60b1dbe5af281d9562a8e7804c2a9faf91af8082a4bceba14ccc404ff5652cc8

Analysis

user interaction
yes
max time kernel
64s
max time network
68s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TSBMacro (1).exe
Size 69.1MB
Sample261026-2dlahacb35
SHA256 60b1dbe5af281d9562a8e7804c2a9faf91af8082a4bceba14ccc404ff5652cc8
MD5 50f6b587c80965d0196ad5389b809e4f
SHA1 502d846a9716b4e8781407e970d4c4a3e8312858
SHA512 389672cc3a516548cec46aec6049b3929dc8121afc81509b7b6c0eca1ca1ab2c133c3aa760deaadef4b0e58581d8a3f984f15147dc33ee25b6fc283620dcbd2e
SSDEEP 1572864:qlD+RBwXzTUX0w8mxmVEt7y1ubpCwC3dUup7tR00UJ1:W+RBwXP5fmxiE5y1ipCwQ30zb
TLSH
T126F72356E2FD00E8D5BBC0B8C6575617E7B1345917309BEB62648A692F33BE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 34 IoCs

pid	Process
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TSBMacro (1).exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	pastebin.com
1	pastebin.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TSBMacro (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	TSBMacro (1).exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2200	msedgewebview2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4032	TSBMacro (1).exe
4032	TSBMacro (1).exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 2200	4032	TSBMacro (1).exe	89
PID 2200 wrote to memory of 400	2200	msedgewebview2.exe	90
PID 2200 wrote to memory of 1284	2200	msedgewebview2.exe	91
PID 2200 wrote to memory of 1284	2200	msedgewebview2.exe	91
PID 2200 wrote to memory of 1284	2200	msedgewebview2.exe	91
PID 2200 wrote to memory of 1284	2200	msedgewebview2.exe	91
PID 2200 wrote to memory of 3224	2200	msedgewebview2.exe	92
PID 2200 wrote to memory of 4892	2200	msedgewebview2.exe	93
PID 2200 wrote to memory of 4892	2200	msedgewebview2.exe	93
PID 2200 wrote to memory of 4892	2200	msedgewebview2.exe	93
PID 2200 wrote to memory of 3044	2200	msedgewebview2.exe	94
PID 2200 wrote to memory of 3044	2200	msedgewebview2.exe	94
PID 2200 wrote to memory of 3044	2200	msedgewebview2.exe	94
PID 2200 wrote to memory of 3044	2200	msedgewebview2.exe	94
PID 2200 wrote to memory of 3044	2200	msedgewebview2.exe	94

C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe
"C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="TSBMacro (1).exe" --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4032.4764.14104768917326420201 /pfhostedapp:6b30c364c73d24b77fd384d49d6d26872fe78b29
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView" /prefetch:4 /pfhostedapp:6b30c364c73d24b77fd384d49d6d26872fe78b29 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb04ae5fd8,0x7ffb04ae5fe4,0x7ffb04ae5ff0
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView" --webview-exe-name="TSBMacro (1).exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,2729283153097477331,10022315910010623334,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:6b30c364c73d24b77fd384d49d6d26872fe78b29
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView" --webview-exe-name="TSBMacro (1).exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2040 --field-trial-handle=1796,i,2729283153097477331,10022315910010623334,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:6b30c364c73d24b77fd384d49d6d26872fe78b29
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView" --webview-exe-name="TSBMacro (1).exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1796,i,2729283153097477331,10022315910010623334,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:6b30c364c73d24b77fd384d49d6d26872fe78b29
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView" --webview-exe-name="TSBMacro (1).exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1796,i,2729283153097477331,10022315910010623334,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:6b30c364c73d24b77fd384d49d6d26872fe78b29 /prefetch:1
    3⤵
    PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.Win32.SystemEvents.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\Microsoft.Win32.SystemEvents.dll
Size 93KB
SHA256 b81fa3ec77812fadd37684388d330805c1ee5dc29ca77ae30334f6640d1b6158
MD5 9fdec0949f789f7b5685759122bda497
SHA1 fdc3572f586a9da3d32ee95466033dc76a8e54f7
SHA512 c74920c6d418df416ba3cb4200a7733ff36a6ae994a5305b98be99d8401972f40c93c804652ae044731340afe7cd1a0355cf79b2064ab083c91eab042e02ce71
SSDEEP 1536:vFseFaiAeq4od3IljMH1dKCAw/4IGrGsDhjvSJJxzO:veeIipq4o2jaHLQIGrHjsJxq
TLSH
T102935B1273940632DAAE8E3BAA278A01E534F5C76752FBDF52C691090F63FC2D775182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Collections.Concurrent.dll
Size 269KB
SHA256 6ffcd942293576dbd3ab66ca6ef2ea0428f9e84bdacec63316bc5c069041f37c
MD5 d44f5a7649fa99f886674f33b214462c
SHA1 2cb6f57a33e4b497ce04ab75d2ee3fb860485d1d
SHA512 a51f19f34e07354fac8228e8af6a1abd06619b6ef466f13e9ac239e7ed75d63a129030b64ec895d17c6ef597c19f4316fc2d01f95361d9c0361c17d0f0eec3fc
SSDEEP 6144:hPA2Hvj4tByYOTblcFe4khyO2qIykwXLy:hI2vj4tBypHfhD2qIrE+
TLSH
T174445B2163884F12FC6F897D9593D514E2B6A8530322C2DF0274A9849FDFFD2AB77522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Collections.NonGeneric.dll
Size 101KB
SHA256 aba7167d2e95ee23a55a03586588eb01ca3e63942ff2e1392936692bc337c194
MD5 9a208dbc9f6ea15911a634abde78edd8
SHA1 df9f0a91436b7d9afe573100603f2b400a4a9659
SHA512 173b3a02b0cfae84b4f7af22a6de582521024b806321d9e754176891664705ec1cf82e2dc725396255d05697e73e3647634da8a0c4420c13aa875aca5a464b55
SSDEEP 1536:lWd0tJVDX9LuIbwNC5IQ7XVrMZqz9AZWTUdOoz6Y:lg0dzNuIc+IQLGZqzKZAoeY
TLSH
T19AA3182673D80322C69E6BFC81938A01E6B5F4D26713D1DF1618A9CD1F9BBC2D6B2147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Collections.Specialized.dll
Size 101KB
SHA256 c4b625cf2ec04fc659e86223ca4be5421f843ecac62feb1a2e5e92e7c70eda50
MD5 ff714375dc1f1ab2bd4c847055d1f78e
SHA1 8dd5a8798873e1175f386577d27c69d7983d5cef
SHA512 32427ee8771ae060ac4b1e8978756808b95a188b6f189f56693f7c647c51fbdad001d1bc93a1235d0a096056bd2e8de25854c89138ceaab05ea8bb2bbe82ce89
SSDEEP 1536:VT6dRfAgP9WSJLeI620hCYCARk4YIAO8xocgL50Gd0VIOblgzYr:VT6fAWpeJDPAOSocgLaGOBblgEr
TLSH
T16EA35B2473D84B22C73E92FC85978981E730F1E31362D2CF1559D9891E8BBC69B7612B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Collections.dll
Size 253KB
SHA256 f0fe3fc9cecf713d5c29a2fecdf6aafc50b41efb8130a56af54b8c9330c1ffc1
MD5 5e013ce9a5a3cb2840b4a0d56f86c849
SHA1 ce783a1bc6c03b5082059d6935cecfed6944da8c
SHA512 8041a3486e1e72079a111c2354f242dd74a43ce1ab4e5dc76b05e24e17bc2654f1ad462358be14e2ea2bcc921e79a17c3ccdfecd2398783f95ed0d499989afcd
SSDEEP 6144:SnxoXLkDXDiKNYX8qTKfAyryS1rIgH3iPt:axCkDXDiQ+jTURrhFXi1
TLSH
T119444A2A778C4E12F56F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.EventBasedAsync.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.ComponentModel.EventBasedAsync.dll
Size 45KB
SHA256 e5b203c21752934ee92e1f2f9aae98f28c0a054f5357072ec7d1a6fd036ae7cf
MD5 65aa50c8e332aaf918b3e792d41af071
SHA1 af58c250aea8fa2979085348c3fdebb69929a518
SHA512 30e92d83294218ff2ebd33f95aad05cd011100e0dd4513d5d96fd01c576616435911d08e28a7e039d01e3b20d9fb8916b90522cfd8dd0ef737c62bbde258a200
SSDEEP 384:IWvJwWyhT+HPadWBj/Duhzq1c8dgfL9ikyr46JXfCvDXxO88+aEZ4jIwVbBvfN4K:3wiCYlkB9n88IVFX8y8A2s9zld
TLSH
T166237D7143AC0113FBB74B7D89B28A53A974F6815743EAEF2474D20C1E933C2A772666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 3dc8bfbf3b542c45646a7057d3e945374c7b85db69c37f2a16794e88091a5b06
MD5 32ca30c430324b105ded9c880e2e9453
SHA1 1f0945383954c26312190f2059d71ef1591e95a1
SHA512 02c242e540dd9ff34ef8da2cb9f0d33adc17f8fefc7bf804a7d5904789d95bafb96d9dabceba70c92c6029bd2fb92252515315b9af0c12711dfe5120078473d1
SSDEEP 1536:+95/UZMu4zhd+Cv8A/oqevD2olsOnbktXzDv:+w43+S85qKD2omOnIv
TLSH
T114734B1823EC0126FBBD46BC9573A821A575F6831713D9CF4AA0D90E1F5BBC2E27152E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.TypeConverter.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.ComponentModel.TypeConverter.dll
Size 729KB
SHA256 534f82e18158a5bf76019b847a1f91dc8f54fb8075561d7678dfcab89c315382
MD5 7d5b13bd8e7b8911c0829c64e3f96db6
SHA1 a021ea71bed936351d56fdb2cadf8cfe6a8123da
SHA512 8bacb8788691c92f12f3df5910ba30f3228021dafd3f1b34a6203d7f23a86bd1766e1c03e9682bc88a6156a55b4ce54c65b5a3996f2ebcb445372bd22ab5ce1d
SSDEEP 12288:DHbWtrT/lAqmrIofhCXvdb+/ipZ7DvBEFBiXMS/e7QLohk+xLRxo:D7WtrxlmrNfhCXvdb+/ipZBEFBiNeMSW
TLSH
T181F45B559BD84A05DABF8278D672C801D570AC83533A86CB19D5EFF51FA3FC2D23A122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.ComponentModel.dll
Size 29KB
SHA256 d912b7e2d421a49a4eee9730764047f058a8d72c9b3618dcc195d6f427b55ae8
MD5 c561bcd4e57dbe2b16b4e294795c0a40
SHA1 8f3fb4dab0647f8c2245ce6006fc4398437f3bc5
SHA512 bcbfc4a08ae86a8fd4022a54aacc8cd34401dfc7bb1c3905a15588cfd15036fb2349f342356f708def2b96bd1810864bd0cbaa89943153b2db429e4a04bf70ac
SSDEEP 192:CW461WVqhdOk7+ASB7x0Yu7lWF+GBTBWseaAWAvkpTsX01k9z3AZTCJ/0b:CW461WVqhn+J0YMIlNKv6oR9z6GJcb
TLSH
T1DED26EA6CBA88213ED9A5E7056BDCB877D3DB3C54E02866B1196F1090D937C4EB3017E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Diagnostics.DiagnosticSource.dll
Size 405KB
SHA256 8501928426904a1b660447cb5cdeae888ec61a850395910a050fb33ba2541a14
MD5 8e2716fb1500a1dc46b2e03f963026d2
SHA1 756d4e8c141751db68006cfdca6675dcac0e189b
SHA512 c10b56888cbdd5481e833d43adc798b6adab8edb3d6e6100ccba761357badef2fbc10f7f9f5fef20c77f5f3749a73612f9442c79bc9765177fc97b38cf69000d
SSDEEP 6144:GsBTEcoc/FGFasNt2l4ru2jKw6xtQ7/tvjETqCZ03EdZZj4MKkf:dBTf/FGEsNtM4q2jStgjTc4Ml
TLSH
T100946B24E3D40D72CE6B9979C1DBC431C172924257D2DBCBA900ADD8AF1FBC1AD3661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.TraceSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Diagnostics.TraceSource.dll
Size 141KB
SHA256 953bd83cfa994f088c5dd326c1746dda1db937c9311c3e58f74e030c3190bb1f
MD5 a13f08d56314a49a0c56364907c6f536
SHA1 21fc500cfc888ce88650b79912f404e4ebd2551c
SHA512 03283d44f9d7fb875700ca157fef4b44d4a4cbb494fb44d4da55c96d68035c8d1bacbff0fd0f8acea0e75cc1b14a750823f23146a72b0f22ba53ce7e1fd18362
SSDEEP 3072:IdiUYBg1TeY0dpwQn60x7cftbgZ7eId1DT5DFHHg:zBg4Y6aQn60x7cftbgUalm
TLSH
T1F7E34B26739C0507C76E87B88563C702E6B3E4870302D2CF5AA6AD591ED7BD1FEB2485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Drawing.Common.dll
Size 1.5MB
SHA256 9925a0664e5ca4250a4b384e0d537354dc8c987bf8d9f59957229bd233ab7351
MD5 18bbcf53f345f1bed69c814e0991ed7a
SHA1 9b3b4e47f745397cad9baa2dcb6ef461bb85516b
SHA512 99b014535a9274e5ac294a39283f12f08c6a7f05a058472093281737150d2dbc0f2b7ef83db3f31e6f8c8464af8c685709ae53196e79e1827a3e1fe9cbb40cd8
SSDEEP 24576:YMD2QHkg196JNYqaM+s9unBgBrubG2dXkOJxPJqT0dAcdse:YMD2c5iSLls9ungrub1dXkOJ7
TLSH
T1EE651911B390992AE62FCA79C55AC504D270F81BEB02E9C715C1DA853F63BC3F63A1D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Drawing.Primitives.dll
Size 129KB
SHA256 6d056c7523d827c5dd264aea88a97342aeaa8a5e5b9a27c5c4e1886ee18c7d05
MD5 b88007cc432924f03bccf316f20a6e60
SHA1 a773b7f362fd7f4eba40ad576c5254b6850116ab
SHA512 c2682cd9259e9aae06c8bb032ee3b2b9704e573672b664721b061ca53e77403583c437c8114a981e37fdb31bbdba071a5b3618bdb7264010726967405bd0c3b5
SSDEEP 3072:NawFFA4yeP4SyuvmH00N6no5WvCIc9oRcb2K:lFFYimpjFo+
TLSH
T168D36B5DF348C4ACDAAC577D61975826DA26B2460361E6CF9DC9408CBF023D8F6B31B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Linq.dll
Size 529KB
SHA256 1b81642c1ee4f21ebbb57213c14e50df59aabcd7bf91de2eebdf4c0d9f32845b
MD5 7d69cbd4f96ebaab18b74203e37f5a59
SHA1 23c4ba0ebd3ae3a8e18e43854e1261d682cc6af8
SHA512 c7b3edfe8bf9f85115950da6aa6b010ebc9a1327ab99fbcd9313de89655f1cd8d15ae4f5cb16e2c52ae2da693c9d41a88a23ff98d55948dfda51d86622e2eaa4
SSDEEP 6144:/NYb3/ypY1hh8r4bdhR+JU1/0kxryufbFHJMyS5IHuYzfhMxjCkoTcK:1Yb36S1hh8rwdh8UxeEvAEImH
TLSH
T173B46A2493B80F07C2AF86BFE553E151D7F1859283A2C1CF995DEE961E93BC165BB020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Memory.dll
Size 153KB
SHA256 4d6fe7d23c06b4e81748d83a1314218f31bb1e4ce9b6d1ebc7ba8a78a342833c
MD5 4807ee6fb0ab7ed7d308d67657af7ed5
SHA1 c8eb5f273d03097957cd99eb1cd28bd3defa5981
SHA512 15c4cca2bda3fde1de51e2783afe7dcb4f4d430a16d132594cb4fbe46ebde25eddccea27cab9de2a6e5b83d7aaeed6de2c2f7bf5a7cb3d1dcd494227a5a99725
SSDEEP 3072:hsyymN/j+0sbFbqX63vwZuIBo7M5F8966oYdACBuqmwvhtTihdNj:gmCb6oIBo7qDGACBuwh0
TLSH
T12DF35B17E2980657DA3FDAFAAD225302D7B36142672192CB4CE4DA441E53BD0FF738A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Net.Http.dll
Size 1.7MB
SHA256 8a7638d615e37d1b271c526979ee36b56c1b56193a33f5929dbeb29d1fa6d6e5
MD5 9ad75ca671ae18a8608aff8bd7fea9b5
SHA1 4168ec4f395f3ecf040b16297e7ba8930be6eb92
SHA512 51fc0770f8735b22d50f9e6db275245eac332c4cb4cfa22e1549cb91325fb706cb80b61a795399d10a5d86169dccd6b99cb5b6f35468c107ea4d057601275090
SSDEEP 24576:2tbStUEPt/z8tbT0SV+6hFE3iZdf2+QdJuIy616Ub4Pl5:2tb3EPt/z8tbT0SrvE53Et5
TLSH
T1DA858D09A3E88616D72FC67D856B4453C675E0878702D7CF1984FD983E537C2BA3A22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NameResolution.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Net.NameResolution.dll
Size 109KB
SHA256 53a3215b359e108f0315e81e4a1c4d9981d5bd3e1adc3891f598dcfd7e4609dc
MD5 e8f2953df4a4e44366a9d27248a88a7b
SHA1 4ecb2966ce69d14041a05368b78572f83e5594ed
SHA512 ce0d6f4cbc6d587ecce53194e8aa9031d59765ec7259606bac6fc066fb1a3f8ffe88543559a5bbf5b1a3e4cb41000c6eac6e9c4471e2938fba48e99d8a4d2d4f
SSDEEP 1536:+SA9vC8kXWSR71kvhqI7+mRJRKaR4RZDFsa3lZGUox0szhp:+SWC8kXW0BkvUMtjRXKvDGECU+B7
TLSH
T155B34914B3D00661DF7E59BC8A234E4AE3B2F0C24B21DADF1989D54D1F937C6B23256A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Net.Primitives.dll
Size 225KB
SHA256 ffb439ee971575c80749639eaa2593194de95dfc18eaaaa4011df9a39fb64181
MD5 973a3e46e93102d5c1ba0e1429b88a73
SHA1 2283b2c5d854004650cabc0bfedb4c14e1bea654
SHA512 7bd445d4d45b6f10b1509a2c5980cf6f3d8d812def745dbfe54b328b123836f3b7364f18e577e999483f55b9fffecaf1e553a0f2295c14de5910aaf0786fc06f
SSDEEP 3072:gwtBNI7bgkZrgyBHSchuzeQ4X1Sji6uJQ+Y6MFotKXxloV2O1weRx:X7I7bgkZrB0cgeQ0RJNtc0V2YXn
TLSH
T16D346C2A73D44E03F66DC5BEC657C502D372A9425B11D6CB86A4B78F2F837D1AE32122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Security.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Net.Security.dll
Size 653KB
SHA256 4f471c45207ae53ad01cb0d16798c0cd94fb29a8253989da8c2f771e6db5e7b0
MD5 31a77cb4b0854d94e5530ca07b30665f
SHA1 272180c2f613fa578d5498aa3c766f5ee76784e0
SHA512 b0c15fef7cb7e1581d0cf2a9dac7d11be101b6b2de8a6dbdb249d2431c19fd6932ad45d118d004364fb54b1cfad46c25f98bc1ceb19f24de8794defd3f63d4aa
SSDEEP 12288:b+afG3x4q0UTs4NmHRquQZhaDcscj+Ctk6p9uMmBaYcuS4:b+4GTgfyh3jK6fZsZcM
TLSH
T19BE48D15ABD40B25FAAF873891724461D2B1A887F712D9DF0684C88E6F57FD28739323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Sockets.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Net.Sockets.dll
Size 533KB
SHA256 096c5ca2b8868c50991f183f0cbf8b32326cbf197f9a6cebe132c5ab63513d24
MD5 be82bc91373496b7e66ed884b4dc42c6
SHA1 2bdfcbcf5eb9c14205bf610709e25e8086fe6f5d
SHA512 694b8c80ba239dcc8b4cc90a2deb52611b8bc9de248ad6505d3c0f7a92b4891466a2fdf003c60db53425535da572ff968f0bad3bbc77c85a983df8e074821957
SSDEEP 12288:LZSV7iKFtxaGNUL2Sdr5Nzv0SAu9FWc1APTE/0NYo:LZS9i+txaGDSzxAu9IpEsH
TLSH
T1F4C44A1567E40E06DA2F967CCD134042E7F0A5861B42D6CBC494DADA3F437D3A77A1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Private.CoreLib.dll
Size 12.6MB
SHA256 7f48a9493a1d9f6c64a51c3ec357cf8534874ea62240a54c2a1570a5913148a4
MD5 3f64c06a7c0a7aaf48e7f95b11e16e59
SHA1 09022ca6e7be1ea52d1cc54af362ec7d915f74a3
SHA512 5214985658e7a6e3dba89154f57fb759884dc962ab70b5e19189cab2d288cdd459e69265f36dfadd64f41fb03f1ae4588e18c1719f360fa8efcfb113388e1b58
SSDEEP 196608:zmhH8mtl5F/v/u5ks5OtsFnyQvoNT/k9B5f:lglb/vG5L5OtsFtoNTaJ
TLSH
T186D69E11B3C89F16E56EC27DC2635285F3B1F4A2135296CF980DEA882F13BC15B7B265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Private.Uri.dll
Size 253KB
SHA256 7ce81174fdba93a1e12c596ea3e1ad4bcc9e798710292e1629cbe827ee34458b
MD5 fad0d4747aa546861652bcb7d37237aa
SHA1 96c67f217aed07466e4a1b571286939fbab6fa58
SHA512 bf8ba7d5bc35c3b7ef71b7c2d26217485c495a8963c45101e910ac70c4072cc44e019fe0332a10152bca50ed43d5e7f959dc848e7c3c9cecc38b7dd4b38c4bd0
SSDEEP 6144:1fAAcZQInBPKCeDc6Ci9MG3CMeVmtG+FsGu6MyN:aFODciMG3HamtG+fuVi
TLSH
T1A7448C25E3844E67F73DC2B981D3D112EAB270665315F7CB0AB5E1821F177C2AA36863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Runtime.InteropServices.dll
Size 93KB
SHA256 74a2dd12e1c0f3d9aca3f11e160a1de7a5bd4447ed8be3071377217a516f6874
MD5 67e5ef7bb29712cd647c9117ae76e48e
SHA1 0d590615d7d2216ff8a6c6b45f9e15586f4a141d
SHA512 41541cd2bab6517e79e71480289ab85d8c401238d359326267fcbeb25aac928081bd7a9f3e807c8d256b6572ea0eea76647cf71dccd7445e4906d38163914940
SSDEEP 1536:nDA6UupEelCtJfKS6+67NspnSPM+l5+ZkmVUKWH0ozkt:nU6p3lCto+dSPM+rCkm+N0o4t
TLSH
T154935A2437D84666CA2A473C8C375D50D9B2F6C613A2E6DF5781885E1D9B7C0C3B23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Claims.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Security.Claims.dll
Size 97KB
SHA256 20dbae23f8943877ef1b9890bc2d6ae3a2716fbb32e26eb124ad435e9e534737
MD5 1c0629c16174d240b790218b72e25a81
SHA1 aab1f7c51f2c8d0a5159bb38c3ddf74dbdc55a42
SHA512 9fe0f5f09cbf80c44571843e54ddbdf4a55a958ab2b2cc1b5374feace80a6d61414eeedf9f37514742248a7cdb09a54a9a35a5240bc97fec259d69225172be49
SSDEEP 1536:jT22/as3w2pm4X+bX5SdluDQu6O/UJxOQwQ7rzUU3q2bP6xLrSjYF6zhP7U:j6I3LpmG+bJS7uPGMXSsF6q
TLSH
T1E9A33B6437EC4222D2BE4F3C94D19909E9B4F9825762C7EF0A39CA4D1E87BD1D930A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Security.Cryptography.dll
Size 2.0MB
SHA256 a998a46e2379d65412d54bb6f55e0eb5f16c3d856228882311f011c870c668b4
MD5 3aeb519528a9c9261221d8020025ad9e
SHA1 3072366c21d4f244c2f450fb1547d952ba5545ad
SHA512 25ca2f6458932b3a3942723466d84b68865efbdd8dd32c23b024eba8a78c5a0d9f3c52b28c9fd32c7e7f3ca63457650767e0f350e61cbe522ed434f04a5961de
SSDEEP 49152:RmRKWpxajTJDMgmJE2JjdQLxObmpwXa41f:RmR0JQgey41f
TLSH
T177957C18BBE44B5AD52EC57E83234402D570F58397829BCB2689CB592F53BC2C7B6363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Security.Principal.Windows.dll
Size 181KB
SHA256 37858ee4c9cc2d07c175d379321d86851e3e89f2278593153cd12f5e33c6655b
MD5 14435461924442e2324c8e5392fcd8fd
SHA1 917c29c0304fd51c978b13cc2b8fa3d1d20b521f
SHA512 d6bceae746cf95bd9aecf44edd26985fadc1663bbc8f268b0fbce2121aa822fcd27cda16e3628c311e6e3e44ee5de8462d6de595ec794aae03e4ab77ecdaa89c
SSDEEP 3072:SRkZDNCLsCTyRdtl63xJYrwr7oDi1Jo82TOK1BguZ4o:lULsC6Ll67YrOoDF82rPjL
TLSH
T1FA045C12A3C8090BE6AF967D81639601D6B3A45707079ACB5590C9DA1FB7FC2FF32253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Text.Encodings.Web.dll
Size 129KB
SHA256 a6bc1ad954c3213bba9b0e27a3aaae8321adfa0642ec679bf4452f7819c8ad54
MD5 b50bebd09bd1eb336c005e78757812e0
SHA1 c1aad99c5673ab6530fa7a2b0201ae9d8c508052
SHA512 f918bdd5998b7af2a3dab9b86d9396e91060837683b23917258de6dfa10c52daa5682288b5b219d8b72983bb7cae65abd284edf8d194ba506bd9b33e9134b269
SSDEEP 1536:ImTABQlE37y4m3E5T+zpq5D3lhjdPTp8K76+d05HzdyRNXV5pm4+SqUUkzG:ImTOQlZF3E16qvZ5N77uLINl5kSqUUki
TLSH
T161D35D10B3CCDA49DB2D9A749153A2B6E5B6BFF6032293D7156474481FB32C4B2BD0E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Text.Json.dll
Size 1.4MB
SHA256 a5deaf26b38846d1f6e904faf4fc6ce50958b1ffb6369f4505e9f6dfc2b37fe2
MD5 9352bc06014a153db4665c44b9d7d786
SHA1 63fb020d34d4e68441bb7745ac88b154b8842ac7
SHA512 d29e1a180ea97beccf524070e5a1c240b06e4b0fc2b59fdb8e42888602c33ec4e7ccfa7486d9ac237d88a872cb1143f4af32c0cb4cc14b030130e0d90e7d8374
SSDEEP 24576:Ptsm4uebl7dAfc1mK9U5MDv8rwAAjuR5K9Ge6RdWU3IM8cVnMBHlJSuS:1BCmK9U5kv8rwBg5oGT8cd
TLSH
T12A657D05EBD88717C52ED379C0B3C112CAF6E4225B11C3CB1464D9AE2E937C6967B1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Threading.dll
Size 81KB
SHA256 76900e5c96b72e6e74477a90897f86c9f8b78eb2169010298cd4aecec5466ae3
MD5 a512c2446cdc301ba4598d5f5963bfaf
SHA1 7b6a72484dad6c24cb4b3f157bffa4c9b0aa9ebd
SHA512 19f4fe27372e1d4d9373b594013b6557c0fcb74641921c3e47e7ccf5d5a09bd3b5bc5fc0687fe658dbe1d382df5bdcbc458312f0a5ef6c5371c50d9b8bcc319b
SSDEEP 1536:U+goICPLFImrmODZcUBeZ8j0GEH9wdN3SGRm3LGgCRzy:U+go9PLCFtZ8j0GEH9wdN7R4GgI+
TLSH
T1F0835A1A7BE80416FA7B47F9EA729946C472FCD20710C6DF9059900C2E67BC1DAB2277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Windows.Forms.Primitives.dll
Size 2.9MB
SHA256 8a547ccc5ae404bd2c74245502bae1f3c8782dde3910d5772eaaeffb61b1df01
MD5 ca8c1b22b4c39e159bbd8421179c7d87
SHA1 08007cb1647f67f81254d66b5f8fba058a7e38bd
SHA512 9ee1bcc078167a6bcb4b8e74ac4f2e982eb585bdb2056420d15941e1a5bcc33ca97eee1cae90a14172f91354c1fd9982c060dc0ee15009b922519a201f09635d
SSDEEP 24576:3+aDBwGGJ6udkncfb9/v3R7dL7VOyrnMHCH/PLvlvKJdnmL/wLIlcq7VHILrajW:OSoJbdRh7ECH/PLvlvKJhT/eW
TLSH
T1D9D55C00B3A627A1FD29CE7599254E419173AA476382DDE7D0C584B83ED3FC3AB3B191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\System.Windows.Forms.dll
Size 12.9MB
SHA256 c72f9abc14c0ff6da97808bec44eac0265e04e8f166cfe2ce3ddc36ed996f5c3
MD5 a7a2beb1b4b61ea996cba1070e48f05e
SHA1 e723bb77b7fc3036aaf99fe2672a657f175aaaf8
SHA512 30c16cd6d9fccf47cec3a6340b8311ccc47455486e9f5a10671e60b343d8c885a6e0116e22557168c2ab7573efdffc37ae8ecb453e94e918e4aacd8ff233d198
SSDEEP 98304:10S5xsDDz9cRqTE0PydxeM2EpGCYoy96I9awaMG:10S5xeDzvTEIHhEpGCYoy9p9a57
TLSH
T1B4D65A5252ECBD86D23A4279E37393E0D7ACDC168351D2CF0590BE063ABE6837636395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TSBMacro.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\TSBMacro.dll
Size 394KB
SHA256 ce359b6e78fa4f8bbe4ccc7355a4f645df7cc70db025c6568d2288061f08dcb4
MD5 6f15a4b9a8dbae2887b35f35e4520f45
SHA1 162af37b4761153799e27d7688c24278dbb5cc69
SHA512 feea1e6702a36dfe824a9ce6911fb3658e931cf7b748f122422cefbd519475fdbd10346039e1bd1c1218d2fd9ff2ae829a99d3664b58ea0289bb04a3f3f7e25b
SSDEEP 12288:I9FyAd98pglftlf9nRjU9VgvewB4d3/dhg9Q5//ay:hpglfth9Rw9V2tY31J5Hay
TLSH
T1A684E12831982637C26F49F361B3865922B6940F6D02C24D9FE9B1E81FF1FE16512F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\TSBMacro (1)\fW+cjCFMx3+3VE3pANU+PfFT7PUEQAY=\WebView2Loader.dll
Size 160KB
SHA256 239a9d6614a6cfade62b47cdb0be36e3069eedc438c3e0647a9e7b7c84ef6ea0
MD5 cce1332e0af440bc54fdf04eb543d4a0
SHA1 c7f6c049ff3eee4ed337a98d3163fbb5c4686ff7
SHA512 3484febcb142beac708faa1775699450ff22f5ce13b7e90da4d6d27ac9bbedd1c2477dc33125cbcce00fc7d59d416588300fa7b3c1c607bda0d1e874cb0425a9
SSDEEP 3072:qjAuqhU/3A5evuBdyoioiVO7kKlU9tKTTnhTEtJI8w6lKIc:36642lioiVOAqnpEtJs6W
TLSH
T1ADF35C57B3E500BBE1B7C27885A74A46EB7678111B609AEF0364433A1F237D0AE3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

056db911-8d66-4b8b-b20c-80cd5be23711.tmp

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\056db911-8d66-4b8b-b20c-80cd5be23711.tmp
Size 15KB
SHA256 3a5e87a257ecaf2683d25db614da3b3abd92c7c70fac81e750298e8cdd89e1d3
MD5 3f7bd03561c9f8113ebb077659bbb773
SHA1 6eec5bfc1723114b61e629c6cbcdbec9b5816f1d
SHA512 c7b836161d46f6c0768824a11c6a5cc6b0888be35483f9326ec4663a68e1d432a3a30cf1129c968dd4f7c74a47a8a7bb0284d8f843126dd201eb13aa55e487ee
SSDEEP 384:5+OBqImmJvGBLx3NaFMJFNNBS9/0BelVELIg6rP:UcvGtlNuhrELmb
TLSH
T15A729C7628A52E632CFBCA49BA8D7343CBB5A293C4D17BE8DDFC5F0E516B0441352816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3dffc2d0-aba5-4579-b5c1-33d8589395fa.tmp

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\3dffc2d0-aba5-4579-b5c1-33d8589395fa.tmp
Size 2KB
SHA256 463a4b9e96c78817489fcf307c3cec6000537cd255688852e0cac52930e72434
MD5 043b58547ff6a2503c7b523902006917
SHA1 d77bd9b5cc0d098c56ba374ff4f5fc730efc3a74
SHA512 6584311b1fe79aec9b16b05de551ed961155e7037dd4bb3e849a31295ba21f791c2cffa1650185ecb9e4687b71e64898f5313f6ceacd0dd39604acc5c6e61920
TLSH
T19651643368506F7795E6C648B94A3B23EF75A2529A922F90DEFD0B0C41DB25D2305C3B
MD5 SHA1 SHA512 TLSH

Submit Download

9776fd96-e8cb-474e-968b-5dfbcf7cd0a1.tmp

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\9776fd96-e8cb-474e-968b-5dfbcf7cd0a1.tmp
Size 3KB
SHA256 04dcd805fc34cfe8341befce25b8463954aced74d01d63494d55c1753e714d50
MD5 b1a1d8cef50ca16b763a2240249f5a11
SHA1 b9a07cf14f832266237f9ddf9f1dc9e497e52da6
SHA512 3b1570002ea1a26fcce4a6a944239355645c86712cf9936d2d8b315106eb96c5e5ae1bde18e702e87f31a9a29c66cbe28c16298b514ecb27498a9a8d41b63395
TLSH
T1C66163376960A9779EE6DA44B98A3B12FBA59123E5D13F94CAFC0E0C01DB3981341C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 972cdab07d79536700a413dabae8c986d323992ded0089e7cef231c55dc5ee1f
MD5 f6e689bb3110fa87e11f867a1e284904
SHA1 44abc59d8acaaf849851c94d886ade689a552a58
SHA512 02c178fb726fa59dd9461298118df0499fdce37b4a4f37dfbfffa6739b2dd71df43a1d64a48feee0d72f92119cdb60a0f938836ce6a267860ed29688a2c6c29d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b85f86f775335a86ecf5a2d42f867a74d0de5c4d727b185b73ca9639bd1048fa
MD5 47d6d71ad2a72b453aa7ffe551c3dc83
SHA1 7116ded5a07c6a50f11f033d901929501d81593c
SHA512 d130a28b72f2d7574b26a96c8960b25f617158e092fe0802f1592ddb02c1b473f48284dd5a5bef6cf6fb2f9538f6b918dc11010fd69d1b1a8bc45b1a3d37c13c
TLSH
T152D0125672120274D120303301427A0D0400C20B8146C8015438991D1F140900D13441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

7a8df3c6-6a2a-4041-9422-500c4a1d44ee.tmp

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\Default\7a8df3c6-6a2a-4041-9422-500c4a1d44ee.tmp
Size 6KB
SHA256 2ce32300599e4f74bfc77d13bbfe7d8054c014df6046dd9d7dd97f8ef46ee6b4
MD5 713aeae517a2bd2c4f4915d82a73192f
SHA1 1f688d7a42d665b965eb9e126c87504a5a93c36a
SHA512 fecb325562a424aa28c933c1ea4cd8a26a6112a28f6e56cdcde5f1520227260fd572e538a84a5905020d952c0119a5b6b8ebc2f9a41d1d87988b8b81d992924a
SSDEEP 96:stB/dJxrBAb9vkgo5h16ZdJCs7/x+6MhmuecjSIh1ejeiK+gyA28XM1C7K:st1r2vooUsV+F3LhQjufG6K
TLSH
T109D1A7025E287DBB4CCAE549BA397B02E2F5A03265D51E98EBFC461C04DF6DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\TSBMacro (1).exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 f0f74ad7e0c7984ce2e7aa27ee413351105550400f20dc4688e0c88b002286e2
MD5 5acb766af2ac08dd30ab546bcf12e852
SHA1 fa27b62717ec5c209944f330fbe29a57cbc1d2d8
SHA512 ec5a75fd6a5b0ecd2885a1d1ad7f40f71ba482f1eb4fa096cdc86a89aca3fe517a01e923a2a2e0369106a6ff2cccc54d2db3ffe1cf9c83087bb2aa52dd9ec76d
TLSH
T198218773E9A00F73AD96D345A1097B67AF70615782914E80DAFD061C02E724DA72DC37
MD5 SHA1 SHA512 TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\Temp\demsMacro_ui\icon.png
Size 266KB
SHA256 64758301d8d67bcbd74c5eaca908bed1d05e7079a6c9a369452629cf9ee356e3
MD5 d9d1f8667cf1aaf0362b345bc10cb582
SHA1 a0c9c011f8a2ba77f557675342b1bea13abf6f2a
SHA512 bfe836ee6b31e494a6b449291b3365aa77ade4370c8e4e4c19f73b0e329df3c2e667f498759b01c2a0b1308dbe9cd3605a3859a14a736b6325130731aa9c5d4d
SSDEEP 6144:Wglftlf9nOiVPrUF9lE0DgveIHB4dFIcd/DXHphg9Q5//1wy+QA6:Wglftlf9nRjU9VgvewB4d3/dhg9Q5//D
TLSH
T19F442214518ABF7759C180B273227C53C3A7510D7AA84F520F7AEB1A38517ADE622F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\demsMacro_ui\index.html
Size 46KB
SHA256 10587e520b7a02a3e192aa8465cefe6ab3d6077863f807f83d2113e13520bb75
MD5 59a4c576cbda95b6cc406b7085ac76b8
SHA1 13beb6214091d2ac5e36beaa36067e77f04d075a
SHA512 7bd6e7373aec255e350733471295c545bbdcf1df38c41e96288c362b34a50faad6ce89998bd02c1e186a818b8434477125b4ac98336ea999e93708de418abb6b
SSDEEP 384:sDGXYmkGy46DUMExYkDL1YPmJObgY34SUkHPX4n0NoIWr7Cg1TZekUQ7eNEhz4IH:sD8YL46DUMExpLPSFm2C9++4IXwfNU
TLSH
T11A23C7716555213BE56358E3926F8B4E30A9C04BE943D02CEAECF1F44FC7DA36926788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-568-0x00007FFB28610000-0x00007FFB28611000-memory.dmp

Download

memory/3044-656-0x00007FFB28610000-0x00007FFB28611000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads