c80bd45ff8b68ac28f62f67a01bbc12dfc61da50746a0adf3d02c06a86da33f7

Resubmissions

24/10/2026, 22:35

261024-2hvdzacx8z8

24/10/2026, 22:30

261024-2e69csxvbz8

Analysis

user interaction
yes
max time kernel
35s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Torix Tools.exe
Size 9.2MB
Sample261024-2e69csxvbz
SHA256 c80bd45ff8b68ac28f62f67a01bbc12dfc61da50746a0adf3d02c06a86da33f7
MD5 8b6fadb0f35ad69fce7cd1253c082ac0
SHA1 075868b53486acc08d61820a5654f9f177a0eb39
SHA512 a592c08f007f3c32e56389a3a93d7929a71e78a80cc057f963065166b7c6096b7ed20c70f73913fdd7124c285cfd3b8087519915bc25364f61e9a043b860ec70
SSDEEP 98304:pBKd/8lvpWHyy4hU4oJarM0/IWb7SJqshzKa18VoDLS51DQbD8q8eIb:pEV8lvpoypO4A0IA7DsHCCDSEng
TLSH
T113A6AD1BA66901F4D0A6D138DA838C13F671748A473197EB3B9C46161FE7BE0BE39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2216	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Torix Tools.exe

Executes dropped EXE 1 IoCs

pid	Process
3064	Torix Tools.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Torix Tools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Torix Tools.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Torix Tools.exe
File opened (read-only)	\??\F:	Torix Tools.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Torix Tools.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2168	tasklist.exe
416	tasklist.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 16 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive12	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive14	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive15	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive5	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive6	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive1	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive2	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive4	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive8	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive10	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive0	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive3	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive9	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive13	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive7	Torix Tools.exe
File opened (read-only)	\??\PhysicalDrive11	Torix Tools.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1192	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Torix Tools.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Torix Tools.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Torix Tools.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Torix Tools.exe

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3984	net1.exe
4892	cmd.exe
2292	net1.exe
3172	net.exe
3400	cmd.exe
1280	net.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2420	timeout.exe
2176	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4320	Torix Tools.exe
4320	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
2216	powershell.exe
2216	powershell.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
2216	powershell.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe
3064	Torix Tools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
876	msedgewebview2.exe
3748	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	tasklist.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeIncreaseQuotaPrivilege	2216	powershell.exe
Token: SeSecurityPrivilege	2216	powershell.exe
Token: SeTakeOwnershipPrivilege	2216	powershell.exe
Token: SeLoadDriverPrivilege	2216	powershell.exe
Token: SeSystemProfilePrivilege	2216	powershell.exe
Token: SeSystemtimePrivilege	2216	powershell.exe
Token: SeProfSingleProcessPrivilege	2216	powershell.exe
Token: SeIncBasePriorityPrivilege	2216	powershell.exe
Token: SeCreatePagefilePrivilege	2216	powershell.exe
Token: SeBackupPrivilege	2216	powershell.exe
Token: SeRestorePrivilege	2216	powershell.exe
Token: SeShutdownPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeSystemEnvironmentPrivilege	2216	powershell.exe
Token: SeRemoteShutdownPrivilege	2216	powershell.exe
Token: SeUndockPrivilege	2216	powershell.exe
Token: SeManageVolumePrivilege	2216	powershell.exe
Token: 33	2216	powershell.exe
Token: 34	2216	powershell.exe
Token: 35	2216	powershell.exe
Token: 36	2216	powershell.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3400	4320	Torix Tools.exe	84
PID 3400 wrote to memory of 1280	3400	cmd.exe	86
PID 1280 wrote to memory of 3984	1280	net.exe	87
PID 4320 wrote to memory of 2784	4320	Torix Tools.exe	88
PID 2784 wrote to memory of 2476	2784	cmd.exe	90
PID 4320 wrote to memory of 876	4320	Torix Tools.exe	91
PID 876 wrote to memory of 1872	876	msedgewebview2.exe	92
PID 876 wrote to memory of 2052	876	msedgewebview2.exe	95
PID 876 wrote to memory of 2052	876	msedgewebview2.exe	95
PID 876 wrote to memory of 2052	876	msedgewebview2.exe	95
PID 876 wrote to memory of 892	876	msedgewebview2.exe	96
PID 876 wrote to memory of 228	876	msedgewebview2.exe	97
PID 876 wrote to memory of 228	876	msedgewebview2.exe	97
PID 876 wrote to memory of 3280	876	msedgewebview2.exe	98
PID 876 wrote to memory of 3280	876	msedgewebview2.exe	98
PID 876 wrote to memory of 3280	876	msedgewebview2.exe	98
PID 4320 wrote to memory of 1192	4320	Torix Tools.exe	101
PID 1192 wrote to memory of 2420	1192	cmd.exe	103
PID 1192 wrote to memory of 416	1192	cmd.exe	105
PID 1192 wrote to memory of 4172	1192	cmd.exe	106
PID 1192 wrote to memory of 2168	1192	cmd.exe	107
PID 1192 wrote to memory of 1652	1192	cmd.exe	108
PID 1192 wrote to memory of 3064	1192	cmd.exe	109
PID 1192 wrote to memory of 2176	1192	cmd.exe	110
PID 3064 wrote to memory of 4892	3064	Torix Tools.exe	111
PID 4892 wrote to memory of 3172	4892	cmd.exe	113
PID 3172 wrote to memory of 2292	3172	net.exe	114
PID 3064 wrote to memory of 2536	3064	Torix Tools.exe	115
PID 2536 wrote to memory of 3768	2536	cmd.exe	117
PID 3064 wrote to memory of 3748	3064	Torix Tools.exe	118
PID 3748 wrote to memory of 5112	3748	msedgewebview2.exe	119
PID 3748 wrote to memory of 1816	3748	msedgewebview2.exe	120
PID 3748 wrote to memory of 1816	3748	msedgewebview2.exe	120
PID 3748 wrote to memory of 1816	3748	msedgewebview2.exe	120
PID 3748 wrote to memory of 4396	3748	msedgewebview2.exe	121
PID 3064 wrote to memory of 2216	3064	Torix Tools.exe	122
PID 3748 wrote to memory of 2172	3748	msedgewebview2.exe	123
PID 3748 wrote to memory of 2172	3748	msedgewebview2.exe	123
PID 3748 wrote to memory of 4288	3748	msedgewebview2.exe	125
PID 3748 wrote to memory of 4288	3748	msedgewebview2.exe	125
PID 3748 wrote to memory of 4288	3748	msedgewebview2.exe	125

C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe
"C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\system32\cmd.exe
  /c "net start w32time"
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:3984
- C:\Windows\system32\cmd.exe
  /c "w32tm /resync /force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:2476
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=4320.3052.5562536005307150922
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffef1adb078,0x7ffef1adb084,0x7ffef1adb090
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,6574854266455622846,7858207586818716772,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,6574854266455622846,7858207586818716772,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,6574854266455622846,7858207586818716772,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --enable-gpu-memory-buffer-video-frames --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,6574854266455622846,7858207586818716772,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2420
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq LoaderNeon.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- - C:\Windows\system32\find.exe
    find /I /N "LoaderNeon.exe"
    3⤵
    PID:4172
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Loader.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- - C:\Windows\system32\find.exe
    find /I /N "Loader.exe"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe
    "C:\Users\Admin\AppData\Local\Temp\Torix Tools.exe" --post-update
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Direct Volume Access: Opens a physical disk for reading
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\system32\cmd.exe
      /c "net start w32time"
      4⤵
      System Time Discovery
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\system32\net.exe
        
        net start w32time
        5⤵
        System Time Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3172
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start w32time
        6⤵
        System Time Discovery
        
        PID:2292
  - - C:\Windows\system32\cmd.exe
      /c "w32tm /resync /force"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /resync /force
        5⤵
        
        PID:3768
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=3064.1344.7364755560459534343
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffef1adb078,0x7ffef1adb084,0x7ffef1adb090
        5⤵
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1796,i,3617432745142578994,11141467637480739687,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
        5⤵
        
        PID:1816
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1964,i,3617432745142578994,11141467637480739687,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:3
        5⤵
        
        PID:4396
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1664,i,3617432745142578994,11141467637480739687,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
        5⤵
        
        PID:2172
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name="Torix Tools.exe" --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --enable-gpu-memory-buffer-video-frames --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3496,i,3617432745142578994,11141467637480739687,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        5⤵
        
        PID:4288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2216
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LoaderNeon_new.exe

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\LoaderNeon_new.exe
Size 13.2MB
SHA256 17a2d330dcda68e437e5584636b40ffb80646cdd67a012dcfdf31b86e8d6c402
MD5 5a7398be1d578ff0828ae7f184c19249
SHA1 f9a727a46679af1e5c0f243c8449f9542fe229bc
SHA512 11ae713f09bf7ba118ec91564f6ea1b2d8344890b0a6ccebbdeececf5bc5140cc8ae094ab3057b25a1ad474126acf723dbe9f1592074df017c40504093cc6980
SSDEEP 196608:WmGX1R36GR8/9YGEpCPoOYiRJHNg6u+E:dGOYpCP9HNgT+E
TLSH
T1DFD6CE17A66401F8D0BAD1789A478D12F672348A4371A7EB3BD849521FE3BE0BE3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.bat

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat
Size 2KB
SHA256 e4747dee863418a19bf6551f17fcf439f2a8ec0b4d1a673673c53f0ea000c8ac
MD5 b43b34ce1100dc144b16200e87b45be4
SHA1 4ee404943101bb177899d910b2c979a498e656d7
SHA512 ccdb5f4e9bc3b0fde85e3c8b285b7314ae4a17167943915c423478b1eef5b2ac01208e042fd6fb774baf52ee0d50d2153204febbd34e94e9efeb0b898b8d451d
TLSH
T1CC41BE06529BCFAB0455997B5BA6928CE4FE880F5F05B7033A64C80D678640FFECA7C4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ga2225nw.z40.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ga2225nw.z40.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

4fd193bd-7a31-400f-84f0-12506b3c142c.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\4fd193bd-7a31-400f-84f0-12506b3c142c.tmp
Size 1KB
SHA256 32dc3a8da5ddee083bfaf5f9ca5803ba9f9ceecbd8687aba6cfe0fe0976af045
MD5 2eb09b56c08ac22f94bd9edcaca3cfb9
SHA1 e87fa7ddbdfa864253f0b9d5d3036925cf6914af
SHA512 2b2cfd873f2bdbadae9eadcce029bf96377021d5ac014d01a94aa3736f90da91c13f006a5f83ad5a428e15db2c06d8e16d10f21ea62fcb7d025a2230d950c072
TLSH
T19231B5B2E6A82B7668E1B40AA5423F077E20303391244F18B6DD0B1802D729E992EC33
MD5 SHA1 SHA512 TLSH

Submit Download

674b1e15-967d-43c9-93c2-16b32ea56816.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\674b1e15-967d-43c9-93c2-16b32ea56816.tmp
Size 3KB
SHA256 5a37ae65559ab216271f862c233224e565f0c8a486c17c3d530fa87f6372954a
MD5 c474b8256eef2322c08d29452ddc6acf
SHA1 aec862654a9c769141cf05e3def78be7630bcb94
SHA512 87f09f920727539d96d7cb934b8cae761538add2e6ffdcb5425f16229211b188a1691fa589732ed4f98a756ba9ac7c9463bf02594dcdf4dae15fca3746a017f6
TLSH
T1A271A872A968BA3B4DF2E905F8863F06B6656133E5943FA8D9EC0F1C01D73991346C17
MD5 SHA1 SHA512 TLSH

Submit Download

97420ee0-643f-4219-b629-19827d48198e.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\97420ee0-643f-4219-b629-19827d48198e.tmp
Size 2KB
SHA256 ed5c07c4c04ecf6ad638e7d73cb372c732464a51569943747e6079c9510087af
MD5 c9109707cb4dd66349baadec9ec59794
SHA1 9a046c019990df25933188d210031fa7c39a3009
SHA512 f40ca90a3567cec1a3c307788422ec489b478d1552f836685a7c33b1463a1fea534e35d85823a3cb489742a9898dc0e51f37de2cdd9998422ffd989d0aaa2f99
TLSH
T15951D772B9587B7B88E2A909F9473F13EE3571629A512F60A9DD0B1C01DB15D230AC37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dea6662dc68df8afa5bb20224804a1872bc31f15af1f87d2ce89e6279f6f195f
MD5 14a0ee423844054a6efd300434ea657b
SHA1 c40168b330d3fb56223b5ef6072a49ef4e574bd6
SHA512 4a282e0331b3df775de511f112a3cc55390cdf2320b78f50395204361196c744b72a308c03cade0fb76523bac7a6c7ffc0acc703cb47019e36f81c56f6314b95
TLSH
T17AD012173201417CC43020730102710A0840C12F40178004583DE51DAB040B40903C42
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6a5c590cd5a94cb735245de88e4ac72362a5d99d3cece0cb4b1b79c1af897ebc
MD5 eff38cbe6647d7889eb823f7ae5ad7b3
SHA1 69ef81ee507ed8ef868b76d9994409cad919d42e
SHA512 478f25ec8b61f7220f9a775b36a48f9b1e2ad84f4fed5ab8ffac57abeb7eaa8c16e3b7b575fdb0568b7e89ff441961408bcb40c131fd80dff2ac9c0c0c7d2cbc
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 1ddc16f3a593b279783ee7460652174cd897a0ea6af111da3b9935e710f6919a
MD5 4c0a0d48cbe66011e5f4514e0b90dd6b
SHA1 b6cc519be0cdbbdd4d74a5237df306383d8c7da1
SHA512 fe9de5713b45fec8208bd0a92d4985b793edb73374d681d7cacf1968652d8dd6cea1eecd048fcd808caa9ec05280bc6baeb513f60c9bd5f67d9effc3bd5add3c
SSDEEP 3:LstlNllkll/lc:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\GrShaderCache\index
Size 256KB
SHA256 de5b40907054d6410f8d7be8ae24d83af5872bf5040a9417c7cd2c909c508417
MD5 49c150692cea85a8f1acf86fc6c7849d
SHA1 47a4fba8219391073109ea6caa2efa4d76e125b6
SHA512 7e8a01f3f5de1ea9dcb7208417fa621218715336a6293529a8910b3266b58279e237b1a9dd694f40659ccb0bec9468f5e8a1f3a114fc4db21d8cf30d3696b31a
SSDEEP 3:LstlNllkll/ls:LsX3lEts
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Local State
Size 1KB
SHA256 398f2088db5fbfd602f5079aadd0f9e8a379a003fd2db9d7eac674639e6ec5b2
MD5 650d37d83f7602d420038caf20f12341
SHA1 e242bb9933568318d70eb2c359f861f99dcd16f5
SHA512 6215f148811d0c24cdbf9393b55039d8e5361bab1931942d6ca7d786f51d2218d7600c49bbbece9d4b07665b7ac739900c8d50676ddd0655433a869de931ddf7
TLSH
T12621B7B2D5AC2AB664E1A80AA5437F4B2E10317391244F2CF5DD031402CB1AF8A3FC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Local State
Size 4KB
SHA256 2fa1ebc495cf23cebd4582b4b77f013aaa6c719522cdd15fdd2e7b8ad83a0b2e
MD5 de51d2abd8b73e0ea2fae53221d1da2b
SHA1 27c463573fe6fe46710395e39fe1dcc3b276c135
SHA512 2e76f47f2e56fd5d3ee5d54f282e11793e8904193f5f23abeee97f08826ac902f3bd511bc2f6587276ffb5440b64b6b5ade7c0363c5929e24c2d2434f10483fd
SSDEEP 96:zuYF3NkCE8fmZ2G/Z58Frh/cInURoDotoTh+DsBdZTP6B+ZTTxTslsa:ztF3NbKZnAooDU4GgdZ5NG
TLSH
T12F91B532A974AA378CF2E905B9863F03BA646123D5D43FA8D9ED0F1C01DB29A1346C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e199249-0a49-4011-8b67-29c253f26e9c.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\2e199249-0a49-4011-8b67-29c253f26e9c.tmp
Size 16KB
SHA256 d56fa7d221f0677b2d6da85db5aadb1b3872c88301db1268ce066e36f03ae1d7
MD5 c1c936cd7de6e38f2047ac06f08ecc50
SHA1 29f90280d556f6afe4ff6cb107440c023d825a6d
SHA512 c3423b086767ca08b97a621cf551fcfa3ac7e0101ea8f12bb5c04c657e224f8b59a6676d06614fb74e82a76a93108626f6ec54c0c2e372ffa795ef8bf8aba60e
SSDEEP 384:zJ+OBqImmJvGBLx3NaFMJFNNb2E2CAp9ClDg6rT:IcvGtlNPYEH
TLSH
T1F1729DBA18366F272CEBC54ABA8D6703DA702163C4946FE8CCED4F0F029F4901396C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d160b81-01b4-4f64-8c56-f24500084a58.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\5d160b81-01b4-4f64-8c56-f24500084a58.tmp
Size 1KB
SHA256 54195cccb82eee6ee70252dd2199d2f82a8548fa50d5c4b63754c75bf3e8663d
MD5 7d6d4e1d70e8255d9174f11eada80aa2
SHA1 922ffb81d7f23b12e22d8039d9332f93a0cbd204
SHA512 1726484831581dab708ab903a13f65f11006a00441a62fc374755b93cfea4297cb453b9d5dc53987732bd1fdd20715aa534bc0e5450a9d9b73f2bb64aff39d3f
TLSH
T1F43185F2D8547B33EC9EA587B256BF479D20203AD1104E1862DE4B1C01D75DC966ED23
MD5 SHA1 SHA512 TLSH

Submit Download

6faf409b-bfb5-4db3-857f-b78d1e7dda0c.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\6faf409b-bfb5-4db3-857f-b78d1e7dda0c.tmp
Size 2KB
SHA256 558a80b59717cd1652a966b49432c0c788f02a93ee8d5c6bbd6f745b76afafe7
MD5 dcda59e2b58470527ac8ab4b08c9a327
SHA1 589b429d9213e0fe7321b17afb9a63e54112398b
SHA512 6b5e1e8cf8e28ec86ba3d4bb1addbce9de8b153ae53d9a8c41d64723f02b9b9acf85a05be7691354f404d5d60490a908f64f136f821e32cc004eca542bf47b48
TLSH
T11951D8B2AC04BA37C9EBD985B94A7F03DE306065EA511F649ADD0B1C01DB59C234AC67
MD5 SHA1 SHA512 TLSH

Submit Download

75dde0a3-fe4c-4249-acb3-6f406c5752d8.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\75dde0a3-fe4c-4249-acb3-6f406c5752d8.tmp
Size 4KB
SHA256 199570d93d567cfc1a89b719204c5ded414009df7a968a56c8e0c084377295b3
MD5 478aae2190f12e7dadbcc040fbd876c8
SHA1 930b927118fa957bf674534209e69d7b4cc1119e
SHA512 38aede81d280997084fa7459f2e037e2a20d37ef8c612f37462829aca587b72bf5404c33b25bf861caa62b12744aa764904e0311493b7d8d964d1e76043836dd
SSDEEP 96:zuCbNkCEAfm9L0jZ58Frh/cInURoDotoi/oAtD/fB2BZb6bQZT2OtTG7lQa:z9bNbA9Y0ooDUDrB2BZAOp+
TLSH
T11D81B7725874A9378DEBD946B9863F03A6605027E4952FACDDED0F0C01DB2D91346C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86377c48-adf4-4046-b8e7-76da95467f3a.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\86377c48-adf4-4046-b8e7-76da95467f3a.tmp
Size 3KB
SHA256 efc39db9fefb324803401a07a680826f57f01ce269bbc81fbda9fdeecaa115a3
MD5 5476b8eeb4b000c962a837f3c6e6ccb0
SHA1 e81b918ef367697b3e3a4a2980b7c30f7aa3556b
SHA512 fadc450b9497be6d349f41d324553476bcc9f611516c5d1918de300c9a8e64e9513309d342d8bb7c5d7e14203eb696a8ba66d2c7fd8593511f51ff0a13512c9d
TLSH
T12771C8726864E9378DE7D941B8863F02FA602137E5853FA8CAED0F0C01D72D81386C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7aa988b5d4d308a157f4fa162737c28576b089c16f493ad8e18134983a5baa13
MD5 70a140bedd8190124819c4ec10700c7f
SHA1 5356f5e64666fc5cea85c96f1483a261c384b001
SHA512 6090ce8f6c40cb6003608885d59706be05b505c109973fd224f0c18c6f3eac5f8a1a3bcaff8d3e4768db7a72676a6371d032be492f3ac8b572a6caadea6cda2e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6f03146800bbbc6a486c78952e50739bc2547af12fee423287c9960c6c2e5ec6
MD5 8cc3cfb308ed01e0e6e80eb00cfaf5e6
SHA1 b3b53b67497123a1de76d7cf855a509094cbd3e2
SHA512 15a1750a44867b2d86d71be786a14608609d52d6987053f5393cfc79083d114397493ad9c055bdd920f95115529ad90671544a59cbefdcca88fd69f68693671c
TLSH
T1B0D0122276211A74D0102033110365090411C21B50054180EA2C895D5A440700A17441
MD5 SHA1 SHA512 TLSH

Submit Download

3eb7cc36-8e45-4d0c-8cc4-a012472595bb.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\3eb7cc36-8e45-4d0c-8cc4-a012472595bb.tmp
Size 6KB
SHA256 31bc7f1921d4eb6727b0848db72f6bc99b411dc24cc173fc304528c4b5779f82
MD5 cdf1d29cf935a1048d586c39323b96df
SHA1 abe1588bb23e2b1dcc8eaceb81218e38a40b5327
SHA512 e7c4b88696ea8ab4a06c1653b502a309bfe6a5ce547f239d485e50b6a3148f46385fc229a8764da517ae76c508b3b725e764a9ca4dd740cee84812edddc8c196
SSDEEP 96:stf05k+N1b92qfftZ8i0vhE5k59m/7qx+WVHMSm+uecnpmS1iYAcQjP+g3LMEB:stf0ypqfVZ8paGA/S+Wi9pRwYAcipLM8
TLSH
T17DE198825E2879774CCBE719BA35BB12D1F9202275D40E98EBFC851C08E66DC630BD4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 6781c5c25f87f576147e5ceb7d12f69851b224c17579776749ecb1c28d25c21c
MD5 6f786c0f8140dd7128c3ba7e6284b3dd
SHA1 c76981a8166efad6f7b4ba52dbcc08bd0a6b1c1a
SHA512 bfdf0baede764204235855dd9ef77ee9f2049edb90383245d308855f48c710de6e2aff83da0c53c4992c4f507d145537b8ad975daa75f7a7ebfba8e4e877bd9b
MD5 SHA1 SHA512

Submit Download

0381fb06-ba98-4abe-b867-0b771afb2e83.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\0381fb06-ba98-4abe-b867-0b771afb2e83.tmp
Size 355B
SHA256 9c70cd310d9654cebf0f03cd366b1ee9d386dafa7be4bcdc5c1f58e40515b54c
MD5 491c399be0d303aa47eee162959849ae
SHA1 9eafebbf1cb17df00ab990838ad0abf497ee131b
SHA512 ed604d51cc8e9bfda43baefae5b200c1244b76f00ecdde914ae0076523f72a2da07871ed6cb53c150f3cb84e27f4ecd0efaf4ec9d7fd6b5a20d6c924d8b53a61
TLSH
T186E0D86184BFE42B107A46B61D44FE84DD36F438004174E4AF6747AC70940735207423
MD5 SHA1 SHA512 TLSH

Submit Download

8cfdaf66-1362-45e9-a467-3c040821ac67.tmp

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\8cfdaf66-1362-45e9-a467-3c040821ac67.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 c65d1591d00ef92cf11ce6d4809ce39789b4ac6aba8b4d970a51148bd3d82c11
MD5 4704a6618a23f820f6cebdc5017b3999
SHA1 c781c59505ea5df14aa2709906506fb92888bb74
SHA512 fd22bbdea9bf1817f8930352f0c92a42b4f14517c35782f56273efb647cabba0ee0e6501848cb7ef6c3fe36da48eac799ec310ce9313dec18f7d64eadf0b1574
TLSH
T113E0D8A1853FF06A107949660D84FD809D36F439008164EC9F73577CB0F90736603423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 264c055f341605a7fd72f7793702a9a3a7f737fdbafcdb0bff6c348f0668395c
MD5 c59d325af7c43a846e0b2e4d6fb64b57
SHA1 f26afff8882deff795701a6b802149149d0624fb
SHA512 0bf8c6f5c775193ea3256d7e1f8a9c527f93935e5e8b02574680a2d5e3b1fb3927a523734e308a41e2f0d14ff839a5953922dfc45bd3627e0cbc2af913c3d2e5
SSDEEP 96:stf05k+N1b92qffxdZ8i0oE5k59m/7qx+WVHMSm+uecnpmS1iYAcQjP+g3LMEB:stf0ypqfzZ8pFGA/S+Wi9pRwYAcipLM8
TLSH
T176D197825E2879774CC7E21DB935BB12D2F5202275D41E98EBFC862C08D66DC520FC4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Local State
Size 1KB
SHA256 1f6f8f9c7e646d62b4a69f748b285e8fbf239e5b511a4d4e8460dfe8dec6e7a3
MD5 9752bf7ac6d2e90bfe461baa55d5ff38
SHA1 44c83c4e76053f10363bd394af44f7097b8e7891
SHA512 38e07a5d22195bc781099c56d231ba5913bfa399df3ae9b36d46c0d9ee4186efcfbc44cd83eb942eb04bfba7467106dcc36b932478681a80633ef425103d617c
TLSH
T14D2165F2C8587A37E99E9497F256BF475D10607A91144E1C52DE061C01D78E8976EC23
MD5 SHA1 SHA512 TLSH

Submit Download

memory/228-85-0x00007FFF0CF80000-0x00007FFF0CF81000-memory.dmp

Download

memory/228-84-0x00007FFF0D890000-0x00007FFF0D891000-memory.dmp

Download

memory/1816-724-0x000002A543860000-0x000002A54390D000-memory.dmp

Download

memory/2052-308-0x0000016097660000-0x000001609770D000-memory.dmp

Download

memory/2052-28-0x00007FFF0E1A0000-0x00007FFF0E1A1000-memory.dmp

Download

memory/2216-518-0x0000025A54C10000-0x0000025A54C32000-memory.dmp

Download

memory/2216-630-0x0000025A54ED0000-0x0000025A54EF4000-memory.dmp

Download

memory/2216-629-0x0000025A54ED0000-0x0000025A54EFA000-memory.dmp

Download

memory/3064-319-0x00007FF697110000-0x00007FF697E4C000-memory.dmp

Download

memory/3280-150-0x00007FFF0E1A0000-0x00007FFF0E1A1000-memory.dmp

Download

memory/4320-0-0x00007FF701750000-0x00007FF702086000-memory.dmp

Download