b2fb1a13a9c1cf78c419aacf5edebeb7a49901da64a0a9a739093e1919a78dc5

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ruby-nokey.exe
Size 6.0MB
Sample261107-1anqsafv4x
SHA256 b2fb1a13a9c1cf78c419aacf5edebeb7a49901da64a0a9a739093e1919a78dc5
MD5 c12a56694bacdea28199d979177d56c3
SHA1 393d31d91f9029d57444e774909240b04bb10aec
SHA512 f638c6ee65e10bd20cfc3c4c8b45710ab584a28d1c6086a50c47a6099ee9268518b09d6d11c09cfa0d7fc48c5fd0da9d5726ec890564c432074a8bc4c4721c34
SSDEEP 98304:1hTwdwumUS9j35X5QtZNaDE55X9NQHxUHl7fJNy0LHn+7gfbF5+:uWU1ZNZ5X9NQHxUNby07Kgfj+
TLSH
T11A56AF03F26181E8C46EC578C35AA233EB72788E093472EB1BD45B252F66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ruby-nokey.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4144	tasklist.exe
3600	tasklist.exe
6028	tasklist.exe
5600	tasklist.exe
5964	tasklist.exe
5528	tasklist.exe
4768	tasklist.exe
4224	tasklist.exe
3412	tasklist.exe
4956	tasklist.exe
2372	tasklist.exe
5748	tasklist.exe
3404	tasklist.exe
1188	tasklist.exe
5460	tasklist.exe
3244	tasklist.exe
2752	tasklist.exe
3664	tasklist.exe
5996	tasklist.exe
5496	tasklist.exe
6024	tasklist.exe
1896	tasklist.exe
6140	tasklist.exe
1028	tasklist.exe
3136	tasklist.exe
5092	tasklist.exe
1884	tasklist.exe
4232	tasklist.exe
124	tasklist.exe
2500	tasklist.exe
1952	tasklist.exe
2880	tasklist.exe
5792	tasklist.exe
3520	tasklist.exe
3636	tasklist.exe
1260	tasklist.exe
3104	tasklist.exe
3304	tasklist.exe
5496	tasklist.exe
3708	tasklist.exe
5528	tasklist.exe
4532	tasklist.exe
2300	tasklist.exe
3220	tasklist.exe
1736	tasklist.exe
704	tasklist.exe
2824	tasklist.exe
596	tasklist.exe
4972	tasklist.exe
1740	tasklist.exe
1852	tasklist.exe
632	tasklist.exe
1828	tasklist.exe
4708	tasklist.exe
2808	tasklist.exe
3708	tasklist.exe
3068	tasklist.exe
1436	tasklist.exe
3536	tasklist.exe
4552	tasklist.exe
4516	tasklist.exe
5224	tasklist.exe
3732	tasklist.exe
5772	tasklist.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_2056681325\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_2056681325\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\test.txt	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ruby-nokey.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ruby-nokey.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4256	msedgewebview2.exe
4256	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4580	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	tasklist.exe
Token: SeDebugPrivilege	5528	tasklist.exe
Token: SeDebugPrivilege	704	tasklist.exe
Token: SeDebugPrivilege	4288	tasklist.exe
Token: SeDebugPrivilege	5092	tasklist.exe
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeDebugPrivilege	1788	tasklist.exe
Token: SeDebugPrivilege	5964	tasklist.exe
Token: SeDebugPrivilege	4516	tasklist.exe
Token: SeDebugPrivilege	5224	tasklist.exe
Token: SeDebugPrivilege	5084	tasklist.exe
Token: SeDebugPrivilege	2440	tasklist.exe
Token: SeDebugPrivilege	3604	tasklist.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	2880	tasklist.exe
Token: SeDebugPrivilege	5420	tasklist.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeDebugPrivilege	5528	tasklist.exe
Token: SeDebugPrivilege	704	tasklist.exe
Token: SeDebugPrivilege	3636	tasklist.exe
Token: SeDebugPrivilege	3412	tasklist.exe
Token: SeDebugPrivilege	952	tasklist.exe
Token: SeDebugPrivilege	4632	tasklist.exe
Token: SeDebugPrivilege	4956	tasklist.exe
Token: SeDebugPrivilege	2508	tasklist.exe
Token: SeDebugPrivilege	632	tasklist.exe
Token: SeDebugPrivilege	2372	tasklist.exe
Token: SeDebugPrivilege	1260	tasklist.exe
Token: SeDebugPrivilege	4976	tasklist.exe
Token: SeDebugPrivilege	120	tasklist.exe
Token: SeDebugPrivilege	1188	tasklist.exe
Token: SeDebugPrivilege	1884	tasklist.exe
Token: SeDebugPrivilege	1736	tasklist.exe
Token: SeDebugPrivilege	1420	tasklist.exe
Token: SeDebugPrivilege	5156	tasklist.exe
Token: SeDebugPrivilege	4904	tasklist.exe
Token: SeDebugPrivilege	6136	tasklist.exe
Token: SeDebugPrivilege	4232	tasklist.exe
Token: SeDebugPrivilege	3944	tasklist.exe
Token: SeDebugPrivilege	1828	tasklist.exe
Token: SeDebugPrivilege	4532	tasklist.exe
Token: SeDebugPrivilege	124	tasklist.exe
Token: SeDebugPrivilege	5924	tasklist.exe
Token: SeDebugPrivilege	1972	tasklist.exe
Token: SeDebugPrivilege	236	tasklist.exe
Token: SeDebugPrivilege	3732	tasklist.exe
Token: SeDebugPrivilege	5404	tasklist.exe
Token: SeDebugPrivilege	2808	tasklist.exe
Token: SeDebugPrivilege	764	tasklist.exe
Token: SeDebugPrivilege	3104	tasklist.exe
Token: SeDebugPrivilege	1896	tasklist.exe
Token: SeDebugPrivilege	3128	tasklist.exe
Token: SeDebugPrivilege	4708	tasklist.exe
Token: SeDebugPrivilege	1740	tasklist.exe
Token: SeDebugPrivilege	5032	tasklist.exe
Token: SeDebugPrivilege	6132	tasklist.exe
Token: SeDebugPrivilege	5460	tasklist.exe
Token: SeDebugPrivilege	2216	tasklist.exe
Token: SeDebugPrivilege	3068	tasklist.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	5176	tasklist.exe
Token: SeDebugPrivilege	5772	tasklist.exe
Token: SeDebugPrivilege	2924	tasklist.exe
Token: SeDebugPrivilege	1796	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5140 wrote to memory of 1896	5140	ruby-nokey.exe	90
PID 5140 wrote to memory of 4580	5140	ruby-nokey.exe	92
PID 4580 wrote to memory of 3480	4580	msedgewebview2.exe	93
PID 4580 wrote to memory of 2480	4580	msedgewebview2.exe	94
PID 4580 wrote to memory of 2480	4580	msedgewebview2.exe	94
PID 4580 wrote to memory of 2480	4580	msedgewebview2.exe	94
PID 4580 wrote to memory of 2480	4580	msedgewebview2.exe	94
PID 4580 wrote to memory of 2644	4580	msedgewebview2.exe	95
PID 4580 wrote to memory of 256	4580	msedgewebview2.exe	96
PID 4580 wrote to memory of 256	4580	msedgewebview2.exe	96
PID 4580 wrote to memory of 256	4580	msedgewebview2.exe	96
PID 4580 wrote to memory of 1100	4580	msedgewebview2.exe	97
PID 4580 wrote to memory of 1100	4580	msedgewebview2.exe	97
PID 4580 wrote to memory of 1100	4580	msedgewebview2.exe	97
PID 4580 wrote to memory of 1100	4580	msedgewebview2.exe	97
PID 4580 wrote to memory of 1100	4580	msedgewebview2.exe	97
PID 5140 wrote to memory of 5528	5140	ruby-nokey.exe	98
PID 5140 wrote to memory of 704	5140	ruby-nokey.exe	100
PID 5140 wrote to memory of 4288	5140	ruby-nokey.exe	102
PID 5140 wrote to memory of 5092	5140	ruby-nokey.exe	104
PID 5140 wrote to memory of 2824	5140	ruby-nokey.exe	106
PID 5140 wrote to memory of 1788	5140	ruby-nokey.exe	108
PID 5140 wrote to memory of 5964	5140	ruby-nokey.exe	110
PID 5140 wrote to memory of 4516	5140	ruby-nokey.exe	112
PID 5140 wrote to memory of 5224	5140	ruby-nokey.exe	114
PID 5140 wrote to memory of 5084	5140	ruby-nokey.exe	116
PID 5140 wrote to memory of 2440	5140	ruby-nokey.exe	118
PID 5140 wrote to memory of 3604	5140	ruby-nokey.exe	120
PID 5140 wrote to memory of 4944	5140	ruby-nokey.exe	122
PID 5140 wrote to memory of 2880	5140	ruby-nokey.exe	124
PID 5140 wrote to memory of 5420	5140	ruby-nokey.exe	126
PID 5140 wrote to memory of 2968	5140	ruby-nokey.exe	128
PID 5140 wrote to memory of 5528	5140	ruby-nokey.exe	130
PID 5140 wrote to memory of 704	5140	ruby-nokey.exe	132
PID 5140 wrote to memory of 3636	5140	ruby-nokey.exe	134
PID 5140 wrote to memory of 3412	5140	ruby-nokey.exe	136
PID 5140 wrote to memory of 952	5140	ruby-nokey.exe	138
PID 5140 wrote to memory of 4632	5140	ruby-nokey.exe	141
PID 5140 wrote to memory of 4956	5140	ruby-nokey.exe	143
PID 5140 wrote to memory of 2508	5140	ruby-nokey.exe	145
PID 5140 wrote to memory of 632	5140	ruby-nokey.exe	147
PID 5140 wrote to memory of 2372	5140	ruby-nokey.exe	149
PID 5140 wrote to memory of 1260	5140	ruby-nokey.exe	151
PID 5140 wrote to memory of 4976	5140	ruby-nokey.exe	153
PID 5140 wrote to memory of 120	5140	ruby-nokey.exe	155
PID 5140 wrote to memory of 1188	5140	ruby-nokey.exe	157
PID 5140 wrote to memory of 1884	5140	ruby-nokey.exe	159
PID 5140 wrote to memory of 1736	5140	ruby-nokey.exe	161
PID 5140 wrote to memory of 1420	5140	ruby-nokey.exe	163
PID 5140 wrote to memory of 5156	5140	ruby-nokey.exe	165
PID 5140 wrote to memory of 4904	5140	ruby-nokey.exe	167
PID 5140 wrote to memory of 6136	5140	ruby-nokey.exe	169
PID 5140 wrote to memory of 4232	5140	ruby-nokey.exe	171
PID 5140 wrote to memory of 3944	5140	ruby-nokey.exe	173
PID 5140 wrote to memory of 1828	5140	ruby-nokey.exe	175
PID 5140 wrote to memory of 4532	5140	ruby-nokey.exe	177
PID 5140 wrote to memory of 124	5140	ruby-nokey.exe	179
PID 5140 wrote to memory of 5924	5140	ruby-nokey.exe	181
PID 5140 wrote to memory of 1972	5140	ruby-nokey.exe	183
PID 5140 wrote to memory of 236	5140	ruby-nokey.exe	185
PID 5140 wrote to memory of 3732	5140	ruby-nokey.exe	187
PID 5140 wrote to memory of 5404	5140	ruby-nokey.exe	189
PID 5140 wrote to memory of 2808	5140	ruby-nokey.exe	191
PID 5140 wrote to memory of 764	5140	ruby-nokey.exe	193

C:\Users\Admin\AppData\Local\Temp\ruby-nokey.exe
"C:\Users\Admin\AppData\Local\Temp\ruby-nokey.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ruby-nokey.exe --webview-exe-version=2.0.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5140.3160.7439468176364452355 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView /prefetch:4 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff66605fd8,0x7fff66605fe4,0x7fff66605ff0
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby-nokey.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,8590560896486725968,14431931408157718214,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby-nokey.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=1756,i,8590560896486725968,14431931408157718214,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby-nokey.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1756,i,8590560896486725968,14431931408157718214,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby-nokey.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3456 --field-trial-handle=1756,i,8590560896486725968,14431931408157718214,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby-nokey.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=1756,i,8590560896486725968,14431931408157718214,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby-nokey.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4528 --field-trial-handle=1756,i,8590560896486725968,14431931408157718214,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby-nokey.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=1756,i,8590560896486725968,14431931408157718214,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:5088
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5528
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5964
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5224
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3604
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5420
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5528
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:952
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2508
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:120
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1420
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5156
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6136
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:124
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5924
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:236
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3104
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6132
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5460
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5176
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5772
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1188
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3104
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3304
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:2336
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5748
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3608
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3244
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3220
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2752
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5496
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:2932
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3044
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:632
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2500
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5792
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3664
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:4976
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2808
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:596
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5808
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:6140
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:6012
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5024
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3708
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5996
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:4820
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:268
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5496
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1436
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:2508
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3404
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:632
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4144
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1556
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5792
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1028
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:764
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3520
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4224
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3136
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4972
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5148
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5528
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:6124
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1740
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:4948
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4768
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3600
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3536
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1216
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1436
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5980
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1952
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:6028
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1852
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:6024
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1796
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3376
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1736
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3136
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4552
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5748
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3492
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5768
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1288
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3708
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5996
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5600
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:4736
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8e2ff272-6818-4a82-9009-cadf6869edfb.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\8e2ff272-6818-4a82-9009-cadf6869edfb.tmp
Size 2KB
SHA256 9929d95ebd3b41feb2f5a9dfb4f1e1e14d8f6803a848000ab08501a99bd846c7
MD5 9d0b97de9602865b29127b7783be278e
SHA1 508455e5e11c0a556651c07d8ca75fdb7aca6dcc
SHA512 a094acce53ddade46c36601298030f4f7ed505362dfacf9382b80d23491c5cd9f1be452310d07d64e3e80c6a723a8d3d301ee6d7853d23ea2de15cca6c894587
TLSH
T1FE5194337A34AB3799F696087A4A3A57DD39D061EA112F5186DC0B1801DB62D2381C37
MD5 SHA1 SHA512 TLSH

Submit Download

9c4589fd-a42e-42ba-99dd-981d4c59686b.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\9c4589fd-a42e-42ba-99dd-981d4c59686b.tmp
Size 3KB
SHA256 bbb6d46df9ee3d4a4c01890e6511f2521d498c7a0add0d57b914380e95b3895d
MD5 4221a05579c1cb6a94e097b8b54fd98b
SHA1 c7a6c66f059ca10c19c439205dfdaf091ba3bb2b
SHA512 56ce363767a8a43317b574e726b0c739a82dc075107c2cb46e9c281ae73463da81a635ee890b98e772751dc85cc9c0c75438a2b23f1ba1616e8590db7c9c4bc2
TLSH
T1A16194376A34AA2B5DF6DA04B9862B06BA658033E5903FA5C6EC0F0C01D729D1381C23
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e075e19f278f43bdefe5c474408f61621f7f4f99fd3a34342f601c5420c28047
MD5 7d907bcb6473335db3b07d5e6b64981a
SHA1 8bbf6081d37ca88e4ee4753ea08d7ab6dfce94ee
SHA512 d63cc0558d4db8cde2c53c2404338951a45f2ef7873f0a77b727a474dd7f7575a7718fea986e8dfd8e77cb2ff7f43490110edf9fdebb70da61f04aa145a46290
TLSH
T17BD0121273814738C01120330592734D4840D10FC24541009428891D1E040500D125C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f1c4fa90e787e5b891bcc40b09e5782a23acf1790855f7a516098eef5fae3985
MD5 ea84f3f5ec1dda6d56dedd1cc700655d
SHA1 f25888ae1fe4c55ba335dcbb67159248762d51a0
SHA512 f8cdbf649c9431f7feb8b01c3a43ebf3735f1db99a1d1551403eaf120fb54372a4125f8e543ffc6f3d098a3097d620a9affa1cdeb51121cea7aff4d3d3ff2f85
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

639ccaab-419d-4820-8bcb-6d9616a13338.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\639ccaab-419d-4820-8bcb-6d9616a13338.tmp
Size 6KB
SHA256 e0ad09487990909b1499275434a0155a3176f7d04231b41dd52e90fd2fc6ddcd
MD5 0b70b50147b9c2ce7d3d5ccdcf05e0a0
SHA1 0e0579d74c0cf2bfc3eb84730ed241f0f2435305
SHA512 555f79c426f84b34a73c544eb8e64577bc1852f2650277d262dabced6aa3e08e4e176e4c674d1f7c0f7ba3cf05f8181f418581bbc3fbbd1ab48adfbf14a7295b
SSDEEP 96:st1/dM+N3GbGCb9wkuo5h16Z04s7/x+6MhmuecJeMZ1ejewK+ge28XM1C7K:stpOwWeRon4sV+FdeeQj4cG6K
TLSH
T166D1B7066E247D7B5CDAF109BB25BB47E2F9903161D41E58EBF8462C04EBADC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

685490f3-cc98-44b3-8eba-a14214787ab0.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\685490f3-cc98-44b3-8eba-a14214787ab0.tmp
Size 6KB
SHA256 9bbc8ac98004baa4f9d367181238ac00f2e135c4dcdb5f17a03ba01fc3fa227a
MD5 b09978a643f782b0bd9e00ddb78b810f
SHA1 a8be279c85758b8855191f859329358c4f50491c
SHA512 109efb97c8d03a43afd8be17789fcde99cf0d70b06ab2a4a5a4d5131dc7d91e9587feb55ec50cc89d4d23ef3ee594a52cc818e1e5d59ffb96fd9ab477635c292
SSDEEP 96:st1/dM+N3GUCb9wkuo5h16Z04s7/x+6MhmuecJeMZ1ejewK+gO28XM1C7K:stpOwWcRon4sV+FdeeQj4kG6K
TLSH
T146D1C7066E24797B5CDAF109BA25BB47E2F9903161D11E58EBF8462C04DB6DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 04e92c152a8c33bea56485afa45b7b90cc19405651d4e9c107a8e39852498c22
MD5 88e41a0b27a6eb2e6d016c40698f38a7
SHA1 57968de5f385f93ed7e9f81148d952af41c82b25
SHA512 1c1223451cf78078a79d711b56f0308e3015305bb05558edce3c6530f3c3760607429d8862a01882b94f2d39390fcd6d0549e0c8a9c2985995f00e929024e786
TLSH
T1B9B012300828080DCB000374E7C760E1307C8A0C45B30F014BA0FFF84C147F0915582A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 18c72454ec505e9b38d166abd57399772d044e823898f0ed35a489e8c225f496
MD5 f1632c434f0805f1585f9b453ac9148f
SHA1 d333b72a66ce384e210c19afc62ac4ae602d5eab
SHA512 565b8497932c0706b60bb56c0c3751d2336f37998514784137fddc977505b8447e7e61ce0fcd7fb10b4c08f7d1a1d7f1441fa5526d471bb1f57b63483f589d39
MD5 SHA1 SHA512

Submit Download

0ab50dce-1504-48b5-b5cb-82bcda06c276.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Network\0ab50dce-1504-48b5-b5cb-82bcda06c276.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Local State
Size 1KB
SHA256 415c62b9b2c0c31c2304859419f434595a7139931de020bbbf73ea73e77c0b3a
MD5 b19e0c37415b0addde2250fe6f071983
SHA1 9c41ed2cbd1040f57f3825e712337d71fc188e3f
SHA512 dc16e139ab522e874c69828a0e3b1c47b12155e02a319c72623e11ea830be93dda4592753d89db379d898222ca9c5a311e8d6d1ff273140678acbfc01f856613
TLSH
T1422195B3B6349B32ACFAA25A3212769BAC209076D2101F4191EC8B2811A751E5195C33
MD5 SHA1 SHA512 TLSH

Submit Download

c59cf868-a901-4d8f-b9fc-ad5d256c308c.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\c59cf868-a901-4d8f-b9fc-ad5d256c308c.tmp
Size 15KB
SHA256 90b8e691f974780dc05e54a67a584eb9c551c8fabc85d11454f148a8ab75901a
MD5 630cd1888a67d74e6d3ff22f84dae11c
SHA1 317a64ece1e88342398800a017df2e685630f481
SHA512 361e7e1ac3453e0734c3645c5593a0b3b2eb65984377ac57637add5ff39b15aad66c6714661a3553e19e6962ff2fff04a04d5d554cf27709b0fda9d2a6b15b65
SSDEEP 384:5+OBqImmJvGBLx3NaFMJFNNBSOTWJX1g6rp:UcvGtlNrK5/F
TLSH
T138729D3B29756F672CFB8509BB8A2387CB64A293C0913BE8C9EC8F0F116B4541392815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Infinite Yield.lua

Path C:\Users\Admin\AppData\Roaming\win.ruby.app\library\Infinite Yield.lua
Size 140B
SHA256 6ff936c77d171195f354392912d881e0c928ee8007eb452a7dc26dc3ef84f982
MD5 e569bb72a3692718689df4c2e53acf3b
SHA1 d7882abfc36034d3b12ffac49b767dc394e62f73
SHA512 441874893ea0b19f95e18550ee27cfb06baa59248863cabdd821b4918e75fb6b9f1ce8b26bd88a85972a1e7838e4def386fd2e88f8eccaa4a66ca42741b222be
TLSH
T1E5C02BBF98A392AF0F3208C889833054D634A82CCAB2C0F3D3F80015D0B6849F030400
MD5 SHA1 SHA512 TLSH

Submit Download

UNC Test.lua

Path C:\Users\Admin\AppData\Roaming\win.ruby.app\library\UNC Test.lua
Size 197B
SHA256 c9323187f605828e01c638e2cc2e20c3ed04d16cd2b57850654f5cf9ae7797a2
MD5 3c37762dc154b1169f0f2e8f86cbcea4
SHA1 985cae6b4d350baeeb9b38bc63bc014cebd87e11
SHA512 4f359839edecd313ee3467e3ca30ed4562e96b731c4a657ac83e5b3458d65d4e1b2b075990704d4341973773c51e9be6af6902df2e2606c8a19625723141dba5
TLSH
T1F6D0226E20A0031C6B3E00DDC303BC889322909882409E3EAFFA0C3840026131173BC4
MD5 SHA1 SHA512 TLSH

Submit Download

Untitled #1.lua

Path C:\Users\Admin\AppData\Roaming\win.ruby.app\scripts\Untitled #1.lua
Size 135B
SHA256 cc1b050e84d801bce686400ca3b36719624cc341b5f66d67568852a21e94c9f1
MD5 bf38cb8fadd9ef6e1c3c03e1e7de7a3e
SHA1 7a8883af5e02683f34a867d28af62cf19065c2cf
SHA512 665c5f7c90e5ac7807b5024df0de1da7670bf86be10750ce97f7b7558482e5320d79f21d518a83f93a43bdffbb544cced73a07bf1684812a60a6b02dfd1c6865
TLSH
T19CC09B169C5F50D194D8C8E9E9113158346014B44865E514F517F03DA54DD3E35E1C5D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_1649128074\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4580_2056681325\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/1100-236-0x000001E781CD0000-0x000001E781D77000-memory.dmp

Download

memory/1100-107-0x00007FFF880F0000-0x00007FFF880F1000-memory.dmp

Download

memory/2480-235-0x0000021132910000-0x00000211329B7000-memory.dmp

Download

memory/2480-27-0x00007FFF880F0000-0x00007FFF880F1000-memory.dmp

Download

memory/4256-531-0x0000025E242E0000-0x0000025E242E1000-memory.dmp

Download

memory/4256-529-0x0000025E242E0000-0x0000025E242E1000-memory.dmp

Download

memory/4256-535-0x0000025E242E0000-0x0000025E242E1000-memory.dmp

Download

memory/4256-540-0x0000025E242E0000-0x0000025E242E1000-memory.dmp

Download

memory/4256-538-0x0000025E242E0000-0x0000025E242E1000-memory.dmp

Download

memory/4256-537-0x0000025E242E0000-0x0000025E242E1000-memory.dmp

Download

memory/4256-536-0x0000025E242E0000-0x0000025E242E1000-memory.dmp

Download

memory/4256-539-0x0000025E242E0000-0x0000025E242E1000-memory.dmp

Download

memory/4676-436-0x00007FFF87EC0000-0x00007FFF87EC1000-memory.dmp

Download

memory/4676-437-0x00007FFF870B0000-0x00007FFF870B1000-memory.dmp

Download