327ae7b8c0c51e3b6688c50ccddbdaf9ac7273fcf389f145942009f63f14cf7d

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Network_Toolkit_1.17.149/Network_Toolkit.exe
Size 20.1MB
Sample261102-jm698aat2n
SHA256 327ae7b8c0c51e3b6688c50ccddbdaf9ac7273fcf389f145942009f63f14cf7d
MD5 5366ae8a15578079d000c03b902fcd11
SHA1 d56a236ec157b2ad639ee427b2bbcbf48a4536df
SHA512 dc0757bababca5800c986df8f06d5738bfbf6fe3cbda02655431468ea9cdaee8c5ec3002b6ef83264246d346c83f272e8809de2662f2cce860a5007ec2416543
SSDEEP 196608:aQl9yx50P/p4nP8Gjtzm7qprVdW1oargU9/h:aeyx50P/mkGjtzmGhdW1oarj/
TLSH
T1F5279D53FA6914E2C1AEC171C5738202B7713C48672123D7AB64EA643F77BD06EBA724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Network_Toolkit.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
11	api.ipify.org
13	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Network_Toolkit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Network_Toolkit.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1204	powershell.exe
1204	powershell.exe
1204	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1880	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeIncreaseQuotaPrivilege	1204	powershell.exe
Token: SeSecurityPrivilege	1204	powershell.exe
Token: SeTakeOwnershipPrivilege	1204	powershell.exe
Token: SeLoadDriverPrivilege	1204	powershell.exe
Token: SeSystemProfilePrivilege	1204	powershell.exe
Token: SeSystemtimePrivilege	1204	powershell.exe
Token: SeProfSingleProcessPrivilege	1204	powershell.exe
Token: SeIncBasePriorityPrivilege	1204	powershell.exe
Token: SeCreatePagefilePrivilege	1204	powershell.exe
Token: SeBackupPrivilege	1204	powershell.exe
Token: SeRestorePrivilege	1204	powershell.exe
Token: SeShutdownPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeSystemEnvironmentPrivilege	1204	powershell.exe
Token: SeRemoteShutdownPrivilege	1204	powershell.exe
Token: SeUndockPrivilege	1204	powershell.exe
Token: SeManageVolumePrivilege	1204	powershell.exe
Token: 33	1204	powershell.exe
Token: 34	1204	powershell.exe
Token: 35	1204	powershell.exe
Token: 36	1204	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 1880	5792	Network_Toolkit.exe	89
PID 1880 wrote to memory of 5676	1880	msedgewebview2.exe	90
PID 1880 wrote to memory of 6004	1880	msedgewebview2.exe	91
PID 1880 wrote to memory of 6004	1880	msedgewebview2.exe	91
PID 1880 wrote to memory of 6004	1880	msedgewebview2.exe	91
PID 1880 wrote to memory of 6004	1880	msedgewebview2.exe	91
PID 1880 wrote to memory of 5708	1880	msedgewebview2.exe	92
PID 1880 wrote to memory of 6060	1880	msedgewebview2.exe	93
PID 1880 wrote to memory of 6060	1880	msedgewebview2.exe	93
PID 1880 wrote to memory of 6060	1880	msedgewebview2.exe	93
PID 1880 wrote to memory of 1152	1880	msedgewebview2.exe	94
PID 1880 wrote to memory of 1152	1880	msedgewebview2.exe	94
PID 1880 wrote to memory of 1152	1880	msedgewebview2.exe	94
PID 1880 wrote to memory of 1152	1880	msedgewebview2.exe	94
PID 1880 wrote to memory of 1152	1880	msedgewebview2.exe	94
PID 5792 wrote to memory of 1204	5792	Network_Toolkit.exe	95

C:\Users\Admin\AppData\Local\Temp\Network_Toolkit_1.17.149\Network_Toolkit.exe
"C:\Users\Admin\AppData\Local\Temp\Network_Toolkit_1.17.149\Network_Toolkit.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5792.4828.8964883269098393071 /pfhostedapp:9efc14e2f3e1cdfbf05cbc261a9b16639f6352a0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView /prefetch:4 /pfhostedapp:9efc14e2f3e1cdfbf05cbc261a9b16639f6352a0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x164,0x188,0x18c,0x108,0x194,0x7ffb0b825fd8,0x7ffb0b825fe4,0x7ffb0b825ff0
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView" --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1684 --field-trial-handle=1708,i,7955753508179491682,1368836332404096802,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:9efc14e2f3e1cdfbf05cbc261a9b16639f6352a0
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView" --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2008 --field-trial-handle=1708,i,7955753508179491682,1368836332404096802,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:9efc14e2f3e1cdfbf05cbc261a9b16639f6352a0
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView" --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1708,i,7955753508179491682,1368836332404096802,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:9efc14e2f3e1cdfbf05cbc261a9b16639f6352a0
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView" --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3512 --field-trial-handle=1708,i,7955753508179491682,1368836332404096802,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:9efc14e2f3e1cdfbf05cbc261a9b16639f6352a0 /prefetch:1
    3⤵
    PID:1152
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwAKACQAUAByAG8AZwByAGUAcwBzAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACcACgB0AHIAeQAgAHsACgAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdABwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwBdADoAOgBuAGUAdwAoACQAZgBhAGwAcwBlACkACgAgAEkAbQBwAG8AcgB0AC0ATQBvAGQAdQBsAGUAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABQAFMASABPAE0ARQAgACcATQBvAGQAdQBsAGUAcwBcAE4AZQB0AEEAZABhAHAAdABlAHIAXABOAGUAdABBAGQAYQBwAHQAZQByAC4AcABzAGQAMQAnACkAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAACgAgACQAcgBvAHcAcwAgAD0AIABAACgATgBlAHQAQQBkAGEAcAB0AGUAcgBcAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0ASQBuAGMAbAB1AGQAZQBIAGkAZABkAGUAbgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AAoAIAAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AGkAZAA9ACgAWwBnAHUAaQBkAF0AJABfAC4ASQBuAHQAZQByAGYAYQBjAGUARwB1AGkAZAApAC4AVABvAFMAdAByAGkAbgBnACgAJwBCACcAKQA7AGkAbgBkAGUAeAA9AFsAdQBpAG4AdAAzADIAXQAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBJAG4AZABlAHgAOwBuAGEAbQBlAD0AWwBzAHQAcgBpAG4AZwBdACQAXwAuAE4AYQBtAGUAOwBkAGUAcwBjAHIAaQBwAHQAaQBvAG4APQBbAHMAdAByAGkAbgBnAF0AJABfAC4ASQBuAHQAZQByAGYAYQBjAGUARABlAHMAYwByAGkAcAB0AGkAbwBuADsAYQBkAG0AaQBuAD0AWwB1AGkAbgB0ADMAMgBdACQAXwAuAEkAbgB0AGUAcgBmAGEAYwBlAEEAZABtAGkAbgBTAHQAYQB0AHUAcwA7AG8AcABlAHIAPQBbAHUAaQBuAHQAMwAyAF0AJABfAC4ASQBuAHQAZQByAGYAYQBjAGUATwBwAGUAcgBhAHQAaQBvAG4AYQBsAFMAdABhAHQAdQBzADsAdAB5AHAAZQA9AFsAdQBpAG4AdAAzADIAXQAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBUAHkAcABlADsAZgBpAGwAdABlAHIAPQBbAGIAbwBvAGwAXQAkAF8ALgBJAE0ARgBpAGwAdABlAHIAOwBlAG4AZABwAG8AaQBuAHQAPQBbAGIAbwBvAGwAXQAkAF8ALgBFAG4AZABQAG8AaQBuAHQASQBuAHQAZQByAGYAYQBjAGUAOwBsAG8AYwBrAGUAZAA9AFsAYgBvAG8AbABdACQAXwAuAEEAZABtAGkAbgBMAG8AYwBrAGUAZAB9AAoAIAB9ACkACgAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHUAdAAuAFcAcgBpAHQAZQAoACgATQBpAGMAcgBvAHMAbwBmAHQALgBQAG8AdwBlAHIAUwBoAGUAbABsAC4AVQB0AGkAbABpAHQAeQBcAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJAByAG8AdwBzACAALQBDAG8AbQBwAHIAZQBzAHMAIAAtAEQAZQBwAHQAaAAgADMAKQApAAoAfQAgAGMAYQB0AGMAaAAgAHsAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoARQByAHIAbwByAC4AVwByAGkAdABlAEwAaQBuAGUAKAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQA7ACAAZQB4AGkAdAAgADEAIAB9AAoA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7b47e6ac-8a16-44b8-a132-3cc35f90bb77.tmp

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\7b47e6ac-8a16-44b8-a132-3cc35f90bb77.tmp
Size 2KB
SHA256 c0dee7cda1fd2f4295da84119d37006d4d466e83cd701de5ae323ba6bda6d41b
MD5 2350de9fe91499f010cbbd8bead2d14d
SHA1 063bafc4d331d82ea3f053fd8c369fe1ed3764e7
SHA512 cea0f23adf16eaf98f4e3f7c61a43b3b1ad1d1702717aa56f035f5e7673fb2e2d36bbdc26359e480ac7685d05d8991d464c625433edb905833dec5b3b6c73119
TLSH
T1EC51A733A918AB37D9A28B19795B3F23DF36A052AA522F50ABDD0B1800C715C2381C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e82783aec6a654de32d6d360ca5ef71a50ef221cf08125fb7eb1a6e01ccdfec4
MD5 85f8e84d34857f7b8756dce426d1637a
SHA1 5131f1ddac737cfea585080cbcbcfb7e18071be1
SHA512 d71008534bc2acf9c5e6c26f72b2062204aea102d9c29ade6627fc579ac54d10671199783baf50dfcd3e35b9a7a5a8f88cfe84ca7b57e1aa9962286b892e433c
TLSH
T1A7D0121772410134C41030734012B1486C81C60B444DC0046439D71F5A444582A1A8D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 141e1656eb30fb2abdc4500971951272205278ac21605acf1e18e5b77f483e4a
MD5 55aa2b3379d8d33164c68c973c940a19
SHA1 b7f4cc6bdb78f327d52f8aa22ab1306b3f2ccf8b
SHA512 b7468acf86f9b1e771cff0aa1461834078f1b1b1a63b2f34ac2c4540aa6dd5fbc7f266f1984cf444f354b6605fa935337c7412695483018c0da03d72491ab44e
TLSH
T1C4D00455D1400001C5017071C030F150FDC14D001C4DC5041031530744C040D315D4D4
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 28c18c6b8ee74d9578dfc74c5cce562dab72d6d473b656c0e4c591abd2f2603a
MD5 5440ddc74967937d3e77eb8ab530856a
SHA1 bc8b00bd9cceae5e1596d7fb14be99ea173c0d01
SHA512 da06daf8bd9e1399df02c877e2937d4956484ee44960d086948ca5129a8657761769d4bff7b753af032737a0b54ef707b4bbcec49e517ec7d5a3bb356dca534b
TLSH
T1D731941480A1339DC7234C7249DE1704FEBC441980372C76BA98A037853EF3961A469F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5ab12639b07cb0e8dc71406345adc11f0f42784a6156eef96194858cf9f9510e
MD5 873eedc03a28972cce3ddc96dd4a68d6
SHA1 19528e06433cfd9b7a5e74c0ec7db9e58d5f6b12
SHA512 b9ba2cdea7a3eef1aa4508fd730a84736eb10eb989cf4a6c39591b5df955131fb073ab86f15bc21d3b59bc3274fa6e0e81d74012cf08659ec39ff919c6efeaf8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\Local State
Size 1KB
SHA256 6d68e998726ec54cbc73631e15f8e6f6b9909527ef533dbb78d06a7baf864862
MD5 3e8038f0acbd341e0f8d6f9d19897f53
SHA1 e66c08bcf7c079edae4da3805ef7405b81ba081e
SHA512 3e372c7b3be84eed4a6533eae5542c9c3de3652b06efd38923990dfcc5593b784559a4731c5fa470809a812a16ad8ad2028acd2a84f5df4e928605eeb8ce40de
TLSH
T120218472E9689F36FC52978632277F275F21A05B92418F04B6DD0B1802D718CA2AAC32
MD5 SHA1 SHA512 TLSH

Submit Download

ce984cf5-958b-48df-b6d8-f871d66913fd.tmp

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\ce984cf5-958b-48df-b6d8-f871d66913fd.tmp
Size 3KB
SHA256 0673de0fb9d2165e559c83e6385ea540187795e734c890d9a603b798090b76da
MD5 9471d91dd90475e796319db1cb64d67e
SHA1 4e05ca27ea70f2a3d949771471b3a41ffa2b47f4
SHA512 e4271665fb58aee40a2226725e2fe0e7cd687698a23145d799de48b299e5aaab0794527f29bc9e7ef5c63be18a2ec423369055bf9b0e2a8857dec0c89573b147
TLSH
T186616637A965AA3B9DE29A1579873B17ABA59027E5813F95EAEC0F0C01C728C1381C17
MD5 SHA1 SHA512 TLSH

Submit Download

de87f367-e331-4a76-902e-fb9bab186d1d.tmp

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.WebView2\EBWebView\de87f367-e331-4a76-902e-fb9bab186d1d.tmp
Size 3KB
SHA256 2a52fd0ef68f77805d3bb6f73d0607f47eb93e75288750c08d19ab7ce34552e3
MD5 de38dfd548825a4adce1958f49572e8c
SHA1 7903982fb5572a9e90d82d071124ac4cb1ccaa0f
SHA512 c3c46346d6bb3dc8fb13151fc465ee542acea768e95933d3525c58cf820fd52e95564280ad852b4ec23449c1cba6ec6270878c2eeae21ff0f88b200a27143f44
TLSH
T11381933269B5A9379DF2CA09794B3F17AB65A013A5857F95DAFC0F1C01C72CD1382C16
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Toolkit.settings.json

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.settings.json
Size 7KB
SHA256 8f647b5753e91fd024e820508cde4038cfa38ddab22d57a504831c912eb7f529
MD5 7a24d23ae408bafe1f5d99524720cfe6
SHA1 d0697bc4ff08b1c9a1074003a3932387572df79a
SHA512 cd870c4d6a3f2c1ebb3fadec6311f39fc41be1e4a52e3ae9371f5d4b82c305a7dc3e7a807dfb29f802b4403bb5da1364f9cae799d67ce339a92c46855a247eac
SSDEEP 96:cNEDvh4GY07+N2cl8A9FXtjF6Vg3hk2jc4j746QBJtTRex03yuzQmffnz1DwGokR:cvXD9FdjFc2BMNsyjF1DHoREfi18
TLSH
T182F18825DC340DB706D5713A587A02036634A5934D1E3C6C778E8A8C1F4EB7F20FA6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-112-0x00007FFB2C230000-0x00007FFB2C231000-memory.dmp

Download

memory/1204-248-0x00000184845B0000-0x00000184845D2000-memory.dmp

Download

memory/1204-253-0x000001849CC80000-0x000001849CE42000-memory.dmp

Download

memory/1204-254-0x000001849D380000-0x000001849D8A8000-memory.dmp

Download

memory/6004-25-0x00007FFB2C230000-0x00007FFB2C231000-memory.dmp

Download