrivilege	3424	powershell.exe
Token: SeSecurityPrivilege	3424	powershell.exe
Token: SeTakeOwnershipPrivilege	3424	powershell.exe
Token: SeLoadDriverPrivilege	3424	powershell.exe
Token: SeSystemProfilePrivilege	3424	powershell.exe
Token: SeSystemtimePrivilege	3424	powershell.exe
Token: SeProfSingleProcessPrivilege	3424	powershell.exe
Token: SeIncBasePriorityPrivilege	3424	powershell.exe
Token: SeCreatePagefilePrivilege	3424	powershell.exe
Token: SeBackupPrivilege	3424	powershell.exe
Token: SeRestorePrivilege	3424	powershell.exe
Token: SeShutdownPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeSystemEnvironmentPrivilege	3424	powershell.exe
Token: SeRemoteShutdownPrivilege	3424	powershell.exe
Token: SeUndockPrivilege	3424	powershell.exe
Token: SeManageVolumePrivilege	3424	powershell.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 5472	5492	Torix Tools.exe	89
PID 5472 wrote to memory of 896	5472	cmd.exe	91
PID 896 wrote to memory of 2856	896	net.exe	92
PID 5492 wrote to memory of 5624	5492	Torix Tools.exe	93
PID 5624 wrote to memory of 3928	5624	cmd.exe	95
PID 5492 wrote to memory of 2356	5492	Torix Tools.exe	96
PID 2356 wrote to memory of 3152	2356	msedgewebview2.exe	97
PID 2356 wrote to memory of 1236	2356	msedgewebview2.exe	98
PID 2356 wrote to memory of 1236	2356	msedgewebview2.exe	98
PID 2356 wrote to memory of 1236	2356	msedgewebview2.exe	98
PID 2356 wrote to memory of 1236	2356	msedgewebview2.exe	98
PID 2356 wrote to memory of 1204	2356	msedgewebview2.exe	99
PID 2356 wrote to memory of 2864	2356	msedgewebview2.exe	100
PID 2356 wrote to memory of 2864	2356	msedgewebview2.exe	100
PID 2356 wrote to memory of 2864	2356	msedgewebview2.exe	100
PID 2356 wrote to memory of 2872	2356	msedgewebview2.exe	101
PID 2356 wrote to memory of 2872	2356	msedgewebview2.exe	101
PID 2356 wrote to memory of 2872	2356	msedgewebview2.exe	101
PID 2356 wrote to memory of 2872	2356	msedgewebview2.exe	101
PID 2356 wrote to memory of 2872	2356	msedgewebview2.exe	101
PID 5492 wrote to memory of 4944	5492	Torix Tools.exe	102
PID 4944 wrote to memory of 3048	4944	cmd.exe	104
PID 4944 wrote to memory of 952	4944	cmd.exe	105
PID 4944 wrote to memory of 1984	4944	cmd.exe	106
PID 4944 wrote to memory of 4984	4944	cmd.exe	108
PID 4944 wrote to memory of 3504	4944	cmd.exe	109
PID 4944 wrote to memory of 3552	4944	cmd.exe	110
PID 4944 wrote to memory of 5820	4944	cmd.exe	111
PID 3552 wrote to memory of 2484	3552	Torix Tools.exe	112
PID 2484 wrote to memory of 4800	2484	cmd.exe	114
PID 4800 wrote to memory of 5328	4800	net.exe	115
PID 3552 wrote to memory of 5844	3552	Torix Tools.exe	116
PID 5844 wrote to memory of 5276	5844	cmd.exe	118
PID 3552 wrote to memory of 3184	3552	Torix Tools.exe	119
PID 3184 wrote to memory of 4216	3184	msedgewebview2.exe	120
PID 3552 wrote to memory of 1976	3552	Torix Tools.exe	121
PID 3184 wrote to memory of 5868	3184	msedgewebview2.exe	123
PID 3184 wrote to memory of 5868	3184	msedgewebview2.exe	123
PID 3184 wrote to memory of 5868	3184	msedgewebview2.exe	123
PID 3184 wrote to memory of 5868	3184	msedgewebview2.exe	123
PID 3184 wrote to memory of 2096	3184	msedgewebview2.exe	124
PID 3184 wrote to memory of 3300	3184	msedgewebview2.exe	125
PID 3184 wrote to memory of 3300	3184	msedgewebview2.exe	125
PID 3184 wrote to memory of 3300	3184	msedgewebview2.exe	125
PID 3184 wrote to memory of 2784	3184	msedgewebview2.exe	126
PID 3184 wrote to memory of 2784	3184	msedgewebview2.exe	126
PID 3184 wrote to memory of 2784	3184	msedgewebview2.exe	126
PID 3184 wrote to memory of 2784	3184	msedgewebview2.exe	126
PID 3184 wrote to memory of 2784	3184	msedgewebview2.exe	126
PID 3552 wrote to memory of 460	3552	Torix Tools.exe	127
PID 3552 wrote to memory of 3424	3552	Torix Tools.exe	132
PID 3184 wrote to memory of 5824	3184	msedgewebview2.exe	136
PID 3184 wrote to memory of 5824	3184	msedgewebview2.exe	136
PID 3184 wrote to memory of 5824	3184	msedgewebview2.exe	136
PID 3184 wrote to memory of 1236	3184	msedgewebview2.exe	137

C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe
"C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Windows\system32\cmd.exe
  /c "net start w32time"
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:2856
- C:\Windows\system32\cmd.exe
  /c "w32tm /resync /force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:3928
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-features=MojoIpcz --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=5492.5116.15121213122586396945 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView /prefetch:4 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffec4ec5fd8,0x7ffec4ec5fe4,0x7ffec4ec5ff0
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1832 --field-trial-handle=1836,i,9557421796727783224,14067461566364211702,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:2 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1836,i,9557421796727783224,14067461566364211702,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:3 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1836,i,9557421796727783224,14067461566364211702,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:8 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --enable-gpu-memory-buffer-video-frames --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3528 --field-trial-handle=1836,i,9557421796727783224,14067461566364211702,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba /prefetch:1
    3⤵
    PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3048
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq LoaderNeon.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- - C:\Windows\system32\find.exe
    find /I /N "LoaderNeon.exe"
    3⤵
    PID:1984
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Loader.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- - C:\Windows\system32\find.exe
    find /I /N "Loader.exe"
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe
    "C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe" --post-update
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\system32\cmd.exe
      /c "net start w32time"
      4⤵
      System Time Discovery
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Windows\system32\net.exe
        
        net start w32time
        5⤵
        System Time Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4800
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start w32time
        6⤵
        System Time Discovery
        
        PID:5328
  - - C:\Windows\system32\cmd.exe
      /c "w32tm /resync /force"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5844
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /resync /force
        5⤵
        
        PID:5276
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-features=MojoIpcz --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=3552.2740.5087686643541016792 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView /prefetch:4 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffec4ec5fd8,0x7ffec4ec5fe4,0x7ffec4ec5ff0
        5⤵
        
        PID:4216
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1776,i,6027012096487875878,2691137072116740251,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:2 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:5868
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2176 --field-trial-handle=1776,i,6027012096487875878,2691137072116740251,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:3 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:2096
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2364 --field-trial-handle=1776,i,6027012096487875878,2691137072116740251,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:8 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:3300
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --enable-gpu-memory-buffer-video-frames --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=1776,i,6027012096487875878,2691137072116740251,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55 /prefetch:1
        5⤵
        
        PID:2784
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=1776,i,6027012096487875878,2691137072116740251,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:8 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:5824
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4536 --field-trial-handle=1776,i,6027012096487875878,2691137072116740251,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:8 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:1236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3424
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 46013602eb712487c5c4134afa81694570fd6c71d2be3cad888c81ec079db732
MD5 9dc3d9fead34511b2dbec305d5588559
SHA1 cdf1808f087fa4fd3121660931131ff21e49622f
SHA512 4e2b345e8b973fc2a510152addf5b1e65ee098ddec88bbf5fd274b06658e05c0235d46067aa37bc066f44203f80e726bdfaba858a1e7406607880d6435d9e991
TLSH
T154217633B3DC8214C899403A10DDAC1036B687CB40DECF9B6B85E159A42F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

LoaderNeon_new.exe

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\LoaderNeon_new.exe
Size 12.5MB
SHA256 a55a573d367ccd368833c6fb4d28f0ac9443b87f412ffa76a72bd0b7f723b0ba
MD5 f63544294d7694f5a3c75484fe72081a
SHA1 0e11e379eabcb92cfc6e62071a66206d5358e009
SHA512 b88ea41506aab97f04485518f86e681941f593614cdc909f0b7fb59d8c0a918e9abf59ed2fee855befc510d1d17f4c4b3b62385bbf725653371de627bf968b21
SSDEEP 196608:tJOM8vfZy/PzBwReQ+v22aw8F/6Q7++f+YZWvcQ77b0Mlku7c:zO9vEwHXhFNf+YZIcQ/b3lVc
TLSH
T168D6BE0B965901F8C0BAD0789A478D53FA7174894335A7EB379C49136FE2BE4BA3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.bat

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat
Size 2KB
SHA256 e4747dee863418a19bf6551f17fcf439f2a8ec0b4d1a673673c53f0ea000c8ac
MD5 b43b34ce1100dc144b16200e87b45be4
SHA1 4ee404943101bb177899d910b2c979a498e656d7
SHA512 ccdb5f4e9bc3b0fde85e3c8b285b7314ae4a17167943915c423478b1eef5b2ac01208e042fd6fb774baf52ee0d50d2153204febbd34e94e9efeb0b898b8d451d
TLSH
T1CC41BE06529BCFAB0455997B5BA6928CE4FE880F5F05B7033A64C80D678640FFECA7C4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wl3p2ocz.da3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wl3p2ocz.da3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7971ed79cc6a998534889b8e50bb059aecd647e5285ae8bc654fac29c03d03fc
MD5 3dc20598f14096b6ec2a4cdec69a4870
SHA1 5bb275ad6e9a6358823e601436814d9e32eefc90
SHA512 c836c43abeed525c382eaef32973db75bba3b8670cfb4453f03789a5670c8e2936dc37df70c61e40aef7e81e659269b1aba854da3e4ba71e6db4678e50d8e9c7
TLSH
T181D0121677530138D42030731102A20C4401C21B440990116529D62E1A080580916442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1ad0142c8da70e100e0a04b9a5382206c13e923cbc1659c3ac495ec31158fcd4
MD5 18861ab7817517aa86b6abd03afdb1d6
SHA1 de114f1ac93dab7b749b3f8f1328f5c4deaf0209
SHA512 d5baac830cd99b1af714384e34d708bef7d7fcdbaebf2668b7133c3e6a5b7c6d9da6bc212b74f9c8916ce09f64fb0cbf88aefeadb26a0dd01bd57fbb4b6a3754
TLSH
T19AD00414D7531015F41030711114C304C10545131C05713113515115044500C0015001
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State
Size 2KB
SHA256 0210b79201ce3e4072a329a0935aec0808ca260559bbd322c9ec2aae0cccfd1e
MD5 ea02b048455b22c6fc511a7b9a24df3a
SHA1 30b4940a3a4dd1e8a82264ab6a129be40ca8d9ad
SHA512 4b33ea5611faf7aaaf83dab2d31554fbf456785a0bf57e9e0f8a34f71c54d084fb6da561afc6a7f2c54a29ece70e8af2c1775893e3ab263e5a76d51201a7ef51
TLSH
T157517273A910EB7789E38604798A6B63DE7941A6AF522FA4AADC0B0C00DB55C5307C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State
Size 3KB
SHA256 7b2157afb0c2165b5566379b972ab1a30e227a682114e86a4597223781e2eae5
MD5 fc2818d461e3b64730f5c4c2e077d7f2
SHA1 a5cbe7c6ed71a83d2c86b0948eafb7dc857ad31d
SHA512 4fdf231ae0f80b4304570136575ef7f102bc15b634ab050e835a46eb3df2603e9b901d727b1bc1d37416911123d2e5b9e47cfc0b38c50ec588707cf2b63a9fd3
TLSH
T17371977B6960E9674DE39A047C862B57FBA54037EA913FA4D6EC0F0C01D72881343C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State
Size 3KB
SHA256 34678f83ec72a1f3653d19c5f02eaa16f341e57ea1ff19379ab1ff20cdc48767
MD5 c7b895b3078da73c35e287d44f9a2027
SHA1 2f70d20cef20842d4dd3e4b9c2cd66cb1bd3d47a
SHA512 6deb0514b761c52e61c843ae74265c292aa133a4bed586042304009f7847af7c3e2c6d5b99cf077e3e792c2ffc93f555e73e786596fd840b93386ca1ead7c3c2
TLSH
T1D681A77A6964E9274DF3D6057D863B17ABA85023EA957FD8D9EC0F0C01DB6890343C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe597313.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State~RFe597313.TMP
Size 1KB
SHA256 cc556fe654da8c37b5a456298523ca1d0d77ae899a00e52a56c41baa39a1d5f6
MD5 58d15bc6f3990cb28d5d6e3792864c24
SHA1 b1846924313c5f3e803e32034ff132e646cf9935
SHA512 544167ca27349d1ddb8eb22ed5c31560e15cf37c2579084b7d24ab6c5adb9c1793fad7c90f44a6c0bdd91732be34a1c91fe8e5f44cb429c5c9fa0389c9f02929
TLSH
T1C53174F6D99097725C9352163546AA97AE70007BA7510F4476DC0B0C11EB04C9A2BC36
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1471e4d3923757f1b1982f3dc35c0aa60687a165e95f6fe6025306e51cb3a3f5
MD5 83852a8ffc7d8d8541e28271cccc9bfd
SHA1 efb382ed64bc9c9db4bcc7dc53d3b90433841798
SHA512 93a6c623a9714b29d0e30952335dd38cf64973376eda558a93755c59866f6adb8709224546f5f5382fe230e99757b846a14b6b4273297ec7d2f3276f5939616d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9fa21b19d533d552897161dd036b54fce6e97f0bb7b97c5dcc20b43c5a520461
MD5 f8bd92bc3fec3526f4c4810d4df1d0f4
SHA1 d32c04477e7ff4b7da45a530f99d8e0e0c204efc
SHA512 b4c79c6069faf5fd9ba52578c7c9c03075ff1a32760bb91f932a0f23a59e3f13d8d1de9d0470f15ddbd9afbd440a25afa5aaf5e913442d2cfc9f0a62fed6f9ec
TLSH
T1C9D0121776010538C8512033010366880501C11B800A40806428C69D2E840A41D07881
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b86b4b122a1f2cc1d55059d27f5dfd4472deffff9016e37ede852dd8cac9f847
MD5 f3f72e7b5ab0a13592511bc9f7a2a81e
SHA1 ab20c88e2e9c41b691ac54d8d24bee9daa784313
SHA512 a7e69606281fae67b00e560295e74106010240e509e7e8297a8c92e4c60f908577125bcb44ed22d1fdf523243b36161678012191eb6549727fff54ffae9418b9
TLSH
T15621D0846413471DD321F0B61EDC09B5B5F16578AA8B2CC5406FC4347C6C3DAED4D129
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e93d.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e93d.TMP
Size 48B
SHA256 d6b8f6d156b457ed94582612095aee90722f067434253b34c19449653226f865
MD5 2b3ce8073bba012f3e01916ddf8885cd
SHA1 d3922039eb88e896837f73f8f6a0c4dc49c193e1
SHA512 116f788fc29a74cfc94183c7613c6380358bcd2068ee8e928bf75d72e725414108cec6b38cf6b0236fdde19ee9ed31817f3b2667c2d3bdc222f11c58613a76ed
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 ffb2fd031bdda223b943e2beb37fb9d6a5a41a775e9b71bac10fa99ab0236ebe
MD5 33bd3e8ccdede8d325685a169469a6ee
SHA1 ef071187b4c908c6a19c81c12079cc32c8569d53
SHA512 8c539876fb95c02343472bac85ea2d4cbd7f24413f4e504803ea6271942f4af3d0458e047915e22007aa6be722fb135c0ae78e23bb8cebbb6cc7a2d11480c29c
TLSH
T1A64168E7C7D4412CD85616F92B25292BCE1E1D1453283DB6C9E5BF8E93E0860E31469F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ab93f.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5ab93f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 d6eb9296999e0389197f0d74080f682d8e79d8492e55aecafeb0f416d630e115
MD5 4187adbbc39a41052cf991d0bfbf2d00
SHA1 50196e0cf42a15c7e2c94574c35c27c5a2d66ba3
SHA512 f83ed4a164e7a031d0d4d50ef5be9d126b52396b00e4be9d47d9aa64ec1154201fb466b485e24f29933134e737decf5f2c2935b3c66bbe258bfbf877fcee8857
TLSH
T145F09533C179E43A20B805AE2C097D447DBBE4705552B4F5EB6D452DB061CB31113857
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 dc2ada1d86f58042e7a9d9755462f049028784838a0965482d1a95f83ecfee91
MD5 a95bb477249f1edef09f3304f122807a
SHA1 caf7753301a236b68fb9a57b3199023030e1638d
SHA512 5b99cb474f3ee19bcbfad13747882693e2b79d0adef183fa5e9188811d36e77032c32d768ecf93439f4aca429a9505fe56f052df8bb3ebb8c395ebee775611c8
TLSH
T1C6F05932C27AE43A10B905AE3C4A7D889EBBE4305552B4E9FBAA452CB071CB31216C57
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 bf02ceb59825d729551a18afeecbf62f2b17031dae9c5d25ac81d12d5b2db327
MD5 e69a39041aad731c8aa225f688e576b9
SHA1 bfb97167cc5edf4b003e7a820602470e992e40df
SHA512 202e056ab39880f130d430e7075220ed85cf71f48875fbe946a69ddf071abc23d93b47d0967523651ec7ff7bb9707c5249d9645016377f8a8be6fa79094df836
TLSH
T14FF05922817AE47B10B819EA1C06BD499E7BE4301163B4F8EB6E452CA070CF31616847
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 06d4029719d0711103af34212b0cf21698faed21cddb4ec9e5d27ed47ddccf3b
MD5 473df1fbe379ec5acd644186244f4a8b
SHA1 8ed22f63fabaae61000909ad3636ad2e3d7792ca
SHA512 bc9de7d969add572b367fa5f9291680e7d936e289f9cce6d3b1cade57ddedee467a2552312f09d5b246ae8d3d85769684786187434295851e1ab2173c31c4e93
TLSH
T14FF09E23D67AE47B10B809AE2C05BD899E7BE4301593B4F9EBAE452CB061CF31217417
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 046b0df44f7342c48ad6fd40edb8cfcfe4b8e3a83d391d27358334e6addd841d
MD5 75a89cbec7a3d1a48c199efb056ef368
SHA1 85c012c52a9da6896f4e449fdb245981d26944f7
SHA512 720e5ad3de08594cc4973f01d6bf3964c99ecfa92de6a63e6b498a399cfa49786485f5f876751d5bb093f7c6c77af92a5aeef7ef88781f040713fcc8e3e516ce
TLSH
T12FF05023C17AE47710BC09BA19057D49AE7BE4300592F4E4DB5D456C7460CF35116407
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 e60ab6e39d51d31171668f747feac9967330d22108b0e7112576272375f191d3
MD5 aab64815f910395ee77ec8151c500cd6
SHA1 5856f10751abc66e19567c3654c282bd789ca605
SHA512 4ae60047ee094db3ef5bb63364d0ef91079225bbaef50b4b882778465ba312467e94cd55e5026cfac53c068b59d75ffb47b5db9ab529d4c2792bfb3ce8d6cdb5
TLSH
T170F05022817AE477107849FE6C45BD499E7BF8340152B4E4EB5D452C60B5CF31116807
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 f496e67663a724d6d8b415eb0864bc22d1675b8ca3e658a43d5e468948c219cf
MD5 50a14a939d63ed5f89b411556ff87476
SHA1 aeb3b2b55fa473c1612ff82c52a4c04ec919d405
SHA512 e231103e09f1f280ae6b8eae31d3c3fb18b72578dc29ae92096cf7f9c43852841edac5037df396563eb99c10ecf4f53422884734fbff4ca8355fdd0d636a8377
TLSH
T1CCF0592292BAE47B10B919AE1D09BE499E7FE4300152B4F8EBAE492CB064CF31616417
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 0aeb146a74af61d0868e35560466f09a76a6ee0334aa1e904871841245ec69b7
MD5 c81752d568b0084a8c6f243e6c1525ec
SHA1 9e0cd79de7ed4e6ba5ac79790ca7e71e42ca89e1
SHA512 64808ab40fdfc4b0533c028f1ada906bb4dbc35119c12a0a64262fdb176a051d064a4e74d0d27014c0c87a1d1609fb9cd21c889e20e7e003177805dfbd92698f
TLSH
T1C4F05963817AF47B10B849BB2C05BD4A9E7BE4300653B4F8EB6E492CB1A1CF31216407
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 55e8c4fbb2afd4890d96b8ad3ff1d3eff1b9f01ff7f248a04afc4454f1e2307f
MD5 1031e1bb8a8746b7584314ea8bf8f215
SHA1 a916a57702844607e408683bb873fa93b205f035
SHA512 44a7b6cab4587d4e2fe122f642b43a4ce5725cbac0c89b204e8a445c1841b5c857f3328927f7f9ab3dd8a4ba5771ec1a148df6b8a174114e3a4eb0c338015712
TLSH
T112F0592282BAE47B10B819EA2C45BD89AE7BE4304152F4E8EB6E452CA061CF31217457
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59ea95.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity~RFe59ea95.TMP
Size 522B
SHA256 b0ab198cd0e3d2ff36b6ef9ebf9842c79a9bf7d12903845d2383a36728c40218
MD5 1fca63c3df2281621960c43f6cbab94a
SHA1 30aeabb5f24a85a9d0840c6c541c46848e888f00
SHA512 d92bb68a1545dc364d3bb129f386a022193af79d3a490bb13e75027e607de4e80b193642244d59d581c5c7ffbbe47d621ddb5a563011106cccc309a41c8163da
TLSH
T1BAF05963C27AE47A60B809AA58057D89EDBBF8301552B4E8EB6E452CE0B8CB31213443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 569e2c34f845b5bd77d696c27ccd2362f8f99a0d9150c32a09d08aecced6c534
MD5 777cdaf1a95f9f5007f112b5d23c0fd5
SHA1 dcda846a1be242a2ac8aa87862fa3c84b9f527b3
SHA512 ecd2237223637521470945cc16d557611030e83db578a47fefaece4edc71484fa51ddd32b3d9318a97f52f02b5c828539b0267c46a7bd520c5f0a0ef60635849
SSDEEP 96:ry4/dEuNpb9EYk+do616ZqVs7/x+6MhmuecnAU4j0BDeTK+gIj28XM1C7K:rycOnY9oMVsV+FTAv4BDRSG6K
TLSH
T14AD1B5035B24A97B4CC7E109FA39BA13D2F95022A6D52E88E7F8461C04EB6CC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 fa1cc71d60f37e4a093a1e178c8f97815bf649e75157c9e6ee0def017b97601f
MD5 702f34a115af6452d9b75c34648b3894
SHA1 6e466e7cd93cee81a7a76490b1a088156723ada3
SHA512 aab655c63869da0285d4e94ef0685a38642d3dd074cb116437635a2c84637cfa35e8417dce9b30b1a41ee5d26e77b62e1e95afa3e9e335dda472170023eee2be
SSDEEP 96:sty4/dEuNpb9EYkMo5h16ZqVs7/x+6MhmuecnAU4j0BDeTK+gIj28XM1C7K:stycOnYzonVsV+FTAv4BDRSG6K
TLSH
T1ECD195065F24A97B4CC7E119FA29BA13E2F96032A5D51E98E7F8461C04EB6DD6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 9632b8d3a9cc47c1c6f5386b9589cf692910911f80dd11c62db6467e13e13ffc
MD5 d2ac4b74443fbdda32c156c34190f6f6
SHA1 b54ca6c9ef9bb661b65b3932830e34b801638a6e
SHA512 3930680cea8ba4619b0600fd75ac11144c3519b14c7e3ce890f0e181f15d66470cfe5c71250248fa7de83e9d20e9e774eca41c57fd792c7ecb22c0acfbe67c44
SSDEEP 96:sty4/dEukGpb9EYkMo5h16ZqVs7/x+6Mhmuecn45MHnBDeTK+gzlA528XM1C7K:stycO5YzonVsV+FT45qBDRaG6K
TLSH
T1AFD197075E24A97B4CC7E119FA39BB13E2F9606265D52E88E7F8461C04EB6DD6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a2fac.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences~RFe5a2fac.TMP
Size 6KB
SHA256 c6e83957354ae27927355c1de3f82534ed723387e1b86044a6160b75841cc8c5
MD5 f281654e1706bb295bed6b00e15bf35c
SHA1 c507d15723803154e703436776668b7dea3cc3ce
SHA512 eae609e41255b79a1035f4567b4fe501af4b6d652a68badf62222aa1bdd1a2302f3bab0accbd2898739b6a306293a7726a25f511f2d458e4d6392815856cce95
SSDEEP 96:ry4/dKuNpb9EYk+do616ZqVs7/x+6MhmuecnJN41eBDeTK+ggj28XM1C7K:rycgnY9oMVsV+FTJ+QBDRGG6K
TLSH
T13AD1A6075B24A97B4CC7E108FA39BA17D2F95021A6D52E48E7F8471C08EB6DC6307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11a05ff6c0f3e47b_0

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\dfa88b9f-c678-4593-9de7-7cc7675806a9\11a05ff6c0f3e47b_0
Size 22KB
SHA256 4949067a4ac11680d3f9db5327fbe21337a275cf85dd2b912d95549e9462c40e
MD5 750ae7e3e9473ad819699e63875293ba
SHA1 90e49fbe0a611f63bb28eb975fd3b44de4aae81b
SHA512 a87aa91d72b8096dc1a355c8d3510771d2858b7264f0d5123e410c5bf9c0fa291d8e7ea6e3f98a0d4cbe61c8fd8172d3bdc3b0aa6d3ceda6e13da3402ebd4991
SSDEEP 384:pnx2CAFnTlfFr46OEpSfMfmOaYe0Hv/PJlGkx36HhsFkhsKgFUp062G:pxQsKeGm8HvplGk24KgFUq6D
TLSH
T1FFA2F152363EB914573B32411A0BEB6CE8D2BAC63412F4649F27CB46AB604D5A4EBD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f29785da697f066c_0

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\dfa88b9f-c678-4593-9de7-7cc7675806a9\f29785da697f066c_0
Size 267KB
SHA256 0cda225a56040d8271f3a7ed66bb88a34e1f4f2185c0c7c00b1d74fdea35b4de
MD5 a7a7e5e31710724012f794ad4dc095b8
SHA1 cb07fba9ac0ae79660a7470f7e1be583f17c446f
SHA512 b4512721678e19d4f3525963050c5e84e2f0cbe99f727ce3b3de7b31fdbeb0ea9d12516af7d168ae4787546d4e6b48d0954e280fa91f8b1a961953a4b53256ec
SSDEEP 6144:OUrOu81F4vhVBlOyIoGJ+II5Hl6NvcdgjLkfqqRLuTkryhLbFdr6V:rrOuGFatvWcejLbQikMK
TLSH
T198442314C7DEAB15C2249E9867E107CC6111E8EEB0F36F3E7A17BC71BB3540E69945A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\dfa88b9f-c678-4593-9de7-7cc7675806a9\index-dir\the-real-index
Size 312B
SHA256 3fd9fad3ca8cfc15f96faeaa96412d2dd15ed89f02974e4908782c8f5f36f475
MD5 6bf2ee9646e8cf265751d5d904c794a4
SHA1 ee0653880b7f20db587283ab507d0f916492cbd4
SHA512 8f0dfc9929c50bc37b164c6d0eb001722157c41998038497dd0a2e274ff7aab99b6f9bc57519ba5afb6db670bf005a9fb89c4267103f759f0b7dc92335842926
TLSH
T1ABE09706A1DC0084DD9080B4D035015A3325CD0081291BA380B47DBDAD0304FED4041C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8dba.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\dfa88b9f-c678-4593-9de7-7cc7675806a9\index-dir\the-real-index~RFe5a8dba.TMP
Size 48B
SHA256 6fcbb122c67633dcebce0a88ecf143f0a7420491035bb6284dacbb75ebd4d3f7
MD5 4689bdfe6d4bd94ee1b4d0620226a234
SHA1 8647a455ed0645146ea990ac6a1c11e49eb9fcc2
SHA512 2033dc61c31258ee3e4a16ac576e03a2d73f5e126a54229c2f946b35bc387b5f0441fb88151836533a67506d58ff06d4ed6acff7f94bc0a2b65dd031f2ac34dd
MD5 SHA1 SHA512

Submit Download

todelete_097c0512fc21d937_0_1

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\dfa88b9f-c678-4593-9de7-7cc7675806a9\todelete_097c0512fc21d937_0_1
Size 70KB
SHA256 60d6f31e10a72eef72b6a9611951015a99893737f9435111a23676f2079a88d8
MD5 936c42af076324ca0df1fb0caef4e008
SHA1 275843782b632823df250ddf230c3557441c3473
SHA512 d3c74a6ff517f5dde48c889c6432bc23173134c480ba245769a37cfaf8c4e003171d82db42cc37f5e5b63785e4124a8a7ccbad330da2154bf2adc9fa05a255a4
SSDEEP 1536:GaDZe3J0DF52ualQb7QbcWmXFtzbY1HdlDPsz/29w7C:RguzeQb7GcWmXTMbszucC
TLSH
T15A63F21B48041A40F750057ABFC959BE57E2C9A96C939FBD382E0DEA3F24D742D4D8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

todelete_3a2c21168936296d_0_1

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\dfa88b9f-c678-4593-9de7-7cc7675806a9\todelete_3a2c21168936296d_0_1
Size 68KB
SHA256 e3f7b5be180df3b1cf0f053c88d04947e27b7fa6ff05acde43694b9834b6a75e
MD5 0be3a64f7000189e12ef240af7acf4b5
SHA1 b6141e938533bb49f36caa06ebcc0bdc361daa4c
SHA512 f5221746100710ce1f2a7357d062a0d70050bfb91765f4deb46512e9f3418616934bfaa93ebc5b51a9b6d4ecc7fb1ec175de1b247adc3202417323a774b10045
SSDEEP 1536:c4poSgfaSxXHiiyjHzzTqG9acFJSIJev0T8b2Yew3D/U77sw/:cfSxSxXCZzKcFJSp0TBYe4/+QU
TLSH
T1D963023AFAB68343C6DAECB51B6D474CD3E17472B7F3E4EA4980677F5418081C985A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

todelete_f8183872858f8272_0_1

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\dfa88b9f-c678-4593-9de7-7cc7675806a9\todelete_f8183872858f8272_0_1
Size 195KB
SHA256 ec3a07e69396f676b0e54e45bb33a0119f0b466e5e95a90a25cd04b5bf8ef863
MD5 6cebbd489623e7da39ee5445141ed332
SHA1 cfbb0e46bc184a333fef3b83f4d4103d4e398873
SHA512 8297e44bc2b6422530a2d3ae63c517907a3353c9a7f96d804735d4fb50eb57e48a843575e012260418c949b1297e535f4ec0ebb0b1f83638b56d5a5e04cfd2a7
SSDEEP 6144:elLSRIrrVbdCWx+nCNq6lpgLaidnEs6Fyiq:elS+Nb+nCpgLJnEpFyJ
TLSH
T1C31423AC8C295353E9A7477F5B42B2C0ABA3123173921AB868F103DB286DCC277DD559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\index.txt
Size 136B
SHA256 1a3c59cd6ca2416207e5a682b244e01621a3c624128b92b5dd0eb622bf1af087
MD5 ef6fe8d5c8a0afe13b2ad5e25d9df5a4
SHA1 e85cee01ed93c684684e13217188f0721ab72970
SHA512 e185f8247ccfc9e4c60df70d88f7e05e49a68a0c5414cd84c2f4eec94eed7431d39cf18ef6a9ca4dfafb8358db3028b8d78bc4ec720d06b973cb9895a85a5f54
TLSH
T1B8C08C120952B8A62790A78BC2886981800BAB52C3802C0D7208F10CC0BD8B286A0860
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a8df9.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\index.txt~RFe5a8df9.TMP
Size 140B
SHA256 aee9d5c352a3e38b09dda5478eedda0f7668cbe946945836400f3cd6a3f12144
MD5 840c5fd802422ce0218e6eb2405867b9
SHA1 c7e8948a5db3a707d635eca2c2088331aab0e317
SHA512 f27a2cfecb89b62174d8c267da18c6492c2ddc7450954a92583700a5e71b5cc8a0237591f8a0bdc80cd2d1036aa5d79c0e5407fa6b8aa82b4513d3b1abc669ce
TLSH
T174C08C560952BAA22780A78BC244A841800AAF52C7802C0C6149F14CC0B99328AA0920
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 2KB
SHA256 dbcb7b6dae809ae05b9bd61ddfe8a98819e401ffb16cdd57e0f25d2ae7cb8823
MD5 464eff66bab5dc0abe9040124be08a25
SHA1 85231e952505a8d9f7bb32d353053b82ef525466
SHA512 fce1d64188a4a04c11880e5262f56712c9f3fc1dd5aa8bd7d140e5aa69fae0ef07998b3361502254d3b45d2d4c55105975d609293dad6e1daf05215eaa3d1d4e
TLSH
T11951527369109A768AE3D604798A3E23EF7450A6EF922F55AAEC1B0C00D755C2343C76
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 3KB
SHA256 16df75dbb6cc5ae3aab224ec4dadff540c406293bc41bc0e74c34d6c107ce044
MD5 423540d2c77ad85c18732afceaa1d5bf
SHA1 17a99065caca6400769be0a2ebed0fa47c150ab4
SHA512 d6e07e6d5228e9cd1d6879a7dea59ba9d4140a0d87f622ad685de92097897279c8cd1f6df672279a20d4df22ef03df62c696536bb035b5f46d1e471ebb0b8818
TLSH
T18D71547B696099778EE3DA0478853B17BBA45067EA963F95DAEC0F0C01D72981343C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 3KB
SHA256 1059557a4ad51df5ad6a23d1f730e8acddac35993fbc1c6879019723e6f01429
MD5 dbaae59390fe9986761aa3dc491ba4bd
SHA1 07b16a218b18fb2e41742071e78021435bfb3deb
SHA512 02ef0f9ce42f19e4ecbea7c3a5cfc96c08f25d7534d45006be5eb56f09ea47810d6caa975d41bc663534ade07a03a1a590f16284546c3ccb2a39d12abb9ceec8
TLSH
T10D81536B6960A9774EF3DA047C853F17BBA44067E9966FA9DAEC0F0C41D72881343C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 3KB
SHA256 d7df7fc1a2a7a4323373b632a6d7374178331f55b7c88d2825dc96a84361385f
MD5 b29b106bc76d63a50d1326c90b20933b
SHA1 36c9d7f23cfd8044df86150de2e73e859a18145a
SHA512 db17c51f5c5d67c2c8d84b77c057928f16c591ef97e7086d67a59394e691266d86402e2c6c79274cde3169948fa452ac6e86f0561c84db9ef4c2a0309d9f1b25
TLSH
T1FB81627B6960A9774EE3DA047C853B17BBA44067EA966F99DAEC0F0C01D72881342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 16KB
SHA256 da4e91365d5b06c2258dc26afab1a7705b08c97d08d635a04f607e58b7dfbc40
MD5 6d0791f66564b73f2699a8132f8003ba
SHA1 4821f700cff3700ffd1464a6eeb335298793b97e
SHA512 a9ce39c7fd366448c29b0fd815482038c4d89a31a7e9e11e41c92003e828535a60c3cd294b697bdb7479621997ac0932a19b3abd66c0176d7ef0eaffc9205fe3
SSDEEP 384:S+aQikB+z/xvxjg/qhEwNBSLy3jbYsEisdG19zm:9/UxvxjgC+63Eis01Fm
TLSH
T146729E3B54257D3396F3EA047D49179BEBF884B395C26EB88AED6F0806C72D80342C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 17KB
SHA256 fd78163af49e03285bb72ba87b965494426f8140d2fa152119c7a02c1ddd0b2f
MD5 7976c57dbc3c1a4e445d0d94e8cca362
SHA1 e2b5d9c0ee983307dfadf5c15edbe3b3a57460e6
SHA512 974db2444a8608fea0bd319b0fda8aa9058b63b7b3464268058e7745b0b6c18fd135f0a0e7a2dd125901bd250bca00585fa0fa8858257e0bcac1db732839041f
SSDEEP 384:4+aQikB+z/xvxjg/qhE5NlLy3jbYp1yEisdG19zm:3/UxvxjgC+gfEis01Fm
TLSH
T1DB828D3BD425BE3399F7E6417A4A679BDBF4806296C55EE48DE92F0C06C36DC0342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5991a7.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State~RFe5991a7.TMP
Size 1KB
SHA256 4c9306e7e854909e40ce18172962af481be56a08c601499061e2c83bb6145a34
MD5 bd9110d79f0321ad3495e307eb55a7eb
SHA1 4b381505c98e6fe871006a0c26e7508999a14d4b
SHA512 3bf8f3a84eb362c6bfdffffa12fd2a0d65e64ce058948e9dbea8e2c1cb8e99bd724443d5be79726eba5dc0ac5a7e7edf5842c446434b6c3c99c289e92107d821
TLSH
T1D43152B7A4509A72DED3A20634857E97BF7000BBDB820F44A6ED4B0D01E708C976BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/460-557-0x0000028148130000-0x000002814813A000-memory.dmp

Download

memory/460-559-0x0000028148170000-0x0000028148194000-memory.dmp

Download

memory/460-558-0x0000028148170000-0x000002814819A000-memory.dmp

Download

memory/460-553-0x0000028148050000-0x000002814806E000-memory.dmp

Download

memory/1236-989-0x000001C5559D0000-0x000001C5559D1000-memory.dmp

Download

memory/1236-999-0x000001C5559D0000-0x000001C5559D1000-memory.dmp

Download

memory/1236-996-0x000001C5559D0000-0x000001C5559D1000-memory.dmp

Download

memory/1236-997-0x000001C5559D0000-0x000001C5559D1000-memory.dmp

Download

memory/1236-272-0x0000022090AC0000-0x0000022090AEF000-memory.dmp

Download

memory/1236-1000-0x000001C5559D0000-0x000001C5559D1000-memory.dmp

Download

memory/1236-995-0x000001C5559D0000-0x000001C5559D1000-memory.dmp

Download

memory/1236-28-0x00007FFEE6B70000-0x00007FFEE6B71000-memory.dmp

Download

memory/1236-998-0x000001C5559D0000-0x000001C5559D1000-memory.dmp

Download

memory/1236-991-0x000001C5559D0000-0x000001C5559D1000-memory.dmp

Download

memory/1976-556-0x000001F2EBF80000-0x000001F2EC032000-memory.dmp

Download

memory/1976-431-0x000001F2EBB70000-0x000001F2EBB92000-memory.dmp

Download

memory/2872-104-0x00007FFEE6B70000-0x00007FFEE6B71000-memory.dmp

Download

memory/3424-621-0x0000029BDE2F0000-0x0000029BDE3A2000-memory.dmp

Download

memory/3552-277-0x00007FF7E9EC0000-0x00007FF7EAB4C000-memory.dmp

Download

memory/5492-0-0x00007FF7CD990000-0x00007FF7CE2C6000-memory.dmp

Download

memory/5824-956-0x00007FFEE67C0000-0x00007FFEE67C1000-memory.dmp

Download

memory/5824-957-0x00007FFEE5C10000-0x00007FFEE5C11000-memory.dmp

Download

memory/5868-583-0x000002C81FF60000-0x000002C81FF8F000-memory.dmp

Download