3d4ffc3cf393e3733b58a8dcf4a1325c3f4b8a50c3a4dcc7319460eb5a8a0a04

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ruby.exe
Size 6.0MB
Sample261107-ya2ljaex3x
SHA256 3d4ffc3cf393e3733b58a8dcf4a1325c3f4b8a50c3a4dcc7319460eb5a8a0a04
MD5 a0f6def0af49d167b6b53301a4b1d1b5
SHA1 27b1132b87c780df473b19ca07d55b178e2646a6
SHA512 26ffb3895a199db37b71ceb545833b26e46ac7621d10691e1b15bd1a725976ddc097fca1c105716568d82109ec2717a34bbd4cc391d5619b9dd8232dfde782ab
SSDEEP 98304:1hTwdwumUS9j35X5QtZNasoYuHPdNQHxUHl7fJNy0L1n+7gfbF5+:uWU1ZNPoBdNQHxUNby0hKgfj+
TLSH
T11C56AE03F66181E8C46EC178C35AA233EB72788E093471EB1BE45B252F66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ruby.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4288	tasklist.exe
3424	tasklist.exe
2852	tasklist.exe
4088	tasklist.exe
2876	tasklist.exe
5068	tasklist.exe
4508	tasklist.exe
5956	tasklist.exe
4552	tasklist.exe
4072	tasklist.exe
1296	tasklist.exe
5784	tasklist.exe
3700	tasklist.exe
4552	tasklist.exe
2568	tasklist.exe
2140	tasklist.exe
5332	tasklist.exe
5020	tasklist.exe
4492	tasklist.exe
2868	tasklist.exe
5504	tasklist.exe
2708	tasklist.exe
4840	tasklist.exe
2912	tasklist.exe
2716	tasklist.exe
3888	tasklist.exe
6080	tasklist.exe
3320	tasklist.exe
2148	tasklist.exe
4432	tasklist.exe
4620	tasklist.exe
2472	tasklist.exe
5948	tasklist.exe
1488	tasklist.exe
4356	tasklist.exe
1092	tasklist.exe
1560	tasklist.exe
860	tasklist.exe
4552	tasklist.exe
4980	tasklist.exe
5516	tasklist.exe
980	tasklist.exe
3908	tasklist.exe
4608	tasklist.exe
2512	tasklist.exe
720	tasklist.exe
4528	tasklist.exe
3108	tasklist.exe
2352	tasklist.exe
6008	tasklist.exe
3464	tasklist.exe
5828	tasklist.exe
1736	tasklist.exe
3684	tasklist.exe
4632	tasklist.exe
4552	tasklist.exe
3624	tasklist.exe
600	tasklist.exe
6088	tasklist.exe
1736	tasklist.exe
1736	tasklist.exe
5148	tasklist.exe
5124	tasklist.exe
5708	tasklist.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_1377273367\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_1377273367\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_1377273367\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_1377273367\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_1377273367\manifest.json	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ruby.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ruby.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5328	msedgewebview2.exe
5328	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2944	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	tasklist.exe
Token: SeDebugPrivilege	3668	tasklist.exe
Token: SeDebugPrivilege	3424	tasklist.exe
Token: SeDebugPrivilege	4840	tasklist.exe
Token: SeDebugPrivilege	3908	tasklist.exe
Token: SeDebugPrivilege	4508	tasklist.exe
Token: SeDebugPrivilege	6088	tasklist.exe
Token: SeDebugPrivilege	3164	tasklist.exe
Token: SeDebugPrivilege	5516	tasklist.exe
Token: SeDebugPrivilege	1356	tasklist.exe
Token: SeDebugPrivilege	1596	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	3380	tasklist.exe
Token: SeDebugPrivilege	1468	tasklist.exe
Token: SeDebugPrivilege	3392	tasklist.exe
Token: SeDebugPrivilege	2972	tasklist.exe
Token: SeDebugPrivilege	2856	tasklist.exe
Token: SeDebugPrivilege	2912	tasklist.exe
Token: SeDebugPrivilege	756	tasklist.exe
Token: SeDebugPrivilege	2080	tasklist.exe
Token: SeDebugPrivilege	3908	tasklist.exe
Token: SeDebugPrivilege	1812	tasklist.exe
Token: SeDebugPrivilege	5956	tasklist.exe
Token: SeDebugPrivilege	5744	tasklist.exe
Token: SeDebugPrivilege	4288	tasklist.exe
Token: SeDebugPrivilege	2868	tasklist.exe
Token: SeDebugPrivilege	5708	tasklist.exe
Token: SeDebugPrivilege	5732	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	4084	tasklist.exe
Token: SeDebugPrivilege	4356	tasklist.exe
Token: SeDebugPrivilege	5808	tasklist.exe
Token: SeDebugPrivilege	2464	tasklist.exe
Token: SeDebugPrivilege	2972	tasklist.exe
Token: SeDebugPrivilege	4176	tasklist.exe
Token: SeDebugPrivilege	2716	tasklist.exe
Token: SeDebugPrivilege	4608	tasklist.exe
Token: SeDebugPrivilege	5332	tasklist.exe
Token: SeDebugPrivilege	6012	tasklist.exe
Token: SeDebugPrivilege	5524	tasklist.exe
Token: SeDebugPrivilege	4552	tasklist.exe
Token: SeDebugPrivilege	4980	tasklist.exe
Token: SeDebugPrivilege	5948	tasklist.exe
Token: SeDebugPrivilege	5784	tasklist.exe
Token: SeDebugPrivilege	3320	tasklist.exe
Token: SeDebugPrivilege	4072	tasklist.exe
Token: SeDebugPrivilege	4556	tasklist.exe
Token: SeDebugPrivilege	2196	tasklist.exe
Token: SeDebugPrivilege	6008	tasklist.exe
Token: SeDebugPrivilege	3884	tasklist.exe
Token: SeDebugPrivilege	5988	tasklist.exe
Token: SeDebugPrivilege	2780	tasklist.exe
Token: SeDebugPrivilege	2852	tasklist.exe
Token: SeDebugPrivilege	1896	tasklist.exe
Token: SeDebugPrivilege	5440	tasklist.exe
Token: SeDebugPrivilege	1736	tasklist.exe
Token: SeDebugPrivilege	1488	tasklist.exe
Token: SeDebugPrivilege	4088	tasklist.exe
Token: SeDebugPrivilege	5624	tasklist.exe
Token: SeDebugPrivilege	5020	tasklist.exe
Token: SeDebugPrivilege	4632	tasklist.exe
Token: SeDebugPrivilege	5028	tasklist.exe
Token: SeDebugPrivilege	2392	tasklist.exe
Token: SeDebugPrivilege	1560	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 1260	5232	ruby.exe	89
PID 5232 wrote to memory of 2944	5232	ruby.exe	91
PID 2944 wrote to memory of 1876	2944	msedgewebview2.exe	93
PID 2944 wrote to memory of 4448	2944	msedgewebview2.exe	94
PID 2944 wrote to memory of 4448	2944	msedgewebview2.exe	94
PID 2944 wrote to memory of 4448	2944	msedgewebview2.exe	94
PID 2944 wrote to memory of 4448	2944	msedgewebview2.exe	94
PID 2944 wrote to memory of 3188	2944	msedgewebview2.exe	95
PID 2944 wrote to memory of 1072	2944	msedgewebview2.exe	96
PID 2944 wrote to memory of 1072	2944	msedgewebview2.exe	96
PID 2944 wrote to memory of 1072	2944	msedgewebview2.exe	96
PID 2944 wrote to memory of 596	2944	msedgewebview2.exe	97
PID 2944 wrote to memory of 596	2944	msedgewebview2.exe	97
PID 2944 wrote to memory of 596	2944	msedgewebview2.exe	97
PID 2944 wrote to memory of 596	2944	msedgewebview2.exe	97
PID 2944 wrote to memory of 596	2944	msedgewebview2.exe	97
PID 5232 wrote to memory of 3668	5232	ruby.exe	98
PID 5232 wrote to memory of 3424	5232	ruby.exe	100
PID 5232 wrote to memory of 4840	5232	ruby.exe	102
PID 5232 wrote to memory of 3908	5232	ruby.exe	104
PID 5232 wrote to memory of 4508	5232	ruby.exe	106
PID 5232 wrote to memory of 6088	5232	ruby.exe	108
PID 5232 wrote to memory of 3164	5232	ruby.exe	110
PID 5232 wrote to memory of 5516	5232	ruby.exe	112
PID 5232 wrote to memory of 1356	5232	ruby.exe	114
PID 5232 wrote to memory of 1596	5232	ruby.exe	116
PID 5232 wrote to memory of 2352	5232	ruby.exe	118
PID 5232 wrote to memory of 3380	5232	ruby.exe	120
PID 5232 wrote to memory of 1468	5232	ruby.exe	122
PID 5232 wrote to memory of 3392	5232	ruby.exe	124
PID 5232 wrote to memory of 2972	5232	ruby.exe	126
PID 5232 wrote to memory of 2856	5232	ruby.exe	128
PID 5232 wrote to memory of 2912	5232	ruby.exe	130
PID 5232 wrote to memory of 756	5232	ruby.exe	132
PID 5232 wrote to memory of 2080	5232	ruby.exe	134
PID 5232 wrote to memory of 3908	5232	ruby.exe	136
PID 5232 wrote to memory of 1812	5232	ruby.exe	138
PID 5232 wrote to memory of 5956	5232	ruby.exe	140
PID 5232 wrote to memory of 5744	5232	ruby.exe	142
PID 5232 wrote to memory of 4288	5232	ruby.exe	145
PID 5232 wrote to memory of 2868	5232	ruby.exe	147
PID 5232 wrote to memory of 5708	5232	ruby.exe	149
PID 5232 wrote to memory of 5732	5232	ruby.exe	151
PID 5232 wrote to memory of 2352	5232	ruby.exe	153
PID 5232 wrote to memory of 4084	5232	ruby.exe	155
PID 5232 wrote to memory of 4356	5232	ruby.exe	157
PID 5232 wrote to memory of 5808	5232	ruby.exe	159
PID 5232 wrote to memory of 2464	5232	ruby.exe	161
PID 5232 wrote to memory of 2972	5232	ruby.exe	163
PID 5232 wrote to memory of 4176	5232	ruby.exe	165
PID 5232 wrote to memory of 2716	5232	ruby.exe	167
PID 5232 wrote to memory of 4608	5232	ruby.exe	169
PID 5232 wrote to memory of 5332	5232	ruby.exe	171
PID 5232 wrote to memory of 6012	5232	ruby.exe	173
PID 5232 wrote to memory of 5524	5232	ruby.exe	175
PID 5232 wrote to memory of 4552	5232	ruby.exe	177
PID 5232 wrote to memory of 4980	5232	ruby.exe	179
PID 5232 wrote to memory of 5948	5232	ruby.exe	181
PID 5232 wrote to memory of 5784	5232	ruby.exe	183
PID 5232 wrote to memory of 3320	5232	ruby.exe	185
PID 5232 wrote to memory of 4072	5232	ruby.exe	187
PID 5232 wrote to memory of 4556	5232	ruby.exe	189
PID 5232 wrote to memory of 2196	5232	ruby.exe	191
PID 5232 wrote to memory of 6008	5232	ruby.exe	193

C:\Users\Admin\AppData\Local\Temp\ruby.exe
"C:\Users\Admin\AppData\Local\Temp\ruby.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1260
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ruby.exe --webview-exe-version=2.0.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5232.1204.14302956481286835361 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView /prefetch:4 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffa69f85fd8,0x7ffa69f85fe4,0x7ffa69f85ff0
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,4656110178691197794,10450822255119183495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1760,i,4656110178691197794,10450822255119183495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1760,i,4656110178691197794,10450822255119183495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3356 --field-trial-handle=1760,i,4656110178691197794,10450822255119183495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713 /prefetch:1
    3⤵
    PID:596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=1760,i,4656110178691197794,10450822255119183495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4580 --field-trial-handle=1760,i,4656110178691197794,10450822255119183495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView" --webview-exe-name=ruby.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4568 --field-trial-handle=1760,i,4656110178691197794,10450822255119183495,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d29623582675ae7908e93052e10fb5df4b066713
    3⤵
    PID:5140
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4508
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3164
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5516
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1468
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5956
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5744
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5708
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5732
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5808
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5332
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6012
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5524
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5784
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3320
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4072
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6008
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5988
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5440
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4356
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3888
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3340
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5224
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:6080
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:264
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:2936
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4492
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:860
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2876
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:4088
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2512
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:4288
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3504
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5732
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2868
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:4660
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:720
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3700
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3932
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3776
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5328
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1736
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:860
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5148
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4552
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1404
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5020
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5516
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5696
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3320
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:2728
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2708
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3624
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1424
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:4160
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5124
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3700
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3680
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:2972
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4432
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1296
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5032
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3464
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3684
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:2876
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1244
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4552
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3900
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3312
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:980
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4528
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3108
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4620
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:2912
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2568
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:4592
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5828
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5068
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:5144
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:1100
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  PID:3100
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5504
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1736
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3684
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2472
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2148
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4552
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2140
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:600
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 988172e71a443d36ca3f6c9ba05aa17e02eae05a7b3af0d95d125e3df533d54d
MD5 cd7c3842f7b2b9b2edcbb915972a41be
SHA1 e12918ee02d7eccff22508090a95d6e2ca1433da
SHA512 976e0b74e8eeb595174d3b21225492ea34324d0d71634efd379c146a66abc1089269ec8550e4e5ea7224d787d1952f4d626a9c4c5753d6f4fa6c9eb90765ba53
TLSH
T179D0123333110238C0502C73104271080802C51F810DC100582E852D2A088510943452
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cab63d576e2866f068bc2f3fc552ef6458998e646c323d4a57b938dfc8385669
MD5 0227f5aa83bddcc4f1eda5c5887e9939
SHA1 f8f6a856521afd42ae2460b0d1fc3159184caebb
SHA512 145667ec7d1b061713a1079ec53548a1301dfc7344ebd5ab08a6c67ea27a5443a52042caa21fe8cfd72bc465007ba7e5a5a136094d624217b7dfaf4b6f55f950
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

42c12132-a465-407a-aeba-e1afc1b4e4af.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\42c12132-a465-407a-aeba-e1afc1b4e4af.tmp
Size 6KB
SHA256 db1f9a3a877234fdc2e2b65587c6904465752a672151282a6232b78bea50da8d
MD5 c3f544118d96c1160ff3c958317178be
SHA1 49eac7e591bb2c71ab2cb42e5979d6347222f491
SHA512 d5f59fe20787e118591061512f2ecc68c46a1de5976bcfeaa670e1bfe84f07366f90bc7bc352993780b67ef6de00945701b1cb68ded9f584da0a9458f49da27a
SSDEEP 96:stM/dM+No/4b9kkpo5h16Z0ss7/x+6MhmuecJH81ejeMK+gtTj28XM1C7K:stAOw0OonssV+FdH8QjUDTjG6K
TLSH
T153D195019F64797B4CC6E209BA39BA16E2F9A47275D11E58E7F8862C04DB6CC3347D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 7f45a297af6f8ee885b2796a6ffa87ceeea9fedc0e81266e58ac46d58b259b3d
MD5 e8e3e4685717a77f348ac5b7850e8f9b
SHA1 ac777021356327583d550e2ae2607b5c365088f9
SHA512 79a43a71e6f062f1e1d99040bb93ddd0c6355e77d4809e875b6de401a0b0ef365cde3a548210f2466d9fa06a0c9705d4d0ee187f9ae5b4b2900dd1423aa1671e
TLSH
T18EB0123C00284351CF300B785CC7230431F0052042730B93A390E275859D3409B41000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 59416b6c7acfcba04f80252e3156269c65543eb41c56a1b0acbcd14bf3478a8c
MD5 51335bf09aeb75b51f0b62c2cc94b2fa
SHA1 995f4203e1be72a0787fa73d78b9a84841721411
SHA512 4c6083de0c0d104a160fe1c602b1a44c45bf54a525e9a79ee1fd0533bdbe0bb17c03a19d119df3168193fb9911cf788ca9d28f5da49f29e4d89863b6458569bf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e03c4e17-432d-4ab5-9b51-749e11d35a7d.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Network\e03c4e17-432d-4ab5-9b51-749e11d35a7d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

bebb672c-6af8-444c-9521-d9c8df5e7c78.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Default\bebb672c-6af8-444c-9521-d9c8df5e7c78.tmp
Size 6KB
SHA256 47233db0cfae99072f61cb06385aa2e59cf390922fbb42f25ed4c9049869c636
MD5 5f2d9b1d18e9ed0acd1670fe49869589
SHA1 4e3f0f1400a2a0e9e3a370503a7fcdd77833d6d4
SHA512 579983ea0e969ca00ea034f4b7bc7134e924ab40496de823ae76d9b8b3b3e51f8cddd0ae453494872ab41134ba48f5c238c8147ba85d77b0a8e100a5bca97fbf
SSDEEP 96:stM/dM+No+G4b9kkpo5h16Z0ss7/x+6MhmuecJH81ejeMK+gt0j28XM1C7K:stAOwyOonssV+FdH8QjUD0jG6K
TLSH
T1D6D195025F64787B4CC6E109BA39BB17E2F9A47265D11E48E7F8862C04DBADC3247D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\Local State
Size 1KB
SHA256 449a97180232314af86614bcad647d8038d79d917347fa25c26d8cc8af5ca1b3
MD5 9c421978014812947476df9a08dacd44
SHA1 b803013c2f211438bab52055929aa2d8835712f9
SHA512 cb32b63d1da21aacf56f6650757c2f7852693ddbdb14d37c9c485d2bf828fb061370b39b9f359b447ec303ff90ebe3a075dff878849ef41ed0531f6e44ea6cd7
TLSH
T1B421727199602F32BDC6960222076B87AE20917B85114E00B5DE0A0D02D245DB7AED36
MD5 SHA1 SHA512 TLSH

Submit Download

aef0cd80-fc23-46c5-8ce2-75100e1ada9f.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\aef0cd80-fc23-46c5-8ce2-75100e1ada9f.tmp
Size 15KB
SHA256 6baa81a4f4a719717c4125f6028cb7963b0f9e6ef26c1909d0a737ba0e6af4eb
MD5 4e7421229a1f7c7b313c2bf41f237a58
SHA1 7b5d3b7b3d48e6a60483eb8de42d5b2df297fd49
SHA512 7bce0098f87aef24333a11384e8871ea7e423be9dcd2c60ebc159bcc9ac8bdc25b782fecc7b7a9edd926703229c09b1be2157cedbfcc674b0d59b0eaf512d919
SSDEEP 384:V+OBqImmJvGBLx3NaFMJFNNBSRSDiqWMg6rW:4cvGtlNHEiq
TLSH
T15272BE3629796E273CEB89097B8E2787CB64A663C4D13BE8DCEC9F0F016B4442391D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df53780c-d82a-4236-961c-919030095002.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\df53780c-d82a-4236-961c-919030095002.tmp
Size 2KB
SHA256 f233514dc4e9453a900651abfe972bf8f5511863bf313744f9e5795781da576c
MD5 4fe98ac72a5ba9b140fb45ef6ca9b56c
SHA1 7548773d0e10b60ea8698e55fffbf913e9fd9015
SHA512 c132bb89508b17616b29c5d9b5e9352b7f754ea532089bd319161a1e5397be19ea720797b343b565cdb4b96fbb4444f6ed488096b173487274987ea22a364fa9
TLSH
T1F2517532A9246B77A9E68B047A0B3F53DE399176AD522F10AADE0B0C01D395D33C5C77
MD5 SHA1 SHA512 TLSH

Submit Download

fcf7ed89-a638-4d13-8043-05d2cc52e585.tmp

Path C:\Users\Admin\AppData\Local\win.ruby.app\EBWebView\fcf7ed89-a638-4d13-8043-05d2cc52e585.tmp
Size 3KB
SHA256 3960eb86ece65181646578f03f1121fed6d58ffcbcd35747787e27e64ee10eec
MD5 b82d19b86bc67f0f3ab24f896bf3411b
SHA1 5865d80c5711686d3a86891789cf0b6e2caa495a
SHA512 db9e60ef5a85e756cab29580aa17cc66820bfa772efdbe98f24cde1267fd5b6b2db098190102ca5f9d5618a42fc80d0157d912bd911600ca95e060d94a63def9
TLSH
T1846186366974AA3B5EE78A0479463B06FB659137E9913F64DAED0F0C01D369C23C1C17
MD5 SHA1 SHA512 TLSH

Submit Download

Infinite Yield.lua

Path C:\Users\Admin\AppData\Roaming\win.ruby.app\library\Infinite Yield.lua
Size 140B
SHA256 6ff936c77d171195f354392912d881e0c928ee8007eb452a7dc26dc3ef84f982
MD5 e569bb72a3692718689df4c2e53acf3b
SHA1 d7882abfc36034d3b12ffac49b767dc394e62f73
SHA512 441874893ea0b19f95e18550ee27cfb06baa59248863cabdd821b4918e75fb6b9f1ce8b26bd88a85972a1e7838e4def386fd2e88f8eccaa4a66ca42741b222be
TLSH
T1E5C02BBF98A392AF0F3208C889833054D634A82CCAB2C0F3D3F80015D0B6849F030400
MD5 SHA1 SHA512 TLSH

Submit Download

UNC Test.lua

Path C:\Users\Admin\AppData\Roaming\win.ruby.app\library\UNC Test.lua
Size 197B
SHA256 c9323187f605828e01c638e2cc2e20c3ed04d16cd2b57850654f5cf9ae7797a2
MD5 3c37762dc154b1169f0f2e8f86cbcea4
SHA1 985cae6b4d350baeeb9b38bc63bc014cebd87e11
SHA512 4f359839edecd313ee3467e3ca30ed4562e96b731c4a657ac83e5b3458d65d4e1b2b075990704d4341973773c51e9be6af6902df2e2606c8a19625723141dba5
TLSH
T1F6D0226E20A0031C6B3E00DDC303BC889322909882409E3EAFFA0C3840026131173BC4
MD5 SHA1 SHA512 TLSH

Submit Download

Untitled #1.lua

Path C:\Users\Admin\AppData\Roaming\win.ruby.app\scripts\Untitled #1.lua
Size 135B
SHA256 cc1b050e84d801bce686400ca3b36719624cc341b5f66d67568852a21e94c9f1
MD5 bf38cb8fadd9ef6e1c3c03e1e7de7a3e
SHA1 7a8883af5e02683f34a867d28af62cf19065c2cf
SHA512 665c5f7c90e5ac7807b5024df0de1da7670bf86be10750ce97f7b7558482e5320d79f21d518a83f93a43bdffbb544cced73a07bf1684812a60a6b02dfd1c6865
TLSH
T19CC09B169C5F50D194D8C8E9E9113158346014B44865E514F517F03DA54DD3E35E1C5D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_1377273367\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_550648236\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

memory/596-80-0x00007FFA8AA20000-0x00007FFA8AA21000-memory.dmp

Download

memory/3340-415-0x00007FFA89C80000-0x00007FFA89C81000-memory.dmp

Download

memory/3340-414-0x00007FFA8A7D0000-0x00007FFA8A7D1000-memory.dmp

Download

memory/4448-27-0x00007FFA8AA20000-0x00007FFA8AA21000-memory.dmp

Download

memory/5328-529-0x0000028ADF210000-0x0000028ADF211000-memory.dmp

Download

memory/5328-528-0x0000028ADF210000-0x0000028ADF211000-memory.dmp

Download

memory/5328-527-0x0000028ADF210000-0x0000028ADF211000-memory.dmp

Download

memory/5328-525-0x0000028ADF210000-0x0000028ADF211000-memory.dmp

Download

memory/5328-524-0x0000028ADF210000-0x0000028ADF211000-memory.dmp

Download

memory/5328-526-0x0000028ADF210000-0x0000028ADF211000-memory.dmp

Download

memory/5328-518-0x0000028ADF210000-0x0000028ADF211000-memory.dmp

Download

memory/5328-520-0x0000028ADF210000-0x0000028ADF211000-memory.dmp

Download