18dd3baa38632c8efcf756b47c141c2340d047323a9524c609b21b19e2207b68

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Toolbay_x64-setup.exe
Size 2.9MB
Sample261030-krtelaaz2w
SHA256 18dd3baa38632c8efcf756b47c141c2340d047323a9524c609b21b19e2207b68
MD5 2dcb6f29e65c98e93de847c0ddc7d9db
SHA1 20d93d95dd2d0131da2518ed43e9f5eca1b26d05
SHA512 5298749d50f9b006046d05ea9b29c4f644177744a2ae431bd7c37b9b59e2be2c6b3c834cb20356e56f5b94b71e9a5ee1f56da1c15153f75fd46f3839e94cf3df
SSDEEP 49152:d5El5v+rDXQsreQyk8rK8cZFFx7eo6dRHaIM4qi3ANm+HYz6t6Ufqc2BgNxfuI54:d1rFkMv+rR6IVANm3ofSkI2cw8j
TLSH
T1A1E5330C8376D8CFEE3127320DFEE92E68B66A7106D521A785658F91BC61E8F744E131
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4276	toolbay-desktop.exe
984	Toolbay-0.1.17-installer.exe
2232	toolbay-desktop.exe

Loads dropped DLL 11 IoCs

pid	Process
4588	Toolbay_x64-setup.exe
4588	Toolbay_x64-setup.exe
4588	Toolbay_x64-setup.exe
4588	Toolbay_x64-setup.exe
4588	Toolbay_x64-setup.exe
4588	Toolbay_x64-setup.exe
984	Toolbay-0.1.17-installer.exe
984	Toolbay-0.1.17-installer.exe
984	Toolbay-0.1.17-installer.exe
984	Toolbay-0.1.17-installer.exe
984	Toolbay-0.1.17-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	toolbay-desktop.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	toolbay-desktop.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 58 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1890271126\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1890271126\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1890271126\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-nl.hyb	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	toolbay-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	toolbay-desktop.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	toolbay-desktop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	toolbay-desktop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	toolbay-desktop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	toolbay-desktop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Toolbay-0.1.17-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Toolbay_x64-setup.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\URL Protocol	Toolbay_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Toolbay\\toolbay-desktop.exe\",0"	Toolbay-0.1.17-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell\open\command	Toolbay-0.1.17-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell\open\command	Toolbay_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell\open	Toolbay_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\DefaultIcon	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Toolbay\\toolbay-desktop.exe,0"	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Toolbay\\toolbay-desktop.exe\" \"%1\""	Toolbay-0.1.17-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\ = "URL:ai.toolbay.desktop protocol"	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\URL Protocol	toolbay-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell\open\command	toolbay-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\DefaultIcon	Toolbay_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell\open\command	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Toolbay\\toolbay-desktop.exe\" \"%1\""	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\ = "URL:ai.toolbay.desktop protocol"	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Toolbay\\toolbay-desktop.exe,0"	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Toolbay\\toolbay-desktop.exe\" \"%1\""	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Toolbay\\toolbay-desktop.exe\" \"%1\""	Toolbay_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay	Toolbay-0.1.17-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\ = "URL:ai.toolbay.desktop protocol"	Toolbay-0.1.17-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\DefaultIcon	toolbay-desktop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay	Toolbay_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\ = "URL:ai.toolbay.desktop protocol"	Toolbay_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Toolbay\\toolbay-desktop.exe\",0"	Toolbay_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\shell	Toolbay_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\URL Protocol	toolbay-desktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\URL Protocol	Toolbay-0.1.17-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\toolbay\DefaultIcon	Toolbay-0.1.17-installer.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	toolbay-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	toolbay-desktop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	toolbay-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	toolbay-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	toolbay-desktop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576146b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	toolbay-desktop.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4588	Toolbay_x64-setup.exe
4588	Toolbay_x64-setup.exe
4276	toolbay-desktop.exe
4276	toolbay-desktop.exe
4276	toolbay-desktop.exe
4276	toolbay-desktop.exe
4276	toolbay-desktop.exe
4276	toolbay-desktop.exe
984	Toolbay-0.1.17-installer.exe
984	Toolbay-0.1.17-installer.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe
2232	toolbay-desktop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1664	msedgewebview2.exe
3224	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	4588	Toolbay_x64-setup.exe
Token: SeImpersonatePrivilege	4588	Toolbay_x64-setup.exe
Token: SeImpersonatePrivilege	984	Toolbay-0.1.17-installer.exe
Token: SeImpersonatePrivilege	984	Toolbay-0.1.17-installer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4276	toolbay-desktop.exe
4276	toolbay-desktop.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4276	toolbay-desktop.exe
4276	toolbay-desktop.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 1664	4276	toolbay-desktop.exe	91
PID 1664 wrote to memory of 3540	1664	msedgewebview2.exe	93
PID 1664 wrote to memory of 5728	1664	msedgewebview2.exe	94
PID 1664 wrote to memory of 5728	1664	msedgewebview2.exe	94
PID 1664 wrote to memory of 5728	1664	msedgewebview2.exe	94
PID 1664 wrote to memory of 5728	1664	msedgewebview2.exe	94
PID 1664 wrote to memory of 896	1664	msedgewebview2.exe	95
PID 1664 wrote to memory of 4196	1664	msedgewebview2.exe	96
PID 1664 wrote to memory of 4196	1664	msedgewebview2.exe	96
PID 1664 wrote to memory of 4196	1664	msedgewebview2.exe	96
PID 1664 wrote to memory of 2380	1664	msedgewebview2.exe	97
PID 1664 wrote to memory of 2380	1664	msedgewebview2.exe	97
PID 1664 wrote to memory of 2380	1664	msedgewebview2.exe	97
PID 1664 wrote to memory of 2380	1664	msedgewebview2.exe	97
PID 1664 wrote to memory of 2380	1664	msedgewebview2.exe	97
PID 4276 wrote to memory of 984	4276	toolbay-desktop.exe	98
PID 2232 wrote to memory of 3224	2232	toolbay-desktop.exe	101
PID 3224 wrote to memory of 1644	3224	msedgewebview2.exe	102
PID 3224 wrote to memory of 6020	3224	msedgewebview2.exe	103
PID 3224 wrote to memory of 6020	3224	msedgewebview2.exe	103
PID 3224 wrote to memory of 6020	3224	msedgewebview2.exe	103
PID 3224 wrote to memory of 6020	3224	msedgewebview2.exe	103
PID 3224 wrote to memory of 1248	3224	msedgewebview2.exe	104
PID 3224 wrote to memory of 4648	3224	msedgewebview2.exe	105
PID 3224 wrote to memory of 4648	3224	msedgewebview2.exe	105
PID 3224 wrote to memory of 4648	3224	msedgewebview2.exe	105
PID 3224 wrote to memory of 4944	3224	msedgewebview2.exe	106
PID 3224 wrote to memory of 4944	3224	msedgewebview2.exe	106
PID 3224 wrote to memory of 4944	3224	msedgewebview2.exe	106
PID 3224 wrote to memory of 4944	3224	msedgewebview2.exe	106
PID 3224 wrote to memory of 4944	3224	msedgewebview2.exe	106
PID 3224 wrote to memory of 4172	3224	msedgewebview2.exe	110
PID 3224 wrote to memory of 4172	3224	msedgewebview2.exe	110
PID 3224 wrote to memory of 4172	3224	msedgewebview2.exe	110
PID 3224 wrote to memory of 4180	3224	msedgewebview2.exe	111
PID 3224 wrote to memory of 4180	3224	msedgewebview2.exe	111
PID 3224 wrote to memory of 4180	3224	msedgewebview2.exe	111
PID 3224 wrote to memory of 5860	3224	msedgewebview2.exe	112

C:\Users\Admin\AppData\Local\Temp\Toolbay_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Toolbay_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588
- C:\Users\Admin\AppData\Local\Toolbay\toolbay-desktop.exe
  "C:\Users\Admin\AppData\Local\Toolbay\toolbay-desktop.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.6 --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4276.3384.11124860415164284563 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView /prefetch:4 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffa31405fd8,0x7ffa31405fe4,0x7ffa31405ff0
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,12165179042538514339,16518398820463271774,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2160 --field-trial-handle=1756,i,12165179042538514339,16518398820463271774,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2404 --field-trial-handle=1756,i,12165179042538514339,16518398820463271774,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3468 --field-trial-handle=1756,i,12165179042538514339,16518398820463271774,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a /prefetch:1
      4⤵
      PID:2380
- - C:\Users\Admin\AppData\Local\Temp\Toolbay-0.1.17-updater-XclYgB\Toolbay-0.1.17-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Toolbay-0.1.17-updater-XclYgB\Toolbay-0.1.17-installer.exe" /S /UPDATE /R /ARGS
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:984
  - - C:\Users\Admin\AppData\Local\Toolbay\toolbay-desktop.exe
      "C:\Users\Admin\AppData\Local\Toolbay\toolbay-desktop.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Reads the TCP/IP host and domain name from the registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2232
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.17 --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2232.3512.17457242582083052619 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3224
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView /prefetch:4 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffa31405fd8,0x7ffa31405fe4,0x7ffa31405ff0
        6⤵
        
        PID:1644
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,18349958738558385404,2863093608727498868,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
        6⤵
        
        PID:6020
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1996 --field-trial-handle=1768,i,18349958738558385404,2863093608727498868,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
        6⤵
        
        PID:1248
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1768,i,18349958738558385404,2863093608727498868,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
        6⤵
        
        PID:4648
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=1768,i,18349958738558385404,2863093608727498868,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a /prefetch:1
        6⤵
        
        PID:4944
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2180 --field-trial-handle=1768,i,18349958738558385404,2863093608727498868,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
        6⤵
        
        PID:4172
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=820 --field-trial-handle=1768,i,18349958738558385404,2863093608727498868,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
        6⤵
        
        PID:4180
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView" --webview-exe-name=toolbay-desktop.exe --webview-exe-version=0.1.17 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4496 --field-trial-handle=1768,i,18349958738558385404,2863093608727498868,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:ae878ccd138905f1a0ea4c1897270868d9c2a03a
        6⤵
        
        PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Toolbay-0.1.17-installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Toolbay-0.1.17-updater-XclYgB\Toolbay-0.1.17-installer.exe
Size 2.9MB
SHA256 451130f88fc6481018872c3b42c578d6c25f43e11c46120c284512785f333afb
MD5 e4f646127e38effd796512e2f2ad1700
SHA1 11dcb0a4aaa05d9bb0b5cd61272cfd6c55cd4558
SHA512 647dcadcd6d77671813c390518346337ee20c2ec6d929d5d13e6b5d343a2b08f9d34f1dfec6062b7414cec96a2910cba44f00863694216362acb8d476d3ff25b
SSDEEP 49152:95EYnHxK0ihVQ0OLLmj6eAMMDHOiivXk/gCWPWEGcCNY+50pGfFmKWzw+hnWPzaz:9O0ihVA37eAKDzWEaFGwdmKWzf4POr
TLSH
T1DEE533DC739558BAF136EF7133264389A6EB0C2F642848DBD1125B52B8A97D4F8F0790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh22A3.tmp\System.dll
Size 12KB
SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
MD5 564e01f2c6edfb8475573e1b809cb5eb
SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
TLSH
T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsh22A3.tmp\modern-wizard.bmp
Size 150KB
SHA256 08a1ed7a26caeded9ea492e3f8128fd61d4fe7e818f7d8e1a1cd64f941d2a0c0
MD5 d3bf6e6a859f332a7527fd471e7aedc0
SHA1 63ea3081d5ca093fdefc30dc64e6ad8aa582c7c7
SHA512 2443beba340044d9705ee1d0807dcd6e76127d5055a9b83f88d88675d830a977a057259f209d01855e4fc5fc2ca4491a35dcd79a397bc194be994f4a78b81332
SSDEEP 96:IidxNjUNkggllBlyOZyg4oJ/d5+HED4pu:IipjLlnyfJpu
TLSH
T187E327B1CC42905BDA58F638C9F1A509FB7BBDDEE470D475314AF8EB2A321B9088584D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh22A3.tmp\nsDialogs.dll
Size 9KB
SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
MD5 79c27de4d1c6d295fefaa70f608f1c67
SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
TLSH
T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh22A3.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installed-from.txt

Path C:\Users\Admin\AppData\Local\Toolbay\installed-from.txt
Size 21B
SHA256 a0f3d47a4914e0bf70d6fc0ed2664796761995a382f3316f8788bdbed60d51f4
MD5 04f4c5070092c3c5fa2ced0eaa2a3b75
SHA1 0bb36ed650ca2754290531eabbadbe3e2271da17
SHA512 3869a9adb7e91c945cbaa2726406b8e1a48b081259eeb59892db3aa8b94c026a4aea2ddd8af1066b7656785cf99df0c357f3776fccccd9ba3e0ae76dfc2066ad
MD5 SHA1 SHA512

Submit Download

toolbay-desktop.exe

Path C:\Users\Admin\AppData\Local\Toolbay\toolbay-desktop.exe
Size 7.9MB
SHA256 4ea8efe604d6bfcb2f6f01bd86cdb1ec8726aeb1088faef735f179df3e4bb3a9
MD5 2a55b7f5f5cd4ef0701ff23c2006d01d
SHA1 edf180dc992f597256804b244098a311635a5e4d
SHA512 8766f5e75155f1e2dad756ce203d96c933c70964eca36ce405569775b2da09aef64fd91fa7e77b3de73430f1a2f4580e2c353879cac0ef46b1d5d6c7ab064f54
SSDEEP 98304:IkZJoWhY9wRA5+wp7TnUgOSRLjNcm7hEa57wXa5CD1Wn/gOI0mNfG8yyZNbivNXX:FyH73LZKU8qa5ZNGvNXO
TLSH
T1AB864953F26280E8C12AC175934A6233FA717C490B357AEB5BE48B253E65FD06B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolbay-desktop.exe

Path C:\Users\Admin\AppData\Local\Toolbay\toolbay-desktop.exe
Size 7.8MB
SHA256 ea16328f4ebca1ce02e652384061ce60a765282ce81af8551be10313be143516
MD5 df913736e5918fae77be5cc693804685
SHA1 001a4fa478d964dae2d3f7f90454087c11dff8a7
SHA512 b836ce09d14836aba1baa92d0df18faef255aaf873118ccc46fe84e5d289757f47730bdc8f07e2ab47262b3413372b4f46a4f1d5d13822b631c0b184fbf4484a
SSDEEP 98304:pRoVB8Q66/6mM4lp90042Y+Y6A2DgN3xAIdMYp6B/KDSp99vt5SZN8OTPSYavn+p:zY13SS1ghbpaGZNlqLW
TLSH
T16C865953F66280F8C12AC175934A6233FA617C4A0B347AEB5BE48B253E65FD0673DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Users\Admin\AppData\Local\Toolbay\uninstall.exe
Size 90KB
SHA256 508b4cb8516bc5e96737f22424668ae29538dfbd7ee5bc2614a9158a4b9ec599
MD5 2e1be8a29e8c2c2e55483d4dd18f3bc6
SHA1 baedd8029f85e0e3e8690fe5286f76cffb7021bb
SHA512 476220a891e0f355f260d9783b8163fb1e1a49d492a063fd7c432f3ff9e5d6a0372903f1aebf1a3f10af52e3601c927ed34f0cebdc5f7677e29756cd1530deab
SSDEEP 1536:brlnJVfjAMrwIK6klYjak7ujgpQ/1CrOjQqLaA9Je6xAsgSh//W/Du7V29SnnJDb:PlnffjVrwUak7ujoQsrOjQSaA92yWSws
TLSH
T10693D04977A0C4F7CAB606305DBA57B33FF5A52111A4676B13409B5EBC32582EE0E3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

065c7111-1beb-427d-af69-1e587b58942a.tmp

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\065c7111-1beb-427d-af69-1e587b58942a.tmp
Size 16KB
SHA256 b8451d8e190d639df7b09fc8c0285c9ec760447ed274fd2f0451657ffd551e1c
MD5 6f0fed53d54000baa9ac64cb3e19db67
SHA1 03d255caa89895ffda4a167008ffccc648a1da45
SHA512 616bad65f5cc5a86377cd74df415adb30d666717f14eb3c3b114371bb7ad4bd159ddf07bf4b3e329472f6fd9ca71670d9b70c061a27d2bb841d899a15a1fd2eb
SSDEEP 384:8+OBqImmJvGBLx3NaFMJFD3NBSY/ZXM4g6rv:dcvGtlNDPFM2b
TLSH
T1D072ADB62C256A372CFBC609BA8A2757CB6962A3C1C57BD4DDFC9F0F006F1940352825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b746b63-907d-4c93-b39d-675aed9104e9.tmp

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\1b746b63-907d-4c93-b39d-675aed9104e9.tmp
Size 3KB
SHA256 9814582b6e3f02bb89277dadc630b8e7bc59bde6ce0c9d9d4918c82c045e18a3
MD5 ea5664e15e875f735e37936e2c7dcf2b
SHA1 71200ed7f47f3217679112a90d840f72e6f5f5cf
SHA512 0468a512ed30dae61cadc90c706ae05673e8b31197db025b8d14d743fec5423ddfe10d48d963a1a8c582f3537f8b3c34ba0d5dd4dfb1b68fb48012250d97e67e
TLSH
T1346184366974A93B4DF6DA047D963B26EBA66067F6913F54CAFC0F0D01DB2981301C27
MD5 SHA1 SHA512 TLSH

Submit Download

802bb9b9-a091-495f-9006-02e204908f98.tmp

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\802bb9b9-a091-495f-9006-02e204908f98.tmp
Size 3KB
SHA256 8c4d137004b615b86ea4aab77f94575c47596c50053fe959dce7364efb561b60
MD5 b7a7ea31711ba7b70feca99653562a79
SHA1 669f554355628b7d20da57388ecf65ed4bf5784e
SHA512 184e7e2439e53b68ff0053a1a187dd6bc3a86d0741db7518f311b10f9ae86bdf86aaeede4efdeebd90086cad6c46e2efda5dc0ccd8f83c130c4605439b746bbe
TLSH
T16C81A5266974B93748F6C904B8963B13E7A5A067E6857F98DAFC0F0D01DB39D0342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

83025475-20f6-47c2-b368-9e37d3e5a1cc.tmp

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\83025475-20f6-47c2-b368-9e37d3e5a1cc.tmp
Size 3KB
SHA256 ccc3ed11bf82cc6dd44688518537fffc159401912fb70001a3696e978278b1a9
MD5 830093c3f28bce412707d91c29ef12a4
SHA1 177808eefa881e6ab56b0f27f64810876ccc915e
SHA512 02ad821b548b840a2759894033bb105632959874d041851b0047c9050279bb34d7ea0e5bfbe130be92f2a9bc9f5a055b41e4b0372a67cabc6030275b0651e921
TLSH
T1378185226974B93748F6C9047D963B13E7696067E6857F98DAFC0F0D01DB29D0342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 54e5383d9358f4ac324cc4e3d0224f9cceef7f681da6f1d378f72511602c74ae
MD5 8e4faae197034a31d5295c024f26d82b
SHA1 b0a557b179a79be3bb56e8087a7658cf73af91cb
SHA512 f95569cd96c42babd4d9ae24518cf3a0792286f7d20efaef4c82355e4b41c03ce72ccabcc0c7108342d02318b409d1745c55143a6124d39f136b0c5b7ecfba52
TLSH
T189D012133A020338C4503133510565090A00DA0E814685115428853D2E868646907441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fc3e7a13c8ee95d1a829d828e882133712b03b70423247a51900c4127ff0658a
MD5 678d1c1345c4d4aee5083823180b59a9
SHA1 78af0014ac09e1262558a3e3c743887e71e70ac7
SHA512 3f8bfc586e0751e34b3686a8922b7329f50152da9ca1dedd5cbffa9e0cba37fbea87ac63ff056ababc9509bcf305acfaac55ca1b6e4237fca6ed65cb56c04406
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7b81b84a87a1c4337f1d8cbc4adaf953356160d267e03cc001323e4fd5eeb186
MD5 40d02c6149cec76445bc31f8bd134ac7
SHA1 302662ab728dab2a15bbcafcbf12df4ee2a9b16c
SHA512 ca0d0ec9525155c3f09933647ef48a04b6bb653a1afc3e24bde7aeec3bf7ffe4f191c6895940a7fa95e82db88d9fc7b468b579f930a4040997f0e97916b7915c
TLSH
T1A3D0121336020738C4503033514665090900DB0F804684115428852D2A858642907441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

103e7488-f12c-4f40-b653-f0973c5bffe7.tmp

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\103e7488-f12c-4f40-b653-f0973c5bffe7.tmp
Size 6KB
SHA256 1dcb063ea67895c41dfc1e25abeed3a92e074a963f09fd6f4e5b7b26cf930c6b
MD5 a8fca49dc03ff04dfe1c0633fd693de3
SHA1 21363b709fa2dd0c98fd49bd21d28ae91ea5ea8b
SHA512 73c8aa707c5d453500ce6f3316c388744d9cdc8a61efa7d881153ecc29b5cfe3ee61ad1053b13c43bc6bbd7f0869e6934e5f2b47f9bba5bb2242168a251ba4e8
SSDEEP 96:stb/dz6pG/8bDtQOkido5h16Z0Ws7/x+6MhmuecJsdMkkjevK+gjHkq+e+28XM15:stjpr+QOponWsV+FdsdwjpBwe+G6K
TLSH
T1F7D185065E24797B4CCAE518BA39BB57E2F9607275D02E48EBFC492C04DB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9af32b07-f005-4f21-86e4-d6a74025ecb3.tmp

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\9af32b07-f005-4f21-86e4-d6a74025ecb3.tmp
Size 6KB
SHA256 31bc4c2f2b5d444a1643300157fbb5c7f25b88c5f93f1e55f343e1b3342c8c71
MD5 2b6a102a32f6a62d617568747542a176
SHA1 7c4ff6c4f88fb29b9c8a7ff2af154273338f1478
SHA512 00e523f24878d8f9f10c7e45dea6e76f574a8c34a268b4da45d2200c728dd056c0936755f343a91cec129e25ef5a3f870b416249a9376b809d76c0e46d2fcb37
SSDEEP 96:stb/dz6S/8bDtQOkido5h16Z0Ws7/x+6MhmuecJsdMkkjevK+gule+28XM1C7K:stjp9+QOponWsV+Fdsdwjp2e+G6K
TLSH
T1F0D1A5019E24797B4CCAE518BA39BA57D3FA607275D02E48EBFC492C04DB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d770af9a37eeeaa29ce18282f245d6cdfeec911807abee3f89efea5c33001dbe
MD5 c8f7a0c8f1610ca3b00263725b86c779
SHA1 b0d794b06b1f5e7996fb1987ac5f6b7bd16d5d8c
SHA512 c53b31475375a93010535beb2a304e4a127141c9b436b3314d0007c93cf505972cc0c49c1ea02f465ca253e5f7a96d0301053ec91b1bff64854d6e637326fb77
SSDEEP 6:/F46hXPNAJlycq5IBpRZdSgDAB+5ZFA55YK2PSxF:d4kNAJLq5Ir8B3Dn2C
TLSH
T1C813C97C94423E02C1E511BC9BA7E77017358007F55386131120F4B0A2F7B869B0C716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 03cbf283d2d44c53a7aff9f276698053e587b11a64bbb2d8e32632099d3349f0
MD5 d3162efd152e6573aac10ff7248edbdc
SHA1 efb790b15dc4a8593a05efd7c6a9dab2a4734052
SHA512 175822f1b8481944ae9008dab420c84e7c4343d989e27961cee8277e780a9dd846e17f7f990de68b37b861722e6152b82256088e01be40f218c70bd3b8947e66
SSDEEP 12:U/1UyTJ9khTDFoRS9kh5Svy59kh+2ywE9khkJdtV9khVMo49khI:hIp2ynTwOLpoe
TLSH
T135440B9E8761D008D7A88AF815EC9D3ED31E00E498B62D19DD70ECA144D779D731030D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 cb11184750108c00f7c5948bfb86c6f0b1f2cbe4cb8b63b611bad38d1b66a530
MD5 45e3c0e613a5957c8fd038ab3307a0a9
SHA1 d0353c85dc4f9fc30f1d99953044d5693cff6bf0
SHA512 6572a53a5fe2c8cfc7321bb3b9a044f8f80cd4aa957edfe23493bc89171f0a226e44433fa09df48d5e876c5c6ba6173c4b16f2b8c6427fb74bb38224684878ac
SSDEEP 96:mToulw1AHNetB06ZuFxyK/+YVTO38giFLkvK:mTlaKNet50FgK/+YE3FiFo
TLSH
T1E52572452306428BD6B8CAFCC6430DD95CF6C6C2A7BAC77E240C171906C4A997E6BFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 9abb74b88c6f0c21d753d3b64cd27b2092e8977421f4dbb6e36b463e8996222a
MD5 3ba1d65aabafa1fa16af558b9490e21e
SHA1 54f52db00282125a10f2a3bd531d9fc1f973ad33
SHA512 118508d7fe8e25cdb7882d6c83596ed1c3599dcf36cadd7dd7b503945144c5059f0c9dc94125ddcc6a9e37c1edc3e26b4499340a8544a6641c57c50239031d1d
SSDEEP 1536:1wACQh1CQhbBimRuCQhZK0iCQhQ5CQhhCQhkyaL:1wlsEsbBiWXshsBsIsvaL
TLSH
T1B9169DD64EB1B927EE81CC30AACAC5293F78E6477E815541644589B6C8D0FFC8BDF04A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Cache\Cache_Data\f_000001
Size 152KB
SHA256 3ee981765cfdb02ab2b7ab5976f8747f7a7e86c12223d2029db463713c5cf4c1
MD5 0c08c94281cce888dfb5b2b7dc05cda8
SHA1 ec480c628bb628bc112c12fe6cdc3f977bafe276
SHA512 6cbd09c1e79a63ff0a9695ecc6d6d131b01f796a54fdab5565ad521985c4f472a312cefacdfed9b2e2767788925dfc5c27ec3dfec9d2146e0915e2f43de2ebe6
SSDEEP 3072:D/+xDghk/mwYqburCFwOTtkKkvJv3bEFDGhk0wzmIl6Vmfkxh/e3R144z:T6Do/ibuGNTtkFv93bENWEfemEZ4z
TLSH
T153E312BD8A9C3DAC382106158887335D5C3B11631E5B731A174C8AB8DCAD4DADDF32E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 5cabf1ad06e7f33f5d8eab3f2554f61af82732e6da4a33906a37ce84c0b5be88
MD5 7f905537853e1c779b4b5312b0af39c3
SHA1 017882c573f501a252404dad13e766296b76643f
SHA512 f0bf666d810889cf7c45eddf1ab216d98b908b229dd4b7bfcfa18f86add9d1c13a8cec1b6f546268d807cc0794423fe1f5c4c8047cc5a5ad364ce68eae267189
SSDEEP 3:LsKfltlNllkll/lagSrLll/nZlglZNtlmNtl9lXlmlXl:LsK13lEtPSIkNo
TLSH
T15044023E93A15D05C6C011BCC45B832123B8C409DD1FC3935708F5312CE37645E0F184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 1c6c9c265e97a0e33e98b5c707b68c2ab8998e6174ce79d0c7ab382ab65d9236
MD5 c1a6fad247d856deb4716764d84f55f4
SHA1 7be913b98798862486b56877a6e6fe33a75be26f
SHA512 3b5a500e9e70662d016ee5598e10f7816c8be4796b4d0f512df882b8f16ee91063021740490064f223402f3aea5507229dfff4d9601b53126a78b4850fe9f49d
TLSH
T141B002DD66147517FB293370B1C602E432322C1311A3299A559226BDAAFF3D98249450
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 9141d8c7fb68fd3380cbc54d09df87a3f8eb323ad05669064bfd3d43d8229a19
MD5 3b1fcae78966bb09ec1fa01757fb98e5
SHA1 a615e8ca8e7984d56daa9d6d4edad8e9c2c07a8f
SHA512 8f88d891d699c3e770e5a01f21e766d6cbc17ea4b5f03c791b679ac6f8dd4ccb0bea94dadef03b75629087f506e7e254d40e28a1d37d73472c30ffe5b4e798d2
TLSH
T164C012C4B576710BEF47017170C607E03232088303E30D79C0E16AB89ABB3F982040D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8d6205b555998bb22a9d726ba2075d308f7e8ff985e27c6e3ff50cbd1f7e44ef
MD5 4c1e13cf7107cf21ca9d4027720ac2a0
SHA1 3fa6f683f5624062fb3b0f922df130dad0b51fc5
SHA512 21a68b7ceadbf3950109c40a3b05175210dbf8cec66058a2f40cfd0781614800ff7768f3554b2ef5e1723722ce1177c4b35302cc535bc3d6c2d6fab8e1f1a637
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\History
Size 164KB
SHA256 87f5b49b5902a471a744ce6c4e0d37fa597710988225e7df64bb4af3d44fb792
MD5 073226a1e4057070dada8c4081e8091a
SHA1 5da4fa7dc0faf99faf79506bd7005c481c3b4add
SHA512 b117bf119585e493dffa57f197b068d8fd3c52796aae1ad69ed4581187017fe765cfaf6040b0742632aee311ed11893010f8c3e31a62de43c7ca61a891f1af58
SSDEEP 192:8Bl5qL/tH+bF+UI3iWGVAXWNVVV630KsV:il5qL/tIkUI3ijVAXWNAEBV
TLSH
T127F3EA5E5F643312CDBD923768E745B3597CF03F87236A866C6204B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ebaa2fd-b989-4077-ac30-8b41a1d819cf.tmp

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Network\4ebaa2fd-b989-4077-ac30-8b41a1d819cf.tmp
Size 351B
SHA256 a3b214a7f3c2285dd579aae994d6b1e8e644a5ae23cfdc7b7abd2e0f2481c2c7
MD5 f0e3523443e8b716e9b86b9a620a87e0
SHA1 7d132380280cdedabbe5a95038a029a601eb889f
SHA512 72fee8fbf406697b0694f93c5c134c4278f1d66113964e861ac68a9552ceee173656587ecf5dbcdca361b4e95489c6d994a149af408ce12f0a1fa67a726f9c45
TLSH
T1D5E0D8528579E47A10B80EA70988BA457FB9B8354141D4EDA693832ED0504BB5747062
MD5 SHA1 SHA512 TLSH

Submit Download

5904b8cc-c668-4896-9b41-a16cf243352d.tmp

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Network\5904b8cc-c668-4896-9b41-a16cf243352d.tmp
Size 555B
SHA256 431138ae9b78b466b46babad25cd6a5d1363a15e24579dd257c78429abdec325
MD5 acefd50464cc98f2c168b54be9ddadb6
SHA1 a30ef2e723e6662e55ceb46e5019fef44efe3d7f
SHA512 60bc0d334cde93c411e591b9c216cb45c64a74e73d87c9f029bbebb82d7fa8189df884059a37504947fdf43d5b7d814173c4e26611e54e88eda103122a666758
TLSH
T1E2F05691C6F4C57D4A5127E016347917C92E040591282D27DDF9FBD657E147BD22450F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Network\Network Persistent State
Size 446B
SHA256 d6a74ff8f7357a784ee5d58864c0b9359a5524a254c7394b5fae7a711530821f
MD5 3df6ae5fcc5038ab5ae995c80b01dcb7
SHA1 2138b92efb7451738f73ff5727ed4947b001b064
SHA512 6350d6caf0e77d47d49086a17acc1b2607dc2dc2dc722da5fdfb34f3a3992a3b93ff79872a111d5b46c8b10649adafef97a1d31cf8d1a83a9834455f57eaaa94
TLSH
T137F05C56C2F4A9BD864166B027282D17C6390985A2182D17DAE9BBAD53E20BD972044E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 a692f153c3a724ffa8c9aab920012816cdf770714787886cbc21caf2c5fa6c22
MD5 aaaa9241cc9e522d326346cc167e6191
SHA1 574be21d5ee7c26a870a7e834194e29d09eff15c
SHA512 7731df95044ba5310cf21e41bf9a589ea4b7c0c0fa00248ce78542f3a5ae09ec9a6d93022561eb3bef38d9a7b1be00b784a6ead30a8782ada18efc0aa2657990
TLSH
T1FCC022128878A87600F80FB70A4CB640BAF06472000084EAA682832EC0100BB1602022
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 4f05abcac13cc0b8ff263a4117c67c467a0890f3badf1cf3ca345c2b5dfba522
MD5 214635f0f210c119616e5ebe6471dbf9
SHA1 36478ebdb2edd96904ed3ac20ec63d365d2cf644
SHA512 3e0bdecb4efb459ab2bf856fab87c612c5c39243df241ee3954f123837434dad5d76373b4d05d3c1659ca32687c26c5d29eefb52401850b64a1133ae583198f0
SSDEEP 96:rb/dz6Sob9tQOkido616Z0ms7/x+6MhmuecJNK41ejevK+gQCI8XM1C7K:rjp+QOpo6msV+FdN1Qjpng6K
TLSH
T1DCD197065E24697B4CCAE508BA35BB17D3FD607275D52E48EBFC896C04DA5DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 a56a30197ae0c52452755af8c4301638e7c9290214e9c59aa070f4e53d520765
MD5 ef60511b4fecede0eb6c0015b8f19d54
SHA1 4af14e6a3e0397557c8ebd194e148cf278516103
SHA512 95d03898a29c6de976e1f31318b205433e040cfc02c24b4ac8d2c671ab9233edf5d52c02d4c10bb04b4ff71ad870557fd59633391eb919110f27336f2abd6906
SSDEEP 96:v3iJPlf/ROo1pkF5d1Ui17VaTEv9V5h5pg5+e0yeAvIs3lBj7hCzpbF:6Rvkj9ljw5nj9m
TLSH
T1F7C1C6A30529C574AF488AEBD8397ECB89AB00DF99D9481997E2C08C06C1FFD21DA494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 76ae1109441026df426c97d73b23d13e0d262eaef92eae4d9b184728a5ed8ed3
MD5 146979046a1c3b6a71a6ec31badbd4ba
SHA1 ddf0b51b42774d1e62e91786acfcf5f3753b5cc9
SHA512 eed1d1601e6003d0527162c3fdbbfa6ee7a4a579c4f5f517a8e3ad339743da7ae0f3c521e433e5c6cb623121fad2aab9685c68e27c4aea5cc4616a9a75289174
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Site Characteristics Database\LOG
Size 313B
SHA256 bc6063a0d565a561442c7be7d3999dc9a25114a79358a70f3873a487161ce2b3
MD5 a9e0fdc46b1c49d6efae2a1e9e084d56
SHA1 c0aab369c08f13876fbbdd839f082c9107fb7e02
SHA512 7e5882de956ce7a1fc0374558757d7075c4fe5ec944b776bc8c27a2a75f5ec724ef8e329be9ab2499bf28d912987e2eb5d79476efe8433c0dfb539da5266de71
TLSH
T1CBE0863299EAC627019998AB5373F30CC775A805E6D536292F1DF6D4218F50CB242A40
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Sync Data\LevelDB\LOG
Size 291B
SHA256 2424e9b720458d1baa9be237bd055a2c6d67bd9e26e480175b9a50cf26186a78
MD5 ea3ff6f359c23f0d2c5a5afbbbf7a31f
SHA1 8d0822bbedcb1e2ad099657824a06b1eaac1eed1
SHA512 b2e230c5f909a9c3187115b264fc9ae5600404291e1a013fba6124cf6397d08784a9a4c418447bcc784929e0523fde6d17581e11c67b8f917b1cd92ffde2dfeb
TLSH
T133D0CD72D8EEC5360898C8D782B2BB0DC774DC06D7C1364D5F0CE598248650CB251981
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Default\Visited Links
Size 128KB
SHA256 6d711ac591aa4035d5c01cbbfda0591a9942f473f6ec49e20345d1c9b527f12f
MD5 87e3fbc429b3035689efd9a53aac7f29
SHA1 2e63b7bc1f309ba6c258a278be362242f0ae641c
SHA512 e01a143f2c62afa9c3b757238837e1823ee9dbfae14f05e4c94bc76826ba84c5c39b937925c78cbd08f4cf2357b6f29d89f77f7120799745e7d45086c6376728
SSDEEP 3:ImtVuyi01pIUl:IiVuyF1Tl
TLSH
T112D3044DC1030D0CF11C1031470505474475F05014310D4573740DC7D4441C31133741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Local State
Size 1KB
SHA256 d08ef083d945a8603f99d765f0eddf314cb726561361a87205b4bbba7b270f4a
MD5 24bfa515fd7f010c3f3da4c42925d18a
SHA1 898e52b9a6af809abbfdd6861da7d7fda64631ea
SHA512 84cdc9f615a8f249db3831f0ddb09430b82d4625541aba225238d1a9ecfdc1e222f40a52940022a371f1e125c08b765cc22515b5b3db4045e4ef7b4c435ed24b
TLSH
T1D32192B295246B33ACF9520439A37A679F3270FBA3514F0459EE470D01EB15D9A2683A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Local State
Size 2KB
SHA256 2204c662fd48c7733852592ef1f165da9a7de221002c5694f8067c7444e6b0c9
MD5 448987ac39ef6a88a62424a638573dbf
SHA1 c878c272bbd9ac8a13818a4a236ce4d93fd733af
SHA512 26e11b0ca7fa2fa5a32a3caea2c07318621d51adae8af9219fb4932e958f4422d3ee66f3fcab2d466f087f000c023dc8504fd0f79d835e6f229ec103070fe5b0
TLSH
T13C5165736924AA3789F68A047D973F23CF7AA0A5B7522F109AED0B0D00DB15D1701C3B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\ShaderCache\index
Size 256KB
SHA256 920dc8f7e562b145256119008f9f0c90e1f7408668c8b8241b45642c54ca0e79
MD5 e26acbaa8c0c4ade1e50a258cc1691a7
SHA1 ef347f0ffaf906189330261cbac6d9b8e8d4318a
SHA512 e9541f55fa00500ac33331c44cc3c6422827c846ca7394f1c6f3cc5bff84516b3458a3ab25538b9afb3a17ccb2dfcb3dd6b9c937fb0e4d1d18006e7ada653766
SSDEEP 3:LsOllllklkXlZM:LsUlPZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\ai.toolbay.desktop\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Toolbay.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Toolbay.lnk
Size 1KB
SHA256 8c500c0ba199ee2578d5992421d46470ae6d1d5c528fd4cbb2eac0fd9dacd8f3
MD5 ba1721cfdd050f0cf7128372865e46df
SHA1 804d0ab99c509b0ce1d3047809507f41e426cad0
SHA512 9b7df47d9a4ba3e67d3e956d0d2476060b1551b48d5c51e454f0434480fe7370e41ba9dcce60861a74716f2ffe959ff34db13025c45f6a43b3a7c6afbaf25a3a
TLSH
T1F621F00175F61F72CAF685349AF2A2618138A951BA565F0C408012490CF9B42FF44FDF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\ai.toolbay.desktop\settings.json
Size 58B
SHA256 fd06b27366ba4f1570ee28ad20e2e7bcdf461d1159988ef9a1fb579b33a1516c
MD5 c988e3de2658f32d92599df6de2f4175
SHA1 5361996aa162dbd389712089a440bb584f9d8117
SHA512 1fd80d5abaa103414fe2a40474742b55915283dc6b63041ea9adf05db9d59bf8f95589279a825d524202e6a5b5fec0f4e5cba74efaa42024ab7a02d8bfd7db68
TLSH
T18FA002912D26B51391124733953F69895A95D566018478887B8F5E912858025E507901
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\ai.toolbay.desktop\settings.json
Size 114B
SHA256 22f6cbd8c66393f1bfda020af971a636a624c2215e33b5e4884ff9ff598bd04a
MD5 99a9f287f059948a6d06dbb5f0fae6bb
SHA1 f13812e2a045343a60ab69715b361ef8b022b6a3
SHA512 f8ebfeeb5c8deb850454a4ab59bcaa875627212187b02b453bd7408e8a486d513fe769405a9b4f474de3a6b113337b19d0ccbfddd31be89f9994873178fcfdee
TLSH
T12AB09B511A29671355D146F3966A15450D85996603403C85978F5A611479025D117441
MD5 SHA1 SHA512 TLSH

Submit Download

Toolbay.lnk

Path C:\Users\Admin\Desktop\Toolbay.lnk
Size 1KB
SHA256 02d72606fc2788404e037c559a6a75efcd3cfd647a41fd2b465d463237edd419
MD5 ee128e7dc325923828f9a4c48fc3c300
SHA1 9cfd779adbcb693a1a31f5af2ed04ec4949da7f9
SHA512 d69465b15c0dc4e352db54311228d5805eb8f88f44ed32465986769b6be2ac6e058867447762d88b8aa28f217c8f73cf831f2b46e4fca875d0f90102b944eab6
TLSH
T1F221FC1178F60A72C6F781349AF2A2518138A5526B069E1C4590420908F9B42BF84BCF
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1363382402\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3224_1890271126\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2380-176-0x00007FFA53E40000-0x00007FFA53E41000-memory.dmp

Download

memory/4172-597-0x00007FFA52800000-0x00007FFA52801000-memory.dmp

Download

memory/4172-596-0x00007FFA53120000-0x00007FFA53121000-memory.dmp

Download

memory/5728-74-0x00007FFA53E40000-0x00007FFA53E41000-memory.dmp

Download

memory/5728-423-0x0000021182570000-0x0000021182643000-memory.dmp

Download

memory/5860-801-0x000001C23DD20000-0x000001C23DD21000-memory.dmp

Download

memory/5860-799-0x000001C23DD20000-0x000001C23DD21000-memory.dmp

Download

memory/5860-806-0x000001C23DD20000-0x000001C23DD21000-memory.dmp

Download

memory/5860-810-0x000001C23DD20000-0x000001C23DD21000-memory.dmp

Download

memory/5860-809-0x000001C23DD20000-0x000001C23DD21000-memory.dmp

Download

memory/5860-808-0x000001C23DD20000-0x000001C23DD21000-memory.dmp

Download

memory/5860-807-0x000001C23DD20000-0x000001C23DD21000-memory.dmp

Download

memory/5860-805-0x000001C23DD20000-0x000001C23DD21000-memory.dmp

Download

memory/6020-546-0x0000016ADD2C0000-0x0000016ADD393000-memory.dmp

Download