3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Size 12.6MB
Sample260723-dnt4dsff98
SHA256 3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f
MD5 301f985e0f7a90213398065ca1845d8a
SHA1 604662714007356875a3b284bee63b2be59f27dd
SHA512 c5873ac9caec76d6a9e608eda31436a008e3e54f3ef2e92d5126814ad49294387be73c2a4c6c3cfe1509a7686494d3762a9ed010997532ce23f046e2bb6e6aa6
SSDEEP 98304:gRpfWLfVFuRPXhtg0cwEODpfpFr3uEek+/Alb6DxNhYscTWWDtWOqh:gRpfWLfVFuRPXhtdcwEIL4i6tXdMaOq
TLSH
T10ED6F7207B5E99ACD09BC474824B8A66493130CB0B35B9FF45D496383F6EBF46F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Unexpected DNS network traffic destination 27 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	64	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	70	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	47	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	11	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	30	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	32	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	33	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	35	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	43	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	49	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	31	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	34	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	37	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	51	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	53	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	67	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	68	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	69	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	46	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	28	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	36	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	52	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	54	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	55	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	56	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	26	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
Destination IP	48	223.5.5.5	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_1982861318\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_1982861318\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_662007445\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_662007445\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_662007445\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_1918797478\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_1918797478\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_1918797478\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_1982861318\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_1918797478\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping700_1918797478\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5392	msedgewebview2.exe
5392	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
700	msedgewebview2.exe
700	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 700	2648	3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe	89
PID 700 wrote to memory of 2608	700	msedgewebview2.exe	90
PID 700 wrote to memory of 4856	700	msedgewebview2.exe	91
PID 700 wrote to memory of 4856	700	msedgewebview2.exe	91
PID 700 wrote to memory of 4856	700	msedgewebview2.exe	91
PID 700 wrote to memory of 4856	700	msedgewebview2.exe	91
PID 700 wrote to memory of 4520	700	msedgewebview2.exe	92
PID 700 wrote to memory of 6024	700	msedgewebview2.exe	93
PID 700 wrote to memory of 6024	700	msedgewebview2.exe	93
PID 700 wrote to memory of 6024	700	msedgewebview2.exe	93
PID 700 wrote to memory of 3540	700	msedgewebview2.exe	94
PID 700 wrote to memory of 3540	700	msedgewebview2.exe	94
PID 700 wrote to memory of 3540	700	msedgewebview2.exe	94
PID 700 wrote to memory of 3540	700	msedgewebview2.exe	94
PID 700 wrote to memory of 3540	700	msedgewebview2.exe	94
PID 700 wrote to memory of 4500	700	msedgewebview2.exe	95
PID 700 wrote to memory of 4500	700	msedgewebview2.exe	95
PID 700 wrote to memory of 4500	700	msedgewebview2.exe	95
PID 700 wrote to memory of 4500	700	msedgewebview2.exe	95
PID 700 wrote to memory of 4500	700	msedgewebview2.exe	95
PID 700 wrote to memory of 4824	700	msedgewebview2.exe	99
PID 700 wrote to memory of 4824	700	msedgewebview2.exe	99
PID 700 wrote to memory of 4824	700	msedgewebview2.exe	99
PID 700 wrote to memory of 2588	700	msedgewebview2.exe	100
PID 700 wrote to memory of 2588	700	msedgewebview2.exe	100
PID 700 wrote to memory of 2588	700	msedgewebview2.exe	100
PID 700 wrote to memory of 5392	700	msedgewebview2.exe	101
PID 700 wrote to memory of 4420	700	msedgewebview2.exe	102
PID 700 wrote to memory of 4420	700	msedgewebview2.exe	102
PID 700 wrote to memory of 4420	700	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe
"C:\Users\Admin\AppData\Local\Temp\3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe"
1⤵
- Unexpected DNS network traffic destination
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2648.1728.9117121638376046562 /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView /prefetch:4 /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffc68735fd8,0x7ffc68735fe4,0x7ffc68735ff0
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,10310338042757563809,13287541319008551259,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2204 --field-trial-handle=1764,i,10310338042757563809,13287541319008551259,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1764,i,10310338042757563809,13287541319008551259,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1764,i,10310338042757563809,13287541319008551259,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4008 --field-trial-handle=1764,i,10310338042757563809,13287541319008551259,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4696 --field-trial-handle=1764,i,10310338042757563809,13287541319008551259,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4748 --field-trial-handle=1764,i,10310338042757563809,13287541319008551259,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4236 --field-trial-handle=1764,i,10310338042757563809,13287541319008551259,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView" --webview-exe-name=3f9ace3182c5d95c5378bbd5863bcf730e492f03d1cd4312c9b195299c122e9f.exe --webview-exe-version=2.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4676 --field-trial-handle=1764,i,10310338042757563809,13287541319008551259,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:c6d91f70b73e044c9f673c1069ea25d38cc5f3fc
    3⤵
    PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b5281c5f9cf46f4b78a45d62f0f6d5eeb137e7cd4df3045a86cfbe73beed5701
MD5 cca785ff68ab81531e00fc887d8d3140
SHA1 465febd0bfd3fb4195c41b6bff4a496b9dbcfeea
SHA512 c33df5cf4bdafc3db85ca828cb361dfbc10eff162c8eb13bea7a7a11b122c67780361b5182891880eca94f3fe721d6d95936a6cbfff94fc9b8db22d2b5bcc40a
TLSH
T17ED0122676410134C0103473100369092900C24B430D80416429851E1B163501D0A459
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8a0a57309789dce03ed7decac7a05a0fc32340cda5fbf9c4b15e4ba53736de06
MD5 076b910c822ed96b99ab7f3e8c76559d
SHA1 c5752cd09b97ac2b43c675937f5a810b3982a079
SHA512 3398e7472a4de9196b82c37e7f55428ce4e88d756ed55bb3433612ace87b302c6d87e34657b8e08649b893051e1bf01161141ed978fec82a739095f63b27641d
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

76686666-9ad9-49ef-9dce-d7488e365c0b.tmp

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Default\76686666-9ad9-49ef-9dce-d7488e365c0b.tmp
Size 6KB
SHA256 018c925c5d8ec6696e1abafbbab984b7ca335b3c2dfbdaabfc55c0bd8becfa7e
MD5 a232961844d562c445bc68e72a346cac
SHA1 6e38d7c69239aac370d4ae0c5ce470debd81b056
SHA512 5aefc4c2dfa4692a09980f6675f32121007acdd448cbe70eada133925d40001356c487c98b9451405d5fc729dce5d780100dd1bc6fecd3de7ca5451bff60700f
SSDEEP 96:stP/dHjvOMb9EkTo5h16Z0vs7/x+6MhmuecJbrMkkjePK+gAuT28XM1C7K:stX1jwMonvsV+Fdbrwj1WcG6K
TLSH
T1BAD195065E24697F4CC6E209FA29BA17E2FA547275D52E58E7F8871C04DA6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 cf75b34d311c1f319422175e6aa83507ec86c1f7129f5753d9ca0af1dbef2383
MD5 2c5ad96be8f18c3a23957282d3811596
SHA1 bc4c277f6274e496afd61a2f37248dab9ba2aff1
SHA512 cbacbb259c7d7536e698de36630812f9ce16894f4608507261284c9dbdbbb8ebedc1452604b2aa8994bcf36991c3dd70ddcbeccf9d3ad48bc84efcc79ceff2db
TLSH
T144B011080000C823C28C03F020EA20BC33B0AFE22223288CC8A080FA8A23283830A228
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598b9c.TMP

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe598b9c.TMP
Size 48B
SHA256 4dbe834120ac8271d2906e42eac95a6671a79119e2594eb36b3dc6e162ea9e71
MD5 605e9383a9b1c23ecca627d172c2fa52
SHA1 411f7d0fdcc19357112beb7be4e53311374d4bf3
SHA512 a83f783a86854c2b8b26611ebb62433a061ed3b597910dce8d90c6da55e51885dc7b93227485bcad973a6e9c8630827ce6424a4b2942d470fc3876c886c7af84
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Default\Network\Network Persistent State
Size 238B
SHA256 3a984152f56639262684ec2a65b582620ebbeb7df0cfbb804d71f221deb99dec
MD5 1622076891508cc87d79647883de8e03
SHA1 4e9cfe9e9c4e7b23d1f6bac53243da49ba15d1ca
SHA512 c3942375f04586dfcdeab5af50217f076b1309b80e8e6845ee6e941a99aa05bb6e35833dad309d406f44dcdbc856ed1a67842ed05a81e3236d033c7076428655
TLSH
T1B9D097A2427098FE8B4093A01A287903CA7E0002931C8E7ACAB9B7758AA20B9D024807
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4e8f.TMP

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Default\Network\Network Persistent State~RFe5a4e8f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Default\Preferences
Size 6KB
SHA256 45a7bbc2f51938b9eea5e9562d3ec9bdcd74d14712b7df48a34970fab5b4dccb
MD5 cb2237bb4d5aaf1f048674247e172da6
SHA1 c11ae9e5f8d56abbe8bbe5855db02e5cd7ce096f
SHA512 1f67e884da07747484fdc5c86f9d4700977fa44cafcfcbe4e30ee859693263ec8eb1dfd38c4d1bd8da05c286203e8f0cbfb4be572391a547f72667901d2cde10
SSDEEP 96:stP/dHjvVGMb9EkTo5h16Z0vs7/x+6MhmuecJbrMkkjePK+gZ/Tuq28XM1C7K:stX1jiMonvsV+Fdbrwj1DLxG6K
TLSH
T1FAD1A5065E24697F8CC7E618FA29BA17E2FA547265D42E48E7FC871C04DB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Local State
Size 2KB
SHA256 1da232fc19d0c0c677213b95e8740ae78e2141c32581d31d5327166486b3b192
MD5 57bcbc7348231d586470e6923eeda845
SHA1 a70c8b54e0f0eded7de39e43454d49701a99ba20
SHA512 790b90ee93f63a2cab45c8cf98b44d4bac746a9a1e796a803a42bb05ed81b99bb51c4546ae5ff61260f4f81f85ca5afccb39481bfbfc98ee2824b5e4cb12d21c
TLSH
T105519677A8105A7BA9E24649B9867F138E7A51E9FF921FA0E6DC070801D745C1317C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Local State
Size 3KB
SHA256 90625246569ea0f283734eef782223b6cefd70ff77242f7fa9cee14ecceb6c07
MD5 1c8b200c3ea0958be4b0ed742af497f4
SHA1 addd24659fde9aa56a473bdd073dd83e449e67fd
SHA512 933dbeb8f6fe0b086e381140fbd35a27ec46ee74ae6375724b7879a028492207de6b0bde47313c64f7c53e8a9d27b87c5ec4791c2ff877d3a23dfd0d6ecec1d3
TLSH
T11871987F9860997B5DE28605B9822B07A7A65067FAC13FA4D5EC0F0C01D72881353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Local State
Size 16KB
SHA256 2c83bccbda543bc594fdaba31640499a7c4babba4336f92dde651b6e89ecdc19
MD5 9fefa92e04d39bbacfe83d926d13d0b8
SHA1 bc7379984565c3814dd0c68ef8a12cafccb36835
SHA512 e00b518e29a3039452e076595d276c078495151f0db9ccf5dbdd51f08d06154b8e2de6b5703a300a0d46aae891eff36484cca3d6f896a913ac98029f55b396ca
SSDEEP 384:++aQikB+z/xvxjg/qhEmNBSyeG7tisdA9zH:J/UxvxjgC+HutisaFH
TLSH
T1F472AE3F58383D37A5F3EA05BD49178BD7BA84B2A5C26EB48ABC5F0906C32941343D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe593733.TMP

Path C:\Users\Admin\AppData\Local\com.ryen.nsd\EBWebView\Local State~RFe593733.TMP
Size 1KB
SHA256 7f2917b11d5b26661d91daa257f266f4b9306c177123a5ae4f9b08bb44be5f56
MD5 1a7ea7adccea14c7d131147acbae2068
SHA1 2bdcdcf5bbc99ce545dfb3a3d35b1e017e65319f
SHA512 53fa51c7d2b41203eb756103016121cf01f973fcc20952153f7f9ad8b9115d8c654f14e823ea84d4e5cfb0fdbb883d514103dfc20fd303c2ff42c499b792575b
TLSH
T1593174FBD8A01E7AB8921296B282BA474D6200EEA7824F90F5CC470906D608D533BD32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3540-102-0x00007FFC89D40000-0x00007FFC89D41000-memory.dmp

Download

memory/4824-238-0x00007FFC8AC30000-0x00007FFC8AC31000-memory.dmp

Download

memory/4824-237-0x00007FFC89F10000-0x00007FFC89F11000-memory.dmp

Download

memory/4856-199-0x000001EA9B720000-0x000001EA9B8E3000-memory.dmp

Download

memory/4856-183-0x000001EA9B720000-0x000001EA9B8E3000-memory.dmp

Download

memory/4856-47-0x00007FFC89D40000-0x00007FFC89D41000-memory.dmp

Download

memory/5392-284-0x000001C594540000-0x000001C594541000-memory.dmp

Download

memory/5392-285-0x000001C594540000-0x000001C594541000-memory.dmp

Download

memory/5392-293-0x000001C594540000-0x000001C594541000-memory.dmp

Download

memory/5392-294-0x000001C594540000-0x000001C594541000-memory.dmp

Download

memory/5392-292-0x000001C594540000-0x000001C594541000-memory.dmp

Download

memory/5392-291-0x000001C594540000-0x000001C594541000-memory.dmp

Download

memory/5392-290-0x000001C594540000-0x000001C594541000-memory.dmp

Download

memory/5392-289-0x000001C594540000-0x000001C594541000-memory.dmp

Download