ea8bb5b759998d781315696a3cdcba0d5bb23a70ce6765e5b0e65a915d2be5b6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Network_Toolkit_1.17.149/Open_Terminal.cmd
Size 108B
Sample261102-jm698aat2n
SHA256 ea8bb5b759998d781315696a3cdcba0d5bb23a70ce6765e5b0e65a915d2be5b6
MD5 8be7ad5e129889c8dcec17b4506b04e8
SHA1 407dbfb871090f0735301e252034c458f5828552
SHA512 1e658fdd7fe4b824ba863e4d448c4b72958d55650c500529235ca677f3bfafd3b61834231b87ae8247a04cf53e2cc70cd2cdd387ebc4d63e486d2dada16843d7
TLSH
T141B012217C312416266B48D098773605742B914EE201C8F260505BAC044FE9DF1CD0C1
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3908	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2412	msedgewebview2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3568	3908	cmd.exe	85
PID 3568 wrote to memory of 2412	3568	Network_Toolkit.exe	86
PID 2412 wrote to memory of 3328	2412	msedgewebview2.exe	89
PID 2412 wrote to memory of 4424	2412	msedgewebview2.exe	90
PID 2412 wrote to memory of 4424	2412	msedgewebview2.exe	90
PID 2412 wrote to memory of 4424	2412	msedgewebview2.exe	90
PID 2412 wrote to memory of 5048	2412	msedgewebview2.exe	92
PID 2412 wrote to memory of 4020	2412	msedgewebview2.exe	93
PID 2412 wrote to memory of 4020	2412	msedgewebview2.exe	93
PID 2412 wrote to memory of 4992	2412	msedgewebview2.exe	95
PID 2412 wrote to memory of 4992	2412	msedgewebview2.exe	95
PID 2412 wrote to memory of 4992	2412	msedgewebview2.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Network_Toolkit_1.17.149\Open_Terminal.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\Network_Toolkit_1.17.149\Network_Toolkit.exe
  "C:\Users\Admin\AppData\Local\Temp\Network_Toolkit_1.17.149\Network_Toolkit.exe" --terminal
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3568.4816.2071790227715283460
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffd2e95b078,0x7ffd2e95b084,0x7ffd2e95b090
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView" --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1736,i,7336270441322070897,18179765502337928242,262144 --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView" --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,7336270441322070897,18179765502337928242,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView" --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,7336270441322070897,18179765502337928242,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView" --webview-exe-name=Network_Toolkit.exe --webview-exe-version=1.17.149 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3592,i,7336270441322070897,18179765502337928242,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

312896de-4629-4c89-9313-723346b5d1cc.tmp

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\312896de-4629-4c89-9313-723346b5d1cc.tmp
Size 2KB
SHA256 2d812ac1a3fbc9f467e967fce0dba697614258dd046ea6bb6b19b4d445bee7a2
MD5 ca10e69c0234a71b958e462d0842580f
SHA1 0e6a8cbf2f2fb1bc0568be4d7cfec755ff06a945
SHA512 e63aa6945acc018bce9ae48633af44b86359829f3d6579e8339f37dd188ab4c94b18ac6d9a61b0382d19f9e7f430caa790906158ff19883982a19bd3dcc7d33b
TLSH
T1A7519473E8887A3769E34A54BD8B3F27EB3550A686522F5066DD0B0C01EB59C3352C2B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 993575f4c565d966db987ca3359de9b8bf79326019e410601641fd212bed1d9f
MD5 5d20a231e186f7a62caa73d4279704ed
SHA1 84f04bab94d2cdcfcab1a42da7d61bed36d8ea36
SHA512 e6241582054580c5ce1195fc10fd9075a3cac3cdb984d4053f21c5a4aa2d09cc38c0aa3594f9bdc5c81e5a315eb39180025e7714936c7f4ce110218b937d24b0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3388e57f5f4d85face203f305d47fbf2558c81400e9b86d192f52e46a86ae9bf
MD5 cb7caa2148719dbf57eb4b7d1db1acc2
SHA1 e08b32401f7efa4e7f506a5529fba0591c6c2fa4
SHA512 5ad84b1bc80f062202b69e0e65442b8aa94ceaab1fad9bc5719e284d863089b0c6d4eb4e8a669736416ec26c5d89ceca872ce91b98b347e98276078965be4efe
TLSH
T100D09B1533014A74D531797312C7EA051D95F11B8306D158E919E66D1D544D40F568D6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 95b29a4c52d6d3a711ddd247dcbffa804f9c2bf051bcdd9e676ba6d945680087
MD5 5c7e0210a9bef606a6f933190fa3dae9
SHA1 2fc3002e9e8ad4db4d30a5d6a73b121c803d3d45
SHA512 fd937c6db8e484cb1c1a28ce3282adb1d79dfe6f2491682ee7b40644e500725486119700d4528db8ba4e8b3a7fbe04733afa1e8b01921f6c5148c691b2cae498
TLSH
T14FD0112A33020238C03030B30083BA080802C20B830A8080E828FBAE2A880A80A23882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 d2c70f115fd2c7c861dd8473c239a1fe11d7ec4889fdbfd8f4bd73f1d46d3fbb
MD5 67f95603251467b6bc865d57324f7f79
SHA1 0c438d07190c413eca9896673ad4ea79005291ec
SHA512 d64bfbab9950fcea79f90940b6160d26d47189e923bbfbfb8af22299d8d60f874ab2f2f05ce3ae6d55317909ef23284d713f287b9e86e0a0891ef6950e98736f
TLSH
T13231327618D01968C35E0EB0C0DEF9C1767D88248477BE7275B6847A952C3E2664483F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 e5c17cc875591505b361bca4c1533e12679a656dc59826398f292c12ceebd2f2
MD5 0d1298fa6233419755d9897bd9d93a0c
SHA1 7b2e93ff807ca778c14c472d9db36f89cc822d2e
SHA512 09e0fd099eab9d37f09b80c1174dc646fe6b71b255de3a082a9463ab0e60fb446bf0b822dc66f623ab8168063700b372b95fb506617ef9181db2903372f4b45c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 05d659ef91462bb2bb26c6e6379771f6053579e5c2e96bcf4a076643c7704e8a
MD5 e7fce1ebc53bab4bf9c69ce0cee98cc9
SHA1 85262b94962da56fddd5e3773d223af16ba0587c
SHA512 aa45047122a46a3b75389d5dcfa97186181290e59316eff48a03533fcac289fabce4b91c91d7fde33207f10c9d5512c0812996f30f17cd458c4bad8f92949f52
SSDEEP 3:LstlNllkll/l/Rnl:LsX3lEt5nl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Local State
Size 1KB
SHA256 6507d63a39954fafcb0c681827cfb3a316c0d327cce42451a8a7c3c346a788b8
MD5 07522ebbc71af976c1b20350bbd3a090
SHA1 418ae870e1432157431251b0621f5f7144e50cd9
SHA512 969149fa01e7e6c528843475c7db613f8e1c5ef4841a840c2c50370a7378672bbe9f413cdd89376d43d362f7554e009e98a743330d70796a3f6d20ada8560e11
TLSH
T1F6211073C8D839727DA24895FA876F8B7F60507B82518E1862DD060913E75DCA677C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\Local State
Size 16KB
SHA256 605c5d5cc5c60d84b60808807e59e98bef28707efd1388cdbc2c940282366dc7
MD5 c6ae6ffde5e5d7e3a5d2fb3812c20b9e
SHA1 f1bd924be2b11ce06ada47cb6be9648a177f5c59
SHA512 ec9cb953f34c283e439928b7141085e4f3717033b15f3fa42bd9ce2a5bbc941a00756404eeb5179fcd8b4b29202f046294a20d3d82eeffcec729887c4c4e722c
SSDEEP 384:z2+OBqImmJvGBLx3NaFMJF93NbRJ5zSj1g6rr:/cvGtlN9tdSj/n
TLSH
T18A729D6618663A232CE7C90ABA8E2B4BDB712153C1D17FD9D9FC8F0E01AB5C42352C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8d25b1e-e89e-4093-b129-39003b1e796a.tmp

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\b8d25b1e-e89e-4093-b129-39003b1e796a.tmp
Size 1KB
SHA256 c9d917e03f1b29720c4004fd6b599a783f7144d10306e6fb731fd2f994252623
MD5 699906c625528ba1c809eb9fb3cb5f2a
SHA1 392365a412b4ddacadd1967c4383d72f27724724
SHA512 2840dbe616cb665b936134cff88404b3153484ecb2c70b8eb24b3149819d11b4f655a5a3149923f3403ca56d6ebbdfbcc980db7e66c843e95dacf14992e6cc91
TLSH
T17F316272D8D83A327C925981BA872F5BBF30107782514E4862DD070812F75DCB636D37
MD5 SHA1 SHA512 TLSH

Submit Download

edabf0ef-f6ba-49ea-8962-77b14b4763ca.tmp

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.WebView2\EBWebView\edabf0ef-f6ba-49ea-8962-77b14b4763ca.tmp
Size 3KB
SHA256 21a1ee640eb5df02ba0ffdeeb66a7d56aa431ee963acca68d0f26e6dbf377ddd
MD5 c414a7c98354f15048e64d6231a2b2df
SHA1 668023f716ceaa5107f8433c46f789fc94e1c2da
SHA512 ed86541a938e3aebaf325aa2398b2c3b23ff8facb7da899a6ba27fefe400c8708d9e1fa5af24abc3b2004e3a93bf036165a95b5da75dde4eed88bd63b4edcc19
TLSH
T109717422A9A8A9275DE29D40B9C62F17F7615177D1913F98D6EC0F0C01E72D82352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Toolkit.instance.json

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.instance.json
Size 173B
SHA256 95aa9740dbb90f684451bfafea8eaf2dc056811865848fc4971dc8a13475aa14
MD5 75ffa4762a74b5fd601d0e65f90670ca
SHA1 35628223c8fe68cf5b71b9686cd84f7c43678b0a
SHA512 c2af28fc0e2ba1d4ab0410357a15f93a658752d7b3fd4b71d5a3128fb6ae5e72be28296f1e29d89f0d08d1917bc2dcfc2244ebfc27a450a05a2abcb0ab9a7f52
TLSH
T1E0C080292D43D497960C56DC45790053DE4E5DD7A42082501C0D5440F5764E71045515
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Toolkit.macros.json

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.macros.json
Size 52B
SHA256 a784157c025ec52e787f5d9fca06fb295744523f6b511607c4a12843f465ce6c
MD5 0591e9c6d22659fcecc09179adc76f66
SHA1 72d2d01152ea990b82945cc80943c7666c253c63
SHA512 ecc90ba75b8a5dac21717171cd6e125cb58cad1d4750fa81753917a32ee14a8423c7b8c0275f2020ad39ddce711551c4f8daa1b39c5c1103a7c38cdbf75d7ac7
TLSH
T15D900220B432547291C167340951C659DB908EF114A17594415F840843695342361112
MD5 SHA1 SHA512 TLSH

Submit Download

Network_Toolkit.settings.json

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.settings.json
Size 30B
SHA256 8c4dae3cadc7ade59f0a31487984a9ef3bbfcada37f74ef294893ef2c03222fb
MD5 af0224d3857fc78a4204b351fd3ad41a
SHA1 1c76df76665ca8785725311456a108ff3abfc406
SHA512 3454c56f25c65d38234081f8044838250df562ffcd159c2f0739435b4ea65631c306591628cb44f78987f783e7828ae872d2d9c220bf1bc8bca72e076649adb1
MD5 SHA1 SHA512

Submit Download

Network_Toolkit.settings.json

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.settings.json
Size 7KB
SHA256 5d04a4e4689958731c45b92e80e40f01e08ad6480817ca4071a6d3ead044ad62
MD5 f9958b32761b5410f130ddaed7ba2cb8
SHA1 16fa6ed8f965fb986be7e6d0e1b41fe0224ff00b
SHA512 559a726589ff53f83f91dae77864de799c12487b0d55dcbc08aca57245707c7f9f84fde163ee6a183ac5de9b503e818b55bb3efff8af258684ccd64f55108352
SSDEEP 96:cgEDvh4GY07+N2cl8A9FXtjF6Vg3hk2jc4j746QBJtTRex03yuzQmffnz1DwGokR:cEXD9FdjFc2BMNsyjF1DHoREfi18
TLSH
T169F18725DC350DB706D5713A587A02036634A5930D1E3C6C778E8A8C1F4EB7F20FA6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network_Toolkit.ssh_known_hosts.json

Path C:\Users\Admin\AppData\Local\NetworkToolkit\Network_Toolkit.Terminal\Network_Toolkit.ssh_known_hosts.json
Size 25B
SHA256 0d696708e74cdae5abf4adee42a30bad769d37391d737b892a49cb3adc3e4370
MD5 f301e80eb6cef3124cc558864571463e
SHA1 34cf2327941bb03b6870949c2ce69fbc79b19f75
SHA512 d1045a76211d0777b02733eadedbecc9b0ee97a277c1d297ff93416d5c60bc14b079a72fde1d73bdddebcf37ed7e09d1b5d4f64586304b254d1c229a75fc141c
MD5 SHA1 SHA512

Submit Download

memory/4020-97-0x00007FFD4A660000-0x00007FFD4A661000-memory.dmp

Download

memory/4020-96-0x00007FFD4ADD0000-0x00007FFD4ADD1000-memory.dmp

Download

memory/4424-40-0x00007FFD4AF70000-0x00007FFD4AF71000-memory.dmp

Download

memory/4992-178-0x00007FFD4AF70000-0x00007FFD4AF71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads