c80bd45ff8b68ac28f62f67a01bbc12dfc61da50746a0adf3d02c06a86da33f7

Analysis

user interaction
yes
max time kernel
68s
max time network
92s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Torix Tools.exe
Size 9.2MB
Sample260822-pmn2jafa48
SHA256 c80bd45ff8b68ac28f62f67a01bbc12dfc61da50746a0adf3d02c06a86da33f7
MD5 8b6fadb0f35ad69fce7cd1253c082ac0
SHA1 075868b53486acc08d61820a5654f9f177a0eb39
SHA512 a592c08f007f3c32e56389a3a93d7929a71e78a80cc057f963065166b7c6096b7ed20c70f73913fdd7124c285cfd3b8087519915bc25364f61e9a043b860ec70
SSDEEP 98304:pBKd/8lvpWHyy4hU4oJarM0/IWb7SJqshzKa18VoDLS51DQbD8q8eIb:pEV8lvpoypO4A0IA7DsHCCDSEng
TLSH
T113A6AD1BA66901F4D0A6D138DA838C13F671748A473197EB3B9C46161FE7BE0BE39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6452	powershell.exe
2780	powershell.exe
3380	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
6672	Torix Tools.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Torix Tools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Torix Tools.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Torix Tools.exe
File opened (read-only)	\??\G:	Torix Tools.exe
File opened (read-only)	\??\L:	Torix Tools.exe
File opened (read-only)	\??\Q:	Torix Tools.exe
File opened (read-only)	\??\R:	Torix Tools.exe
File opened (read-only)	\??\X:	Torix Tools.exe
File opened (read-only)	\??\Z:	Torix Tools.exe
File opened (read-only)	\??\E:	Torix Tools.exe
File opened (read-only)	\??\A:	Torix Tools.exe
File opened (read-only)	\??\H:	Torix Tools.exe
File opened (read-only)	\??\K:	Torix Tools.exe
File opened (read-only)	\??\N:	Torix Tools.exe
File opened (read-only)	\??\P:	Torix Tools.exe
File opened (read-only)	\??\T:	Torix Tools.exe
File opened (read-only)	\??\U:	Torix Tools.exe
File opened (read-only)	\??\B:	Torix Tools.exe
File opened (read-only)	\??\D:	Torix Tools.exe
File opened (read-only)	\??\J:	Torix Tools.exe
File opened (read-only)	\??\S:	Torix Tools.exe
File opened (read-only)	\??\V:	Torix Tools.exe
File opened (read-only)	\??\W:	Torix Tools.exe
File opened (read-only)	\??\Y:	Torix Tools.exe
File opened (read-only)	\??\I:	Torix Tools.exe
File opened (read-only)	\??\M:	Torix Tools.exe
File opened (read-only)	\??\O:	Torix Tools.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Torix Tools.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6796	tasklist.exe
6188	tasklist.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4608	sc.exe
6440	sc.exe
6576	sc.exe
5972	sc.exe
4368	sc.exe
7152	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
604	cmd.exe
7136	cmd.exe
5700	cmd.exe
6816	cmd.exe
6112	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4608	sc.exe
6440	sc.exe
6576	sc.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5104	net1.exe
6080	cmd.exe
5680	net.exe
1892	net1.exe
6076	cmd.exe
4660	net.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
7020	timeout.exe
5872	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Kills process with taskkill 13 IoCs

defense_evasion

pid	Process
5748	taskkill.exe
2336	taskkill.exe
1380	taskkill.exe
1868	taskkill.exe
4780	taskkill.exe
5036	taskkill.exe
6976	taskkill.exe
4828	taskkill.exe
6240	taskkill.exe
7092	taskkill.exe
4640	taskkill.exe
6624	taskkill.exe
6000	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Torix Tools.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318752537259459"	Torix Tools.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	Torix Tools.exe
4960	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe
6672	Torix Tools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1336	msedgewebview2.exe
2856	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6796	tasklist.exe
Token: SeDebugPrivilege	6188	tasklist.exe
Token: SeDebugPrivilege	6452	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeIncreaseQuotaPrivilege	2780	powershell.exe
Token: SeSecurityPrivilege	2780	powershell.exe
Token: SeTakeOwnershipPrivilege	2780	powershell.exe
Token: SeLoadDriverPrivilege	2780	powershell.exe
Token: SeSystemProfilePrivilege	2780	powershell.exe
Token: SeSystemtimePrivilege	2780	powershell.exe
Token: SeProfSingleProcessPrivilege	2780	powershell.exe
Token: SeIncBasePriorityPrivilege	2780	powershell.exe
Token: SeCreatePagefilePrivilege	2780	powershell.exe
Token: SeBackupPrivilege	2780	powershell.exe
Token: SeRestorePrivilege	2780	powershell.exe
Token: SeShutdownPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeSystemEnvironmentPrivilege	2780	powershell.exe
Token: SeRemoteShutdownPrivilege	2780	powershell.exe
Token: SeUndockPrivilege	2780	powershell.exe
Token: SeManageVolumePrivilege	2780	powershell.exe
Token: 33	2780	powershell.exe
Token: 34	2780	powershell.exe
Token: 35	2780	powershell.exe
Token: 36	2780	powershell.exe
Token: SeIncreaseQuotaPrivilege	6452	powershell.exe
Token: SeSecurityPrivilege	6452	powershell.exe
Token: SeTakeOwnershipPrivilege	6452	powershell.exe
Token: SeLoadDriverPrivilege	6452	powershell.exe
Token: SeSystemProfilePrivilege	6452	powershell.exe
Token: SeSystemtimePrivilege	6452	powershell.exe
Token: SeProfSingleProcessPrivilege	6452	powershell.exe
Token: SeIncBasePriorityPrivilege	6452	powershell.exe
Token: SeCreatePagefilePrivilege	6452	powershell.exe
Token: SeBackupPrivilege	6452	powershell.exe
Token: SeRestorePrivilege	6452	powershell.exe
Token: SeShutdownPrivilege	6452	powershell.exe
Token: SeDebugPrivilege	6452	powershell.exe
Token: SeSystemEnvironmentPrivilege	6452	powershell.exe
Token: SeRemoteShutdownPrivilege	6452	powershell.exe
Token: SeUndockPrivilege	6452	powershell.exe
Token: SeManageVolumePrivilege	6452	powershell.exe
Token: 33	6452	powershell.exe
Token: 34	6452	powershell.exe
Token: 35	6452	powershell.exe
Token: 36	6452	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeIncreaseQuotaPrivilege	3380	powershell.exe
Token: SeSecurityPrivilege	3380	powershell.exe
Token: SeTakeOwnershipPrivilege	3380	powershell.exe
Token: SeLoadDriverPrivilege	3380	powershell.exe
Token: SeSystemProfilePrivilege	3380	powershell.exe
Token: SeSystemtimePrivilege	3380	powershell.exe
Token: SeProfSingleProcessPrivilege	3380	powershell.exe
Token: SeIncBasePriorityPrivilege	3380	powershell.exe
Token: SeCreatePagefilePrivilege	3380	powershell.exe
Token: SeBackupPrivilege	3380	powershell.exe
Token: SeRestorePrivilege	3380	powershell.exe
Token: SeShutdownPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeSystemEnvironmentPrivilege	3380	powershell.exe
Token: SeRemoteShutdownPrivilege	3380	powershell.exe
Token: SeUndockPrivilege	3380	powershell.exe
Token: SeManageVolumePrivilege	3380	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 6076	4960	Torix Tools.exe	90
PID 6076 wrote to memory of 4660	6076	cmd.exe	92
PID 4660 wrote to memory of 5104	4660	net.exe	93
PID 4960 wrote to memory of 3844	4960	Torix Tools.exe	94
PID 3844 wrote to memory of 5880	3844	cmd.exe	96
PID 4960 wrote to memory of 1336	4960	Torix Tools.exe	97
PID 1336 wrote to memory of 5236	1336	msedgewebview2.exe	98
PID 1336 wrote to memory of 3380	1336	msedgewebview2.exe	99
PID 1336 wrote to memory of 3380	1336	msedgewebview2.exe	99
PID 1336 wrote to memory of 3380	1336	msedgewebview2.exe	99
PID 1336 wrote to memory of 3380	1336	msedgewebview2.exe	99
PID 1336 wrote to memory of 4156	1336	msedgewebview2.exe	100
PID 1336 wrote to memory of 6416	1336	msedgewebview2.exe	101
PID 1336 wrote to memory of 6416	1336	msedgewebview2.exe	101
PID 1336 wrote to memory of 6416	1336	msedgewebview2.exe	101
PID 1336 wrote to memory of 1896	1336	msedgewebview2.exe	102
PID 1336 wrote to memory of 1896	1336	msedgewebview2.exe	102
PID 1336 wrote to memory of 1896	1336	msedgewebview2.exe	102
PID 1336 wrote to memory of 1896	1336	msedgewebview2.exe	102
PID 1336 wrote to memory of 1896	1336	msedgewebview2.exe	102
PID 4960 wrote to memory of 604	4960	Torix Tools.exe	103
PID 604 wrote to memory of 7020	604	cmd.exe	105
PID 604 wrote to memory of 6796	604	cmd.exe	106
PID 604 wrote to memory of 716	604	cmd.exe	107
PID 604 wrote to memory of 6188	604	cmd.exe	109
PID 604 wrote to memory of 6084	604	cmd.exe	110
PID 604 wrote to memory of 6672	604	cmd.exe	111
PID 604 wrote to memory of 5872	604	cmd.exe	112
PID 6672 wrote to memory of 6080	6672	Torix Tools.exe	113
PID 6080 wrote to memory of 5680	6080	cmd.exe	115
PID 5680 wrote to memory of 1892	5680	net.exe	116
PID 6672 wrote to memory of 3192	6672	Torix Tools.exe	117
PID 3192 wrote to memory of 4752	3192	cmd.exe	119
PID 6672 wrote to memory of 2856	6672	Torix Tools.exe	120
PID 2856 wrote to memory of 5176	2856	msedgewebview2.exe	121
PID 2856 wrote to memory of 6980	2856	msedgewebview2.exe	122
PID 2856 wrote to memory of 6980	2856	msedgewebview2.exe	122
PID 2856 wrote to memory of 6980	2856	msedgewebview2.exe	122
PID 2856 wrote to memory of 6980	2856	msedgewebview2.exe	122
PID 2856 wrote to memory of 5392	2856	msedgewebview2.exe	123
PID 2856 wrote to memory of 4604	2856	msedgewebview2.exe	124
PID 2856 wrote to memory of 4604	2856	msedgewebview2.exe	124
PID 2856 wrote to memory of 4604	2856	msedgewebview2.exe	124
PID 2856 wrote to memory of 2504	2856	msedgewebview2.exe	125
PID 2856 wrote to memory of 2504	2856	msedgewebview2.exe	125
PID 2856 wrote to memory of 2504	2856	msedgewebview2.exe	125
PID 2856 wrote to memory of 2504	2856	msedgewebview2.exe	125
PID 2856 wrote to memory of 2504	2856	msedgewebview2.exe	125
PID 6672 wrote to memory of 2780	6672	Torix Tools.exe	126
PID 6672 wrote to memory of 6452	6672	Torix Tools.exe	127
PID 6672 wrote to memory of 3380	6672	Torix Tools.exe	131
PID 6672 wrote to memory of 7136	6672	Torix Tools.exe	134
PID 7136 wrote to memory of 5700	7136	cmd.exe	136
PID 5700 wrote to memory of 2576	5700	cmd.exe	137
PID 7136 wrote to memory of 3356	7136	cmd.exe	138
PID 7136 wrote to memory of 1552	7136	cmd.exe	139
PID 7136 wrote to memory of 2336	7136	cmd.exe	140
PID 7136 wrote to memory of 7092	7136	cmd.exe	141

C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe
"C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\system32\cmd.exe
  /c "net start w32time"
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:5104
- C:\Windows\system32\cmd.exe
  /c "w32tm /resync /force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:5880
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-features=MojoIpcz --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=4960.4208.18284707064708805876 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView /prefetch:4 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffb284d5fd8,0x7ffb284d5fe4,0x7ffb284d5ff0
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1764,i,5660544636512891086,13546664040880993683,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:2 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=1764,i,5660544636512891086,13546664040880993683,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:3 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1764,i,5660544636512891086,13546664040880993683,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:8 /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --enable-gpu-memory-buffer-video-frames --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3520 --field-trial-handle=1764,i,5660544636512891086,13546664040880993683,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /pfhostedapp:9ec860cf3e11e83fdd3c94bcf44cade46f38a9ba /prefetch:1
    3⤵
    PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:7020
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq LoaderNeon.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6796
- - C:\Windows\system32\find.exe
    find /I /N "LoaderNeon.exe"
    3⤵
    PID:716
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Loader.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6188
- - C:\Windows\system32\find.exe
    find /I /N "Loader.exe"
    3⤵
    PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe
    "C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe" --post-update
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6672
  - - C:\Windows\system32\cmd.exe
      /c "net start w32time"
      4⤵
      System Time Discovery
      Suspicious use of WriteProcessMemory
      PID:6080
    - - C:\Windows\system32\net.exe
        
        net start w32time
        5⤵
        System Time Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5680
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start w32time
        6⤵
        System Time Discovery
        
        PID:1892
  - - C:\Windows\system32\cmd.exe
      /c "w32tm /resync /force"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3192
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /resync /force
        5⤵
        
        PID:4752
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-features=MojoIpcz --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=6672.4188.12789606970151085318 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView /prefetch:4 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7ffb284d5fd8,0x7ffb284d5fe4,0x7ffb284d5ff0
        5⤵
        
        PID:5176
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1964 --field-trial-handle=1968,i,15678583561560632101,17368616350051429896,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:2 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:6980
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2420 --field-trial-handle=1968,i,15678583561560632101,17368616350051429896,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:3 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:5392
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2428 --field-trial-handle=1968,i,15678583561560632101,17368616350051429896,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /prefetch:8 /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55
        5⤵
        
        PID:4604
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --enable-gpu-memory-buffer-video-frames --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3304 --field-trial-handle=1968,i,15678583561560632101,17368616350051429896,262144 --enable-features=MojoIpcz --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version /pfhostedapp:049bc6ca6d70db0a1da381c75b0c054205ed2a55 /prefetch:1
        5⤵
        
        PID:2504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:6452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3380
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\you_found_it.bat"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:7136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c whoami /user /fo table /nh
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5700
      - C:\Windows\system32\whoami.exe
        
        whoami /user /fo table /nh
        6⤵
        
        PID:2576
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /f
        5⤵
        
        PID:3356
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache" /f
        5⤵
        
        PID:1552
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FortniteClient-Win64-Shipping_EAC_EOS.exe
        5⤵
        Kills process with taskkill
        
        PID:2336
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
        5⤵
        Kills process with taskkill
        
        PID:7092
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FortniteLauncher.exe
        5⤵
        Kills process with taskkill
        
        PID:1380
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im FortniteClient-Win64-Shipping.exe
        5⤵
        Kills process with taskkill
        
        PID:4640
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im EpicGamesLauncher.exe
        5⤵
        Kills process with taskkill
        
        PID:6624
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im UnrealCEFSubProcess.exe
        5⤵
        Kills process with taskkill
        
        PID:1868
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im EasyAntiCheat.exe
        5⤵
        Kills process with taskkill
        
        PID:4780
    - - C:\Windows\system32\sc.exe
        
        Sc stop EasyAntiCheat
        5⤵
        Launches sc.exe
        
        PID:7152
    - - C:\Windows\system32\sc.exe
        
        Sc stop FortniteClient-Win64-Shipping_EAC_EOS
        5⤵
        Launches sc.exe
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4608
    - - C:\Windows\system32\sc.exe
        
        Sc stop FortniteClient-Win64-Shipping_EAC
        5⤵
        Launches sc.exe
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:6440
    - - C:\Windows\system32\sc.exe
        
        Sc stop FortniteClient-Win64-Shipping_BE
        5⤵
        Launches sc.exe
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:6576
    - - C:\Windows\system32\sc.exe
        
        sc stop NvContainerLocalSystem
        5⤵
        Launches sc.exe
        
        PID:5972
    - - C:\Windows\system32\sc.exe
        
        sc stop NVDisplay.ContainerLocalSystem
        5⤵
        Launches sc.exe
        
        PID:4368
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im nvcontainer.exe
        5⤵
        Kills process with taskkill
        
        PID:5036
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im NVDisplay.Container.exe
        5⤵
        Kills process with taskkill
        
        PID:6976
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "NVIDIA Web Helper.exe"
        5⤵
        Kills process with taskkill
        
        PID:4828
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im "NVIDIA Share.exe"
        5⤵
        Kills process with taskkill
        
        PID:6240
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im nvsphelper64.exe
        5⤵
        Kills process with taskkill
        
        PID:6000
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im EpicWebHelper.exe
        5⤵
        Kills process with taskkill
        
        PID:5748
    - - C:\Windows\system32\reg.exe
        
        REG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /f
        5⤵
        
        PID:4152
    - - C:\Windows\system32\reg.exe
        
        REG DELETE "HKU\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Direct3D" /f
        5⤵
        
        PID:4968
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Blizzard Entertainment" /f
        5⤵
        
        PID:5104
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
        5⤵
        
        PID:4168
    - - C:\Windows\system32\cmd.exe
        
        cmd /C del /s /f /q "C:\Windows\INF\*.*"
        5⤵
        
        PID:3392
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Windows\temp"
        5⤵
        
        PID:4280
    - - C:\Windows\system32\cmd.exe
        
        cmd /C mkdir "C:\Windows\temp"
        5⤵
        Executes a command shell one-liner
        
        PID:6816
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Windows\Prefetch"
        5⤵
        
        PID:3304
    - - C:\Windows\system32\cmd.exe
        
        cmd /C mkdir "C:\Windows\Prefetch"
        5⤵
        Executes a command shell one-liner
        
        PID:6112
    - - C:\Windows\system32\cmd.exe
        
        cmd /C del /s /f /q "C:\Users\Admin\AppData\Local\IconCache.db"
        5⤵
        
        PID:2684
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache"
        5⤵
        
        PID:7088
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches"
        5⤵
        
        PID:7076
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\History"
        5⤵
        
        PID:6608
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache"
        5⤵
        
        PID:3336
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache"
        5⤵
        
        PID:4772
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache"
        5⤵
        
        PID:484
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content"
        5⤵
        
        PID:4832
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData"
        5⤵
        
        PID:2668
    - - C:\Windows\system32\cmd.exe
        
        cmd /C rmdir /s /q "C:\ProgramData\NVIDIA Corporation\Drs"
        5⤵
        
        PID:1288
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel" /f
        5⤵
        
        PID:1260
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /f
        5⤵
        
        PID:2952
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}\Count" /f
        5⤵
        
        PID:8
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}" /f
        5⤵
        
        PID:5688
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count" /f
        5⤵
        
        PID:6960
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}" /f
        5⤵
        
        PID:2508
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}\Count" /f
        5⤵
        
        PID:4740
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}" /f
        5⤵
        
        PID:2280
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /f
        5⤵
        
        PID:6648
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}" /f
        5⤵
        
        PID:3876
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}\Count" /f
        5⤵
        
        PID:1948
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CAA59E3C-4792-41A5-9909-6A6A8D32490E}" /f
        5⤵
        
        PID:7016
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}\Count" /f
        5⤵
        
        PID:1428
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{BCB48336-4DDD-48FF-BB0B-D3190DACB3E2}" /f
        5⤵
        
        PID:5796
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}\Count" /f
        5⤵
        
        PID:5684
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{B267E3AD-A825-4A09-82B9-EEC22AA3B847}" /f
        5⤵
        
        PID:4844
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}\Count" /f
        5⤵
        
        PID:6696
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{A3D53349-6E61-4557-8FC7-0028EDCEEBF6}" /f
        5⤵
        
        PID:940
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}\Count" /f
        5⤵
        
        PID:4336
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}" /f
        5⤵
        
        PID:5780
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
        5⤵
        
        PID:4472
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /f
        5⤵
        
        PID:2356
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /f
        5⤵
        
        PID:600
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /f
        5⤵
        
        PID:3416
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Epic Games\EOS" /f
        5⤵
        
        PID:1084
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
        5⤵
        
        PID:4720
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e5c55e3-79e4-4b12-bf22-96d9cc96266f}" /f
        5⤵
        
        PID:3360
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71699d39-459f-4b66-b56d-57388b4ef932}" /f
        5⤵
        
        PID:3108
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{f840bc35-59a8-4818-98dd-f637809d719e}" /f
        5⤵
        
        PID:5676
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{b4b931e9-956a-4dda-81a0-0852d33b94fc}" /f
        5⤵
        
        PID:5124
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9e5c55e3-79e4-4b12-bf22-96d9cc96266f}" /f
        5⤵
        
        PID:6592
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{8cf84386-1c42-49b0-b5d4-e3627b54df13}" /f
        5⤵
        
        PID:4156
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{71699d39-459f-4b66-b56d-57388b4ef932}" /f
        5⤵
        
        PID:6352
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" /f
        5⤵
        
        PID:1512
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC" /f
        5⤵
        
        PID:3516
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f
        5⤵
        
        PID:4436
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell\open\command" /f
        5⤵
        
        PID:4384
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell\open" /f
        5⤵
        
        PID:5828
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\shell" /f
        5⤵
        
        PID:5660
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher\DefaultIcon" /f
        5⤵
        
        PID:1268
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher" /f
        5⤵
        
        PID:1724
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\SYSTEM\ControlSet001\Services\ClipSVC\Parameters" /f
        5⤵
        
        PID:3396
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b4b931e9-956a-4dda-81a0-0852d33b94fc}" /f
        5⤵
        
        PID:6252
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{9e5c55e3-79e4-4b12-bf22-96d9cc96266f}" /f
        5⤵
        
        PID:5840
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{71699d39-459f-4b66-b56d-57388b4ef932}" /f
        5⤵
        
        PID:1804
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume" /f
        5⤵
        
        PID:4520
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket" /f
        5⤵
        
        PID:1800
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Users\Admin\Desktop" /v "loader.exe" /f
        5⤵
        
        PID:3856
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\20900" /v "rAQBc8Wsa1xVP" /f
        5⤵
        
        PID:632
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\469751801" /v "DNhm3" /f
        5⤵
        
        PID:4104
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\92978" /v "IDCdJOyapnxr" /f
        5⤵
        
        PID:4412
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Activision" /v "JBdT3hVOfoaM" /f
        5⤵
        
        PID:6284
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Activision\Call Of Duty" /v "ZYFYZ5B6kzMCk" /f
        5⤵
        
        PID:4340
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\appdatalow" /v "fRyilOYGxlSXP" /f
        5⤵
        
        PID:1924
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\appdatalow\software" /v "Rblsaqv" /f
        5⤵
        
        PID:4332
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Bytedance" /v "CmZFOv" /f
        5⤵
        
        PID:924
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Bytedance\CapCut" /v "ZpzRiKYpZgnSOK" /f
        5⤵
        
        PID:2820
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\CapCut" /v "g5Ayy61" /f
        5⤵
        
        PID:2464
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Caphyon" /v "9rklPGtfUR2I" /f
        5⤵
        
        PID:6116
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_CURRENT_USER\Software\Caphyon\Advanced Updater" /v "ciQTqVaAUnJv" /f
        5⤵
        
        PID:5136
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

LoaderNeon_new.exe

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\LoaderNeon_new.exe
Size 12.7MB
SHA256 19ad6d73050fb9f81a32334e16b8a550a249de6b1d4c73737450438d0600bba4
MD5 3b1c67e560488c797756d26ca2c7ffce
SHA1 c2f71c896acff57f09a002eb4efddb9c3428c9d5
SHA512 80c629c43d97f0aa9f785e87714e6abdc9666de62b46bb23022925f3f7edc49fb651687f8e1e1225abd72004a9eeade98dec245a70140dd43963488979450b26
SSDEEP 196608:S9LryfvyFPgUPTBcTXc4ye4tvohf/Ve0H54lh7njPV7:Yryfv+UcRoB9e0ZS
TLSH
T190D6BE1B975801F8C0BAD1789A478D53FA71388A433197EB3B9C49522FE3BE4B939711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.bat

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat
Size 2KB
SHA256 e4747dee863418a19bf6551f17fcf439f2a8ec0b4d1a673673c53f0ea000c8ac
MD5 b43b34ce1100dc144b16200e87b45be4
SHA1 4ee404943101bb177899d910b2c979a498e656d7
SHA512 ccdb5f4e9bc3b0fde85e3c8b285b7314ae4a17167943915c423478b1eef5b2ac01208e042fd6fb774baf52ee0d50d2153204febbd34e94e9efeb0b898b8d451d
TLSH
T1CC41BE06529BCFAB0455997B5BA6928CE4FE880F5F05B7033A64C80D678640FFECA7C4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mzynexti.fvi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mzynexti.fvi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

you_found_it.bat

Path C:\Users\Admin\AppData\Local\Temp\you_found_it.bat
Size 1.4MB
SHA256 0afefd2394302990c35c2962055d0ce7f818c7fba05baf4f31485c2a56bb1da4
MD5 fe6596a28b2228c21800331afd508975
SHA1 547046a9247270ad0a44c55800716cdacc022559
SHA512 e151e9b51d44bcd61615c886cab6d30d847975693c063a340ed6d3c6f84ea90aff456a83c3c1e87c53b6949fe6010def6dd084409722ba50b21a8fe5bcfe5423
SSDEEP 12288:PHVUOoHunYzyaDsMriEuopWumBMORmy4t7:vVUOoHunYzyaDsMriEuopWumBMOR67
TLSH
T1A3656500A2159272D4A321C8D3DF991D39BCD18736A03B9352E5AE4DDC8E83C557FEEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ef99ed7a201a4be689c0522a86a1867d598c79930cbf8d6e7c49554198ff14e4
MD5 bebe96506d009d425b95ba2abd1ba0ca
SHA1 d28fdf4b00d7e361e9211de4629000e276af282d
SHA512 d8cd402e6899ebf3b589fea6de8489f2c503dfddce7276f14fd0422d8fd523e17514eedbed184cd53c7898acb8410fd82f11e372c8e1bf20166b0f0bfcfe8dbd
TLSH
T1E7D0121272524134C01035731002619F1840C74B901982045A68C61D9B444500D13451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5a870e7342bdc481da2529e32b5dfed7e3e710719b750b34e176280a10429366
MD5 8bf61459c3363cf34de80b55fd10bac8
SHA1 096a15537ee64d96fb21f99c3357fdc3b52bb8fa
SHA512 1cda23bf134c28a99be07658762961a47de4bc512bb4bbf85a4ba66de34ea9dd1c2b6f4ca16dcacc73d63df95513caf5cb6d0ad2a181ae167446fe593f616b53
TLSH
T1F8D00450D1554000D1403571101441F71550CFC07035430407D0C104C7C04004C53014
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State
Size 2KB
SHA256 66f267a0db6f0033312ff6101422696fafb55f729f3406e4a8b64728fa6f68f1
MD5 f84fe926fa7df5a88551404718dd47cb
SHA1 a8dc0bc3d74042f503aadf25c3bb427923b07a4f
SHA512 2e4067f2d7a69fa7563bdfe121255c1edd2c37f19df18b4cee4e78cf8f0c49be4246834cf513ccaee0decafd6bda0775213eaf94d2cd6bc706d8d8bc6c1affb8
TLSH
T10E51777369249A37C9E3A6057A8B2F13EF395161AA511F14EADD4B0801C75AD134683B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State
Size 3KB
SHA256 b8db395f01bb5699bc3b413587fd6fafd55fd1e6987082532ffc094c25a9005a
MD5 790d2a75f63a2a77b4dbd78cf0691c0d
SHA1 1df13f4d325a2f67e9370a6509acc9794b7c2b6d
SHA512 6b3b7c15356da79a1318cd95f704bd1178408f81d18579cd9e5be9abe32685beb2b7b5b31b6fc7733c9a1f0f734bd5462b60dc0c757984cfe87f33b666d07c71
TLSH
T11E6163376974E9378EF3EA05B9862B16BB655123E5913F59DAEC0E0C01D72DC134281B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State
Size 15KB
SHA256 718605f60ab826c1688c21b015c12cdfb378b58be51a2642e250ef77ca35234e
MD5 12d2c531bf25a9a2f157af06c81c679b
SHA1 7a8d8c2095e52f76f3fb8c793e7bcf9bdf394fec
SHA512 d72c4af0fc831005c00978728fbfbcbabb405dc50e02e3979dc73d08e82319bff590a12ab3eecc52d65900acd3931dc916d8a963ec93fad97c7462c6b9bae049
SSDEEP 384:Z+aQikB+z/xvxjg/qhEb3NBSsRbwpAHXAVdpg79z8:E/UxvxjgC+bhRbKeXUiF8
TLSH
T18F72AE2B55797D33E5F3FA057A5D4B8BDBB8447251C12EA88EBD9F0D02C72E80302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59ac92.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\Overlays\EBWebView\Local State~RFe59ac92.TMP
Size 1KB
SHA256 8b65b11347010f0223c724851af4985342ff0ae02156025edadc7c359e59921e
MD5 d7f1ba34fd1ad59822299b0d542f0a84
SHA1 3994d39f47c0ec8ff226be334f34ba2772d32e72
SHA512 333ad0435e87f09c825554cc5c60fa65f18f04ed7bf724501796d10d62883d7135d65423d3cf2a365df5e1ac113b1c43b0799c0639d877a4926270e8e7e83289
TLSH
T1572170B3A4649B33DDD2B24673966E47BF30106282104F08B2CD8B0C02D71EDD62E932
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 84ea809bafd5c311b642c7dfdd3772625f9a8735e798b479cf7c8b0abde67744
MD5 f9feb1fd0afb64460dceff8c63f8b8c8
SHA1 47a8af9366950e9e1a71f0f64fb8b47a55db63fa
SHA512 409118602dea9bffe79b01eaf9c684bb6050d4bf8f888a54052fb4f01beefbe2e24db1104fc65ec566b2287c11c507eee0fc307cf0eb209a870e11305d45fe3e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e4b643083201d2b5e80f40abd24ef0070d53ce9faea0811117e42e85cf5e16c9
MD5 f92d861c6359387a38b29ce5f7a58b29
SHA1 72271271a1f13bfe02193c59d1300b5b26c982e9
SHA512 7fd00e7194f029b1b47b429c46495cdb4cdef149ee5cd899426f19d66f7662f3de8948db075cf6ac8a9b724773e63a3a99f6ed24328fd83b37d166046e6a53c6
TLSH
T160D01212B34605B5C4202033000375090D01C11F814B41445429D59E1A840501D02441
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 926ea68797c5d2f2ecfbf10dd93896576571a2c54a1aeddd469cbdfa0b344f20
MD5 7be8a006c2752a8992769c88221cc0e0
SHA1 bda5613d0ad5a471da96c2b4b6eb41d6f1d7d08c
SHA512 ec9be2b647300ddf31906238b94b120ef18586de2210385140eb61da1ab38e5007a3ec05597a4ed6939573be122438532d7ee6353a5c3711b9a7f14f699e42b0
TLSH
T1D621CE85AB1D1879DF20EC3F1BCB481573B5ED5815472E054DE90834806DF514A17E2E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a29c1.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a29c1.TMP
Size 48B
SHA256 c58782b0a35a552fa03cc217dff9ab1f15dc07dc22d9741d59dc56560aa45ae8
MD5 c0fb2c52cfc6242e2d441261679b6162
SHA1 a11474f4515d28fbf2712f60274e423bce6b81a4
SHA512 19844fcd0fc4e16b81689a03f430c1da44ea69a26c554c41c37eaabb66bea222d5e5a0e411d6d79e5ad47feb1c0a13a3eb8482ba88a53c8b3dce730cad24052e
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 59c7390abc853f701865569489ff6f79d9eb0ee9c5d357d34b381220a7023cd8
MD5 9baeff565ea1678dbc3ad6cf0dccb5d1
SHA1 b8afa8a81295d436838beff950db9b7cbf2261ff
SHA512 71941ae2e26fca67c8dc7228f62dee53a69e5813a75b789fa9aeebd9bb389a55d124bc969ec5fa7f6d446750f05514f8399d446ade84e5bc7a865be0b51fa3ca
TLSH
T144F05073C07BE47B50FC4C7E1C44FD816D76E432464168F5CB92456DA0604F75603417
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 a0d1778f9bef8ab277f54e27280d5f97742fd3d0ffdad3a0d0e49e67e7f72b8c
MD5 7c3a85baff54b2c08f61fb7e6e438a69
SHA1 9e62da8fc5dcf9a078885c5c285a08124a1def9a
SHA512 1d27aa14853928bbad6048e1adbb00697280cfc7a59b4c52e9c8f8a344475985bb69cfdd4f0bd9f461e132da3e80caba500aa30df7ed92bd3ed4d659865da6de
TLSH
T18BF05966C57BE47B40FC49BF0D44BD816EB7E436598164EACBA2912EA0605F72A03413
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 da959c84f331cb161f5555bfe3e650034fb2e2a49804a87c07c77f1b16b53f28
MD5 ef34648d2ec51df477b4686b8e15dba1
SHA1 9bd1a2edf7b93d8d493c686414b4c25fb50ca110
SHA512 c159399d3435c45fe30f0660cc089f9a26a5ea89d40721b0bf8cf62cec5f151a4463ff07e88c7dbab3ad792ddf80302fd219dc3f64e16af823bd899ac87b5e8b
TLSH
T11BF05976C07BE4BB50FC4EBE0C44BD826EB6E031068164FACFA2816EA0604FB2603413
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 ed5db175b365ffb1ffa89d026e24b0e1a89520814dad0a0666c6a9c93e9cb62b
MD5 7e2617df58230640afbb61d4cda6e84b
SHA1 1ff2463eda2b3b4cc87495a2cd7b2b6dc10cd5f0
SHA512 40bc70a37198a4b43ef7997c1f49312893ed8da1f140074458d255b178c813b1ae6264f9b477e7ee7c1732e2c19dc5524d2f07a90c4ea4237022ee889fda8d01
TLSH
T121F02476C17BE47B00FC4CBE0D54BD816D76A031464164FACBA2916EE0605FB2A02423
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a2973.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a2973.TMP
Size 522B
SHA256 1cf7dc04e5f60e9698565116965f67d1f7d8367a6174d24f54b8547d03849640
MD5 c3c9834e5d7a45200b7e5e8545028471
SHA1 ad5f38bcb9a1d6abc4d7f56c90317529583f293e
SHA512 d36f14350604e938516654f36d1c0320587e6de09367c35ef7fb01165811629e4ad05b48d6deb2c67de7333f7055d23f6c1e9dcead4938c750db0ccdc9acc3e4
TLSH
T14CF05966857BE47B00FC48BF0D54BD816EB6E437498164EACFB2912EA0A06F72707413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 b00555c67f3e7f47059870a11a267dcf14353fd185dc8664140bfc61c48e96d9
MD5 e556ca9c5227573ccad96207a5ac76d5
SHA1 10d2a1dd2849b7651abbba05b4417d107734091a
SHA512 dfd729ca20f1183813b57c79ffb7084a741621b8ef68a6e58c07400cb8d88745dfac45e8faa029ace25064c266a68ffaf430235cb044d442e63986132f968349
SSDEEP 96:rk7/dEHGnNb9JYkSdo616Zqus7/x+6MhmuecnTIKj0Blje/K+gDek28XM1C7K:rEOwY5oMusV+FT8K4Blj5ckG6K
TLSH
T14BD197025B34A97B8CCAF119FA25BB17E2F9603161D51E58EBF8452C04EB6DD631780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 ec61fd8363de4e3054dc1577a2f14d7e58b7be1d028e3eb170fd89cf1990ef58
MD5 ca4fc219af45ffae7a45446323819f3f
SHA1 99dc22b929ffe3bb7ac4ea845f9839d6d6557547
SHA512 8a82de2f78ab6d33847b5676a67b795d0a0764117fb89d4b8600844d295a9cb6a623e8c14c2d2d3977ec49e04622ea7bd8cd9fba59f2aa8ec346c06dad663068
SSDEEP 96:rk7/dEHGnNb9JYkSdo5h16Zqus7/x+6MhmuecnR/MFNBlje/K+gek28XM1C7K:rEOwY5onusV+FTR/2Blj5skG6K
TLSH
T131D1B8025B38B87B8CCAF119FA25BB12E2F9606261D51E48EBF8452C04DB6DD631780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 3f4963782e55e59b0934387e83a111e8584c1b2c5c949874ef2a1e3821cb8645
MD5 0a9621d3dbea6088ded6ec0f01d153a5
SHA1 dcf134e49750c8ec0332f1f81770a91123ab8f6d
SHA512 c4f630bea35cced5438952218f88f59b12f801f1431ea42b9aa426602b9a3211ee66b404112ceacefd72010963e29d2ec88df7f953d5ee9e03179381b41aa709
SSDEEP 96:stk7/dEHGnNb9JYkoo5h16Zqus7/x+6MhmuecndTMHnBlje/K+gyk28XM1C7K:stEOwYHonusV+FTdTqBlj58kG6K
TLSH
T176D187025E34B97B8CCAF119FA25BB16E2F9503261D51E54EBF8462C04EB6DD631780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a2d5b.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Preferences~RFe5a2d5b.TMP
Size 6KB
SHA256 269283f8822cc464dfb83a245acd67422d296ceb4e6346b246d3eaa99c66c9d8
MD5 020ef7074e699b313366ab95ed90a755
SHA1 0ba7b45f4e94e9d6760cac5aef66e26e8891e111
SHA512 45863b6a453ac09b52cf864c9b3716c4aee154fdd15025770b3b3c3a00716e93ba86787741c9e202b2e42b52010dc6711db5ae580268725b9f2356ca6adafc90
SSDEEP 96:rk7/dKHGnNb9JYkSdo616Zqus7/x+6MhmuecnEy1eBlje/K+gqk28XM1C7K:rEgwY5oMusV+FTEyQBlj5UkG6K
TLSH
T185D1A6025B38A97B8CCAF119FA25BB16E2F9503261D51E58EBF8452C04DB6DDA31780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11a05ff6c0f3e47b_0

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\24731cd1-b22a-4c7a-9de5-190bb187245d\11a05ff6c0f3e47b_0
Size 22KB
SHA256 b27377bd7e83a3ee9022de21c1612887635ae94fb970412873304f500fc887ea
MD5 6d4a393e63a166b042c7a09aac3e5ca1
SHA1 334facdd540af2e6261c3f7d4013707ded4fe49e
SHA512 bdc1a367b05dd771b655ef361d4a6e75dd884f5b826130d93e310edaa419cb1678cce44b9807bbd1ce92e87fb383bc14b516571da3245b901cc5197d633847f1
SSDEEP 384:pnx2CAFnTlfFr46OEpSfMfmOaYe0Hv/PJlGkx36HhsFkhsKgFUp06c:pxQsKeGm8HvplGk24KgFUq6c
TLSH
T1D1A2F052363EB914533B32451A4BEB6CE8D2BAC63412F4649F27CB46AB604D4A4EBD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a2c21168936296d_0

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\24731cd1-b22a-4c7a-9de5-190bb187245d\3a2c21168936296d_0
Size 68KB
SHA256 59b934a32317b886390ed87d0c2e108ddc2b138a5dc044ba453fb60c25dc8b4f
MD5 ba29e030fa7d2095131fbed2f8242987
SHA1 2133a2960fe467dce62c654c2f8a738fafb2ee84
SHA512 c95c08e2c705fa18a3b46c9d0063618cf5bf62045a841e994002693506482261f2547bbc3a920338259e7e7fcb4242a2b7f88e4420b51aecdd04a5795241ef80
SSDEEP 1536:c4poSgfaSxXHiiyjHzzTqG9acFJSIJev0T8b2Yew3D/U77swx:cfSxSxXCZzKcFJSp0TBYe4/+Qa
TLSH
T16163023AFAB68343C6DAECB51B6D474CD3E17472B7F3E4EA4980677F5418081C985A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a052cbedb5479d4_0

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\24731cd1-b22a-4c7a-9de5-190bb187245d\6a052cbedb5479d4_0
Size 494KB
SHA256 06460a03293e656b48af20a19e9883ac6d1be38ec59be1b70b706902c7959841
MD5 2c7b912f8b1aed0bf21853976ef0fc4b
SHA1 676de131b5e11722f2260adf470ac5a4c203815c
SHA512 71498f383d15f9fc33d152d2a9111032b2568ccfc31ad766a1670664ea536c8d49e4c2e14a55ab8e4049f9bcb03e8f6f16b7d22dbee15836781dc31b9eb07cfe
SSDEEP 6144:pdyqMtOOWqtMrge6GegI+Bs+uxSesdopyunS+49WTY5J9e3Dlz8RTv4xX7AJ2/3k:PyFtjXlJ+uwesbu8DehQACJEnj6
TLSH
T1C5B423C6B861EE09CC69A93A96FB3FA52338D94713840BF796F0B20D5701D5C945CE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88086aa1742a222d_0

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\24731cd1-b22a-4c7a-9de5-190bb187245d\88086aa1742a222d_0
Size 1.4MB
SHA256 b79e64a0f4c8856749610ac415d2b70d7ca794bb85813a647dd9d0d54c1626f4
MD5 8351d8137db15e6b6f58ec849c6fbe12
SHA1 f579b65455988c36ad58c386d2962e520dfe29b4
SHA512 c3c1cee88e1c2bad70f92543779c53a1edb08ebb6844cb043264a96e8c6fd095d0ca8bc712a82749910fc96a278becabb0721562a28e082fa907e0f647f29f66
SSDEEP 24576:tCz8njuip8O37+773yiTBO/80XB8u8/StpZnxF/pG1KMSY5cQzYvWjqobYd:tIwp8F7rTt0XejStp1D/o1rSY5HMyqAw
TLSH
T1D86533C97205B44808D7A93329532977ADAF93F66FDA2F0C2235BBC59B2608234C705F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f29785da697f066c_0

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\24731cd1-b22a-4c7a-9de5-190bb187245d\f29785da697f066c_0
Size 267KB
SHA256 c1ba758499eb01532e81b4ceb4bbc3c96c070643d84f0946cf670d15bb5d4753
MD5 09da6c3137d9d6c16ffc8a3e6531a54d
SHA1 bcb24fcfc55f3b5e54ee1239353affcec077e3cc
SHA512 50b73953ea3e6698a69106150d79a1a20fb8ed965ad3960719fecb22f0ba7177377ed89a8d9fa7b348baef0dc05074a61b5b64015cf12867c2967f00c58be665
SSDEEP 6144:OUrOu81F4vhVBlOyIoGJ+II5Hl6NvcdgjLkfqqRLuTkryhLbFdr6q:rrOuGFatvWcejLbQikMR
TLSH
T15D442314C7DEAB15C2249E9867E107CC6111E8FEB0F36F3E7A17BC71BB2540E69945A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8183872858f8272_0

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\24731cd1-b22a-4c7a-9de5-190bb187245d\f8183872858f8272_0
Size 195KB
SHA256 acfc90ca866ab338a54a736bc09f57ed91f333bf52d4bca0f38b3534575fc189
MD5 f581168b6246d40fdefe9a4f480a64db
SHA1 b2123d986a3146d4e92b0409e2570a764f111227
SHA512 606677137f130353371f7be546ac5b9fcc3fe8bef6acc2f6eae4a0e35ea15474c4bc05397604af15a9736815f9cbb11bd480b40a5ee5ed7a0a9874ee0fbf7fbd
SSDEEP 6144:elLSRIrrVbdCWx+nCNq6lpgLaidnEs6FyiB:elS+Nb+nCpgLJnEpFyK
TLSH
T1741423AC8C295353E9A7477F5B42B2C0ABA3123133921AB868B043DB286DCC277DD559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\24731cd1-b22a-4c7a-9de5-190bb187245d\index-dir\the-real-index
Size 336B
SHA256 7fe5c9af9842127e2f66e9184f4147dad3a952f5753780caa28d17e92fcf4c4a
MD5 389f368dec396272de32eaf28677266c
SHA1 0545d868b943f529aca906b99130e6a0d942689d
SHA512 200d47d077d917bead0bdc3cc6c9dccb15b2139998d76fc485d62b5cc3134db5de7b7631cadca7ec4110a56419ee3aa4f6295a581be20eb4a1824626e7c52973
TLSH
T120E09712E0C87085EC8482B480A2161A736AC910413DAFF381B479BDBE2344DEE82A1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8733.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\24731cd1-b22a-4c7a-9de5-190bb187245d\index-dir\the-real-index~RFe5a8733.TMP
Size 48B
SHA256 41e0c6e315ecb53c92ac03c16e512db4a0ff1ce4a8aa7be48c97e8b5b2f69f94
MD5 4a7132c162f0a3043bb79a2837b9238b
SHA1 80e3a16c7e547d0cfd6ec7904ebff293398b7121
SHA512 2190bcd3c06245d1b9a3566097211f079fa075f7c8db433ba933e65516d2222d2be1a71fcd919c9a4201640a3f1c19ad1d0238582446b81360e9ad9a9c21ff18
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\index.txt
Size 136B
SHA256 55d0b6de695aad3ecbbd256757388b6ada5d8817d2e00206c908d82d18f55742
MD5 9c8423fb78df43a2f85975f452b32908
SHA1 5b774b6bb6062ebe32bad220fb356b0fc9b300f2
SHA512 eaf55a60f312475036d107c8b49ec7fd02d2d49459d98027cbd64e6c1991e889114fe7d5848aada7fc51fcab5b276259ea1905f6d11efa4cf82ebada6b954b46
TLSH
T13EC04C524542E42C56A16B9EC2856F458156B719CBC17D0EA119615EC1ED53186A4900
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a8771.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Default\Service Worker\CacheStorage\56c953ad452559f7590f459b50eba4b0ef372ca8\index.txt~RFe5a8771.TMP
Size 140B
SHA256 df59abed09d307a9c334d074987e395236f9002903e5eccc5979f91dce4737e6
MD5 066dab7bac640e9f2d6215bd66936831
SHA1 de5a45d194e8690f1b4cb13ae3361b00d8ac8766
SHA512 e0da0066f88c4157c7f1e16b678251856bcf8ce22f8d27b2700ad89611b62dc288c95924f4e0aa28df0cd3f44702858c1a4e5304f7d9bb6bd0b4fa88c071a769
TLSH
T173C04C964542A42867A56B8EC295AE05814ABF19CB816D0DA01A718DD1FC532C6A0A10
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 3KB
SHA256 e142304d18e25c51cdc0f26d7e277276f59a3678c91b556d48c9c3642e9d9cb8
MD5 9be394533a2701e7da9af64172811689
SHA1 5aa3fdf3b1b6dabb575dc8eeb66a781c637a1370
SHA512 31a26a5d457a179d153a913c8bfc6dc4e99e7b26f171b4b651e5d62019ed68419255048bd0aff83751c535efe6fbd40b732c2e643b2dccdf58efa81c5811a623
TLSH
T1A4718526A574AA378EF2D605BD863B03B7A55067E6913F98CAEC0F0C01D72CD5342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 2KB
SHA256 a8f090e09f2b8ec34d64f561cd7d9d347e7905662e385013a7a47e040e8a394c
MD5 f51e59f1c38b31054ff334cfb7481b35
SHA1 aa578758f373c02c1bd0b9b6ab9390d691b52669
SHA512 be9e837a6d6d82df847066cb688317fd28a482b73ab742b1f1f736b253813aca9aff0f8321434e644019ec938353dd5d29747ee2bd85c60d536f724ab7aa6044
TLSH
T1F05177736924A733CEE25749B9473A139E299066A7522F409BDD4B1C01D719D6302C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 15KB
SHA256 e656d9e17a7a3e3c31b8786229b8c35b21dc4f679e89e83ae2a767dd44dfdc21
MD5 89834204eaa65f73bd4606332c588088
SHA1 d3dcef816b5c74dd0a81699dd134711ff6674c82
SHA512 0fa5868956bbab485915a9807efb3a32ce35348662b44e00e2c478150b33c5d39b6dddf599fb3c399554fa637ee85c9d4b53106ad4ac00623fa95160b7db1a85
SSDEEP 384:t+aQikB+z/xvxjg/qhEwNBSIwC6dYAVdpK9zVK:4/UxvxjgC+G4YUKFVK
TLSH
T135729E2795797E33DAF3F6057D491B8BDBB984B291816EA44EBD9F0902C72D81302C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State
Size 3KB
SHA256 f6801365fa3d4f8878f33dd03bcdbc73e15ce2c20bf7697ea9a50f4f625d9ad6
MD5 4136586284939cf1a18bb06c59967b5b
SHA1 f0c082cb8cb937417bc93953748cb92e8c9f74ed
SHA512 1a99809b380e0ac0477ef786b984af8e9072557db3ede41d5160a4321539fda6b5b7917fcf1d12aff541c43a62eae774fe569eeac5383393869044465c586170
TLSH
T15261A7776974E6378EE29A05B9863B16B7695027E6913F94CAEC0F1C01D72C95302C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59cf9b.TMP

Path C:\Users\Admin\AppData\Roaming\1711956076\WebView2\EBWebView\Local State~RFe59cf9b.TMP
Size 1KB
SHA256 116303f7e78e22ebb30d15b68d6f7d5b33d944021c7d5efb2de00fa7d8accbc9
MD5 3c83fd7555f13b2de968f2b71369db5d
SHA1 1fcd1e4865304e452aaf347419124fd30feadb18
SHA512 60bdec815edc2f52531c81f602ac555ec481faae613ca4042fb5002893bbcb17fbc6e9da6f3892693fc762161dad1205ca0e31afc56d60b65095fb549a0817ac
TLSH
T1CA2198F3D060A733EDD16246224265172F15506B43104F0096DD871D02A70DDEB17D3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-104-0x00007FFB4A520000-0x00007FFB4A521000-memory.dmp

Download

memory/2780-572-0x0000010439740000-0x00000104397F2000-memory.dmp

Download

memory/2780-571-0x0000010439460000-0x000001043947E000-memory.dmp

Download

memory/2780-576-0x00000104394B0000-0x00000104394DA000-memory.dmp

Download

memory/2780-577-0x00000104394B0000-0x00000104394D4000-memory.dmp

Download

memory/2780-573-0x0000010421230000-0x000001042123A000-memory.dmp

Download

memory/3380-28-0x00007FFB4A520000-0x00007FFB4A521000-memory.dmp

Download

memory/4960-0-0x00007FF74E5E0000-0x00007FF74EF16000-memory.dmp

Download

memory/6452-566-0x000001A5A2AF0000-0x000001A5A2B12000-memory.dmp

Download

memory/6672-291-0x00007FF651530000-0x00007FF6521F3000-memory.dmp

Download