236d81e49361b1f78f96fedbb6a3c36e11988da1932b6ec1486f15b13846f6c8

Analysis

user interaction
yes
max time kernel
22s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BrutoForce Seed.exe
Size 5.9MB
Sample260827-ar7bcawvbw
SHA256 236d81e49361b1f78f96fedbb6a3c36e11988da1932b6ec1486f15b13846f6c8
MD5 b3868c088380ef51c98159f890c24682
SHA1 0526ddbce09a2c2e89b4e61f6be35a0890859393
SHA512 20a47aa7735cb29ef0c35bddc89dad8a32ace975a65ed9ca9320862d325d2ed1b60717db880700c89f3665f6ee0f15fa59c8e7a3a0df8a82a40b3b4c2556927a
SSDEEP 49152:e9QDZUyJ9u3/allkIO2L8W30Uzo3aNlMGZNC6tarGfn2YxJhC3q+gHdehhg+gzFZ:eSQWYQlk68HKoWVF7AmgDu
TLSH
T143562A117B4A99ACC06AC470824687725A317CCB1B35AAFF41D4B9753FBAAF01F39358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BrutoForce Seed.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322640827061043"	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1804	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4600	BrutoForce Seed.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1804	4600	BrutoForce Seed.exe	86
PID 1804 wrote to memory of 1536	1804	msedgewebview2.exe	87
PID 1804 wrote to memory of 1792	1804	msedgewebview2.exe	88
PID 1804 wrote to memory of 1792	1804	msedgewebview2.exe	88
PID 1804 wrote to memory of 1792	1804	msedgewebview2.exe	88
PID 1804 wrote to memory of 1288	1804	msedgewebview2.exe	89
PID 1804 wrote to memory of 4796	1804	msedgewebview2.exe	90
PID 1804 wrote to memory of 4796	1804	msedgewebview2.exe	90
PID 1804 wrote to memory of 4612	1804	msedgewebview2.exe	91
PID 1804 wrote to memory of 4612	1804	msedgewebview2.exe	91
PID 1804 wrote to memory of 4612	1804	msedgewebview2.exe	91

C:\Users\Admin\AppData\Local\Temp\BrutoForce Seed.exe
"C:\Users\Admin\AppData\Local\Temp\BrutoForce Seed.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="BrutoForce Seed.exe" --webview-exe-version=4.0.2 --user-data-dir="C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4600.2272.14224211417943535809
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffd5151b078,0x7ffd5151b084,0x7ffd5151b090
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView" --webview-exe-name="BrutoForce Seed.exe" --webview-exe-version=4.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,16062810567138764110,14972031323453454035,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView" --webview-exe-name="BrutoForce Seed.exe" --webview-exe-version=4.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,16062810567138764110,14972031323453454035,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView" --webview-exe-name="BrutoForce Seed.exe" --webview-exe-version=4.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,16062810567138764110,14972031323453454035,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView" --webview-exe-name="BrutoForce Seed.exe" --webview-exe-version=4.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,16062810567138764110,14972031323453454035,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dd83dca0302a73c8ab4f54f71c80138bd7af738e050651dcb04210c9e11f64d3
MD5 8ba4becb69783986ada357b374e1a818
SHA1 50aaed89aff84adcd7ae224019fdf0c18e227c59
SHA512 c6c4dd4fd49dba35a89762c0de0f86ff9f87548421de09c6e809fb25da6d6d7add82c72d557e5dd619b44f2dfd860d83a192201f0e5f04deff7a27623b4bdfa0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 62ebd848946dac45693ab7d4ffcb2f8bead9b78a25f3906e0d5964ba00964c68
MD5 5f0f8a9c0a1b108fe2b8b8a2beae2613
SHA1 f7e063aa549e9ce750c964788a58d140d90febcc
SHA512 27cb8282fe9d600476c8c9bf19c54a4d63b6829088d4188c2bc585a9cbe238053f8b9745788cbe9608b99deeaafdb4b09ec99eaec7f5183f296a3e6b69b9a6c2
TLSH
T1CFD0122B36010A34C0203173141661080D02D22B424D844194299AED1A084502A03481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c0041cc2223e8cc15613ca011a0d3fa01d8948c60277b6af45a96ed055bb2686
MD5 7d5fe16e9f7dda17bc3245553700e983
SHA1 cbf140dce04fbfa511185e1d2bd7b813c0dea0e8
SHA512 2a4f88979a65342914dfdf1c6000b645dba37ef4e66b75f0dcfd5f33d71d239cff73b7cc308bc7f3128c214b43950f3027e96ab6ed7db52b06915a9c11d3e0c9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 595896cea51547c30e08cc8d72ce111633df2f27b7c01820302be0e0aa624751
MD5 a1d503c886648606b5345bf7d8e18f54
SHA1 3296b122910520e5f883df32622e10d7ea853cda
SHA512 fe7297c60d74822de3ada657557e8cdd2e3dcedb1e55ac1d57dbae01a1fa380d625fd034e3ed7e540c19fad02b8539439de3691a7488949995886a58385907e5
TLSH
T102A002181575497FD9205FB590D903413732A9A012130E0242D29564D8E4381D21A400
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Local State
Size 1KB
SHA256 a72643722eb4c0c1daf8799f13726c0c1ddf2bd02c1f1abd040db4617c00656a
MD5 ed439aa836aac12adce106fe69ffea90
SHA1 1d22d41910ba02544a28c3956ab32cf6119d58c4
SHA512 b1611eb46c1c487f8eb64b72a5eb1e84bfaa9ad4769798fb8f02d0780a39964e2212773b846a762830bb8c9a10e41d65860071404d9e13b4d563d2310a433a24
TLSH
T1B6318573E4E07F73BCA29544F54EFA876E315025C1614E48A2EE4B1816D65ECA12FD23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Local State
Size 2KB
SHA256 92097bb3230a3f46384f5e33e873766e0bff1163525fe0a9435ccc17bb80a62e
MD5 a5645a2d42db9d71e0615f3bd705f177
SHA1 b7fbb6a636625a73615082d7a1c42884903dc232
SHA512 7bad01afe9cf9edf49b796fc2c20718047b2b00f08fc5ab6eb721b02497a1b897e6e989e35b749bedbe4ab8ac2d0ef6f1c16b7a09b128144c771c4c2760ed328
TLSH
T1E451B473B854BF77A9F39A44FC4EBB43EA35502196611F5096ED0B1C01D669C230BC27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Local State
Size 3KB
SHA256 b158555fb2863017ad3e1041a8afb4a6c6e24053546e9f7bb41dad8d94256ec1
MD5 3f4b0ff6b941c602220334f38dc3a997
SHA1 e26631924e3a8e694545c127e6b091798dadf177
SHA512 72ea60b4cdb9d3cf98359db0b8d296284972f62b1fbebf846cdb1bb4c2d4d0c76ddfada095c6a14b1fa115812575d37771d868af3c6c26b3a11a0ee3925c827b
TLSH
T1B271A677A8A4BA279DF39940F8897B07B6A55123D5912FA8D6ED0F0C01D73D82306C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Local State
Size 16KB
SHA256 377b479f544934a9d57bbc93ac8a781ee45c3a750b50b8033c16db4ce6918e11
MD5 6cda1ec7e4b1c5fa5aeeb1d18229d4cc
SHA1 81f439d39e7be003c0d454bd5861c98fcf3caa1d
SHA512 b2082fb6d4e9e3226889a121257a9b75ec43a77f50ac40168f61df45e3bc25d68d36f650b0243d37806e26a5bddbf17c9246a4cefd285d92130631b2ab374270
SSDEEP 384:zr+aQikB+z/xvxjg/qhEPNb4/vnFfbHwlpD2UR9z2:u/UxvxjgC+k8lpD2URF2
TLSH
T1DA728D3B64787E23A9F3F914BA4D1B4BDAB5946290812FB84AFE5F0D06C73D81306902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58056a.TMP

Path C:\Users\Admin\AppData\Local\com.cryptohunter.dev\EBWebView\Local State~RFe58056a.TMP
Size 1KB
SHA256 5dc9d10ac3585645cde5ab8b40528b1d5b76d38c72fee336a77d9515beafdee5
MD5 c07adcbbb428a99534c298b90b86e6eb
SHA1 69bebc4d2c9e0a582e034f9b3e9c82a47611c49e
SHA512 2cedda1cb576a7d69ab2db7f89116235b05dcbf252872e2b724a3723a990de7eb95379c74d4a03b2dd0341869fbdb8a2e8b4a491ae4c2331a25d813343b087cc
TLSH
T142216573E4A47F73B8A15850F54AF6CB2D61502581204E0CA2DE471916D65ECD23FC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1792-25-0x00007FFD6BEC0000-0x00007FFD6BEC1000-memory.dmp

Download

memory/4612-138-0x00007FFD6BEC0000-0x00007FFD6BEC1000-memory.dmp

Download

memory/4796-75-0x00007FFD6D600000-0x00007FFD6D601000-memory.dmp

Download

memory/4796-76-0x00007FFD6D6D0000-0x00007FFD6D6D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads