57341e593a7fdeaae093825573de58fca8248d0f6347333269cdee4cd6987ba8

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe
Size 4.0MB
Sample260704-mtfbvsev4y
SHA256 57341e593a7fdeaae093825573de58fca8248d0f6347333269cdee4cd6987ba8
MD5 18575497e4fe2142cd4b20200438d719
SHA1 2091fa468db7c1fd36ad934588dfc0ca21dd8b2a
SHA512 a6b140fd0a367488899a20a123400c58dc7a5b47acbbf624374e9155598eb6c65f93d8e6be4c4c97238d74edabc4ae0061e85b57efddfdf543622236dd833378
SSDEEP 98304:gKFAq/zYu6ZpHvcLrIr0N5oDZ9lwsNmo7cEfUk1:gKiqcJ9vW0QN5ozlwocEMk
TLSH
T17C16F164B7A61264E0B3C6384EE3C336FA76B8052F35D6CF72A645290E137F0593A752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_2046965563\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_2046965563\protocols.json	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1868417328\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1868417328\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1868417328\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_2046965563\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1868417328\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1868417328\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4680_1941653719\ranked_dicts	msedgewebview2.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5656	msedgewebview2.exe
5656	msedgewebview2.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4680	msedgewebview2.exe
4680	msedgewebview2.exe
4680	msedgewebview2.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4680	2476	2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe	88
PID 4680 wrote to memory of 5436	4680	msedgewebview2.exe	89
PID 4680 wrote to memory of 1260	4680	msedgewebview2.exe	90
PID 4680 wrote to memory of 1260	4680	msedgewebview2.exe	90
PID 4680 wrote to memory of 1260	4680	msedgewebview2.exe	90
PID 4680 wrote to memory of 1260	4680	msedgewebview2.exe	90
PID 4680 wrote to memory of 3596	4680	msedgewebview2.exe	91
PID 4680 wrote to memory of 5020	4680	msedgewebview2.exe	92
PID 4680 wrote to memory of 5020	4680	msedgewebview2.exe	92
PID 4680 wrote to memory of 5020	4680	msedgewebview2.exe	92
PID 4680 wrote to memory of 5876	4680	msedgewebview2.exe	93
PID 4680 wrote to memory of 5876	4680	msedgewebview2.exe	93
PID 4680 wrote to memory of 5876	4680	msedgewebview2.exe	93
PID 4680 wrote to memory of 5876	4680	msedgewebview2.exe	93
PID 4680 wrote to memory of 5876	4680	msedgewebview2.exe	93
PID 4680 wrote to memory of 4812	4680	msedgewebview2.exe	94
PID 4680 wrote to memory of 4812	4680	msedgewebview2.exe	94
PID 4680 wrote to memory of 4812	4680	msedgewebview2.exe	94
PID 4680 wrote to memory of 4812	4680	msedgewebview2.exe	94
PID 4680 wrote to memory of 4812	4680	msedgewebview2.exe	94
PID 4680 wrote to memory of 5900	4680	msedgewebview2.exe	95
PID 4680 wrote to memory of 5900	4680	msedgewebview2.exe	95
PID 4680 wrote to memory of 5900	4680	msedgewebview2.exe	95
PID 4680 wrote to memory of 5900	4680	msedgewebview2.exe	95
PID 4680 wrote to memory of 5900	4680	msedgewebview2.exe	95
PID 4680 wrote to memory of 4424	4680	msedgewebview2.exe	99
PID 4680 wrote to memory of 4424	4680	msedgewebview2.exe	99
PID 4680 wrote to memory of 4424	4680	msedgewebview2.exe	99
PID 4680 wrote to memory of 1324	4680	msedgewebview2.exe	100
PID 4680 wrote to memory of 1324	4680	msedgewebview2.exe	100
PID 4680 wrote to memory of 1324	4680	msedgewebview2.exe	100
PID 4680 wrote to memory of 5656	4680	msedgewebview2.exe	101
PID 4680 wrote to memory of 4976	4680	msedgewebview2.exe	102
PID 4680 wrote to memory of 4976	4680	msedgewebview2.exe	102
PID 4680 wrote to memory of 4976	4680	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --user-data-dir="C:\Koyke\cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2476.6032.7512989387958288061 /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Koyke\cache\EBWebView /prefetch:4 /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Koyke\cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x16c,0x7ff999965fd8,0x7ff999965fe4,0x7ff999965ff0
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2104 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2204 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3636 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a /prefetch:1
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4284 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a /prefetch:1
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1076 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5076 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5056 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Koyke\cache\EBWebView" --webview-exe-name=2026-07-04_18575497e4fe2142cd4b20200438d719_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4044 --field-trial-handle=1744,i,9713998533504919331,4210838701361440111,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ca8e4528800bac86a6f1bdcb394f60d6c737928a
    3⤵
    PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Koyke\cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9e1ccde37b5830b9396dc46e522c2c96f0d35e368cf3b887904f189faeaf1f72
MD5 da343edf1e99d28f131beab946b0371e
SHA1 d56c654ee035f5541d35a4889074403dc6362969
SHA512 e139ae92861485e5314b55dabdc42ef48742e4ce5b3f1f0d765d2b473c7ef98e6becef8f5378170ebf88000962d78ac88580b205028359c37037753441c61e7f
TLSH
T180D01212B6020534C5B131731003710C0800E11B404540046928852D1A048581906841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Koyke\cache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 26b4145f043cd3430c5f6b094b93199847e7bce81904616fc01985fefd327a2b
MD5 aa603f20f85091c774fdace0b202a078
SHA1 648c19db05026d97e6657dded5f9ec7889519cb4
SHA512 7c00d1ee87355b4487afe11412e968ac73d34040688aa8144ec686780edafc8ecf177a925f7ffae29e18020762bcb42bca46a5ab487b03ba0d8611663d62d169
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Koyke\cache\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Koyke\cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 32382cb8c775ce31d0e8d874afc3afd65e431ed91399c8c2f67feb583ff4a2f8
MD5 02eb9a1dff0509512a412a89d8cb1404
SHA1 f7dcbb415545191b40fe8e0e8c5182ae4424ba1f
SHA512 8ad49a9741da289b1187fa9df47452277158ef844968515b64ed79131207ef9d6055e3c40ed28942cd6fcdc797d38d1c2c89d6d794d0765ac4473c0b2f84755d
TLSH
T1AFA0026206661983C91D037025D1175076356821060FA602A09406E9D8E0351868605D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591534.TMP

Path C:\Koyke\cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe591534.TMP
Size 48B
SHA256 23fba74953b32255805905753837492d260b2148d84dd250ad0cfa5dd9641467
MD5 8338a078b769ec29d24a9477b37d50ea
SHA1 cc5fb138e601c81d7904a038a0b79b30125d441f
SHA512 283a187d2f4ec7802fa6b5a740c34aef6fcec3cd6dcb82c61363ae911694da90c51de4f0a56d2905eff625b9a096455486ea484c9452dc7176996512ee067df2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Koyke\cache\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Koyke\cache\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Koyke\cache\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Koyke\cache\EBWebView\Default\Network\Network Persistent State
Size 1010B
SHA256 eb267c17efc2ecff8317880a43d5d106a0a6cf862d4008f036b7a52291fd2600
MD5 1994f98bb64cd8501d49f4846901dd0d
SHA1 ed833687f5bd3458c855c48c922a89b4a643e1f6
SHA512 41cfdd1a39e49905c041a5c12e1eaf7ed6b60194205f20f0487d2d8f40e07463f7f6a1c49b9ddd7db18bc38b813804b58f92b6472f50a8d164b12e5587f706fd
TLSH
T140117FA2C2E94B7D4D6203F42BA46A2BCE6D050843187E37DFD5EB4F53E1175D101A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe599735.TMP

Path C:\Koyke\cache\EBWebView\Default\Network\Network Persistent State~RFe599735.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Koyke\cache\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Koyke\cache\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 4c2c7f017ac602ba902426d554ef523a3359c8da051200c67d178b87ab0afe42
MD5 7c39b775e59fe6aa650f1b37aaf71475
SHA1 89c5d5e40f36e5df8ae58640e2900b1c48ced9db
SHA512 53c9d577033ef146ddca3e7a8baf5d3a4e9831df1896341bf1262adc69563e5e81f2d38ec2f52c56ba07ea618aa0266873e0cc5ced9dbcfc0e971d364bdfab42
TLSH
T1CAC022E240BDE0BA207805AE49806D085F3AB03A518058F8E1438238D0908AA4103002
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58f037.TMP

Path C:\Koyke\cache\EBWebView\Default\Network\TransportSecurity~RFe58f037.TMP
Size 188B
SHA256 cd6b95d7f1c5ca4eb135820f75caefb9c805cb219553f7a3492f03ab06ba2852
MD5 4c049ff0703f2bc90edd9182488974d5
SHA1 9545fd5ea72cf2d8360f36e4ab56aad774bc9317
SHA512 9713bf3afe052ffab832e7829e6c13a9384924a76c8d4c740d9c249bca4c8483d2c4fc94226cf1f722c5a1ce60a413693bd41c16a1dc4a906bf1e011cb7dd3da
TLSH
T165C012A2407EA6BA307907695AC86D496F3BB13801C1DCFC965647689150EEA5113012
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Koyke\cache\EBWebView\Default\Preferences
Size 6KB
SHA256 5236d645039a0ced4f312f31a1be7021902c01e15c9d14b5365ae440fb442a39
MD5 ef4a87cbd1edc6cf0886ef278cf5c780
SHA1 aa9461f54da3bf81d710e9849a379176bccb7f15
SHA512 a1760ebda1229f31369e17a86f4fb89d799e1712a00dc7b9f8cc00ee18f3ee7eeb7a0698f0a79b7470d5144e7dead6fa8533d7a7655e79f8a4630ce145347025
SSDEEP 96:stP/djx9kpb9Kkubo5h16Z9Cs7/x+6Mhmuec3WK1ejeWK+gLjD28XM1C7K:stXr/5ocCsV+F7WKQjyNvG6K
TLSH
T108D1C5025E28797B4CC6F519BA29BA06E2F5603272D01E58EBF8462C05EB6DD731BD07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Koyke\cache\EBWebView\Default\Preferences
Size 6KB
SHA256 bbb60e794b201622bf09d0391950cdec6be13c0dd09503dc0b119345d831fa5c
MD5 2b52b149ada9b2b027e7c2f1133706d6
SHA1 188f04eb8ac7f28855f5f790bbfb81608095826f
SHA512 e3328f0522853a5066c7de9affcec6e4ad389324d001e0bc3993f83f28640ea237cf876bf24d6b9b9575f15a0545bf96d22a087249e386e9674b3b83eef196f6
SSDEEP 96:stP/djx9LGpb9Kkubo5h16Z9Cs7/x+6Mhmuec3WK1ejeWK+gDcD28XM1C7K:stXrh5ocCsV+F7WKQjypyG6K
TLSH
T13BD1C5025E28787B4CC6E519BA29BA17E2F5603272901E58EBF8462C05EB6DD7317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f586.TMP

Path C:\Koyke\cache\EBWebView\Default\Preferences~RFe58f586.TMP
Size 5KB
SHA256 669e466c16be30632e7dc89141333268182e22e75d5b2c6d51a0448c29511289
MD5 d4757252a2b3c1f7c03b83e00f23ec3a
SHA1 04b171af13c96e1f8df77d629dd8641f69cba06e
SHA512 f1dbaa4e84c2c7657f759c1fe8f80266995c14816b2d8f8f0dd45306026fcf5678b922be38a72b2075637e4eb2db28b2e6084aff7e775a6bceca96fa4e1fce3e
SSDEEP 96:rP/djx9kpb9Kku/do616Z9Cs7/x+6Mhmuec3WK1ejeWK+gxD28XM1C7K:rXr/foDCsV+F7WKQjyrG6K
TLSH
T10DC1C5025A28797B4CC6E518BA39BA06D2F5503276D12E58F7F88A2C05DB6CD731BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Koyke\cache\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Koyke\cache\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Koyke\cache\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Koyke\cache\EBWebView\Local State
Size 2KB
SHA256 1a86e85fea13e448abf9486e9095cd2b0ce19e927e9ce023b1b0ad8207098f9e
MD5 5d8866889560e49134c56790558147f9
SHA1 ec23c68e8b2cf47e5ea75ee98dd39e31fa321444
SHA512 bbf0f35236c0174272d48aa6ca61ca0cd46901ab81e28b83c66639de5d6d0c2ac1dd69c8ee5ecdd0a12d571003512b41673c259c5261731c495485ca6a38dab5
TLSH
T1FD519633A8146777CDE39B49B98A6B16CA7550A5BF912F50B6EC0B0802D790D3317C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Koyke\cache\EBWebView\Local State
Size 3KB
SHA256 0f0a2fc600e782b962d08ae0b0f104e22fb916a280a2a2f2463e38b2484082c8
MD5 d9ab912888de654841672dfe405ca565
SHA1 72e08fe67fa3144f99b4074f24167488d515ebc3
SHA512 1500f0ef2c499e295e536237769ed6724c1457672a0fe4740f09df301a5456fb267a01719982d898bee63da99793d80ed07d3cc337027559698cae89cb806cb4
TLSH
T17C818436A874A9678DF2DA09BD862B0AE7A05027BAC57FD4E5EC0F0C12D76492357C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Koyke\cache\EBWebView\Local State
Size 15KB
SHA256 f17f222a4666d7c372eee0b72495735af0432070dc64f02ee076c49480782b05
MD5 383cb599bacee57fda7501f57b665e4d
SHA1 be012bb48edc472830ac65e9db5d6cacd6e56cf4
SHA512 3e4fe2f895e37dacd17f3f0692329fe457095d9b48dae38c28db8693bc06c551995595184662cfe6201ad9ace063800b6a2b11ef32ed81c395824d910ee79844
SSDEEP 384:nsrv+89zHqlDNP9oid6NBSNQm5h50OA8YNu:srv+4UNbdP1oNu
TLSH
T15172AF73E47CA6339DF38545B48A6A0B7F78509666C20BE0F5991F8D12DB4C93317E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Koyke\cache\EBWebView\Local State
Size 3KB
SHA256 faecc69957a61267d70ffc76a6c0b2587f8d739da8a09ea09a6f3518a12eaa4e
MD5 2b51cf89c0b9e4e8ee0dc5ee462d9391
SHA1 2b89ad6bbc2c499db0c734d86e4f8d95dae6030a
SHA512 a410222f1e64fb026ac6128144292f16bf42021ccca46cb67563d0fe9fb893eb38b1ec83ef67dc56dacacc6a0c29460f258be0df9369c3f617a34383543e4cde
TLSH
T173719677A864A9778DE39A09BCC52B1AE7A15067BAC53F94E6EC0F0C02D764C2357C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe587097.TMP

Path C:\Koyke\cache\EBWebView\Local State~RFe587097.TMP
Size 1KB
SHA256 90358aa2ffaca2a74c8556ddbe0d81d13825b71e15e7e63f5cbae7809a64711d
MD5 317cb5e880c9c0daae23dced3f8cd6da
SHA1 8d9f432ca8f1f4b586ef888572eafdb61ba31c86
SHA512 50d777087af1445d7d456de265d4be8a8e527022221681c0d6b9550d3b8d6d4a6df2c439f5050e0bd49f8359940b9b35f2ebe156c9099e97dce1e419144df8aa
TLSH
T1AC31A4B2D4A41772EC926B4A7585AA9FDF7040BA67400F40B1DD070813EB80D723FC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1260-226-0x0000018626D20000-0x0000018626D23000-memory.dmp

Download

memory/1260-227-0x0000018626D00000-0x0000018626D06000-memory.dmp

Download

memory/1260-224-0x0000018626D10000-0x0000018626D12000-memory.dmp

Download

memory/1260-221-0x0000018626D00000-0x0000018626D03000-memory.dmp

Download

memory/1260-222-0x0000018626860000-0x0000018626865000-memory.dmp

Download

memory/1260-218-0x0000018626860000-0x0000018626861000-memory.dmp

Download

memory/1260-217-0x0000018626870000-0x0000018626872000-memory.dmp

Download

memory/1260-223-0x0000018626D00000-0x0000018626D01000-memory.dmp

Download

memory/1260-26-0x00007FF9BA050000-0x00007FF9BA051000-memory.dmp

Download

memory/1260-216-0x0000018626860000-0x0000018626861000-memory.dmp

Download

memory/1260-219-0x0000018626CF0000-0x0000018626CF2000-memory.dmp

Download

memory/4424-295-0x00007FF9BAD30000-0x00007FF9BAD31000-memory.dmp

Download

memory/4424-296-0x00007FF9BA050000-0x00007FF9BA051000-memory.dmp

Download

memory/5656-371-0x0000025F5A960000-0x0000025F5A961000-memory.dmp

Download

memory/5656-377-0x0000025F5A960000-0x0000025F5A961000-memory.dmp

Download

memory/5656-380-0x0000025F5A960000-0x0000025F5A961000-memory.dmp

Download

memory/5656-379-0x0000025F5A960000-0x0000025F5A961000-memory.dmp

Download

memory/5656-378-0x0000025F5A960000-0x0000025F5A961000-memory.dmp

Download

memory/5656-376-0x0000025F5A960000-0x0000025F5A961000-memory.dmp

Download

memory/5656-375-0x0000025F5A960000-0x0000025F5A961000-memory.dmp

Download

memory/5656-369-0x0000025F5A960000-0x0000025F5A961000-memory.dmp

Download

memory/5876-75-0x00007FF9BA050000-0x00007FF9BA051000-memory.dmp

Download