3b87bfca019f75457d12cb7808050b284e70d272cf7841aaf5a86cfae72ab42b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
Size 5.9MB
Sample260720-nc69paf12k
SHA256 3b87bfca019f75457d12cb7808050b284e70d272cf7841aaf5a86cfae72ab42b
MD5 c0ceb4b33a449c70cb80735783d51712
SHA1 dd7440ff14e9564cf72de7e46d0d8daa11a79eff
SHA512 debac775014862e8c72665e7fe431aeed715de82ad0973afe034819da4ffd00de4f145362cad004fb6659977120b332cdc7e35fec17bea759ed07a94f9459c31
SSDEEP 98304:Nvaq1R85EkExPJRSbuBdOvSg60fSxWWML7L3A+RU54YfskdOlJckd1op:BasaEkiEuBqSwMEvZrkd+aGI
TLSH
T1E35601EBB15C85F8F0B6CFF8009246D19A2C7C63CBB5264632C9760A5E32D901D5DA9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Detects executables packed with Enigma 5 IoCs

resource	yara_rule
behavioral2/memory/4436-17-0x0000000140000000-0x0000000140A07000-memory.dmp	INDICATOR_EXE_Packed_Enigma
behavioral2/memory/4436-204-0x0000000140000000-0x0000000140A07000-memory.dmp	INDICATOR_EXE_Packed_Enigma
behavioral2/memory/4436-235-0x0000000140000000-0x0000000140A07000-memory.dmp	INDICATOR_EXE_Packed_Enigma
behavioral2/memory/4436-239-0x0000000140000000-0x0000000140A07000-memory.dmp	INDICATOR_EXE_Packed_Enigma
behavioral2/memory/4436-355-0x0000000140000000-0x0000000140A07000-memory.dmp	INDICATOR_EXE_Packed_Enigma

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe

Loads dropped DLL 1 IoCs

pid	Process
4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 25 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2156	powercfg.exe
1212	powercfg.exe
2392	powercfg.exe
2784	powercfg.exe
5408	powercfg.exe
3344	powercfg.exe
4372	powercfg.exe
5860	powercfg.exe
1176	powercfg.exe
1220	powercfg.exe
1992	powercfg.exe
1736	powercfg.exe
2808	powercfg.exe
5264	powercfg.exe
4344	powercfg.exe
252	powercfg.exe
4936	powercfg.exe
2092	powercfg.exe
2856	powercfg.exe
5828	powercfg.exe
1168	powercfg.exe
4732	powercfg.exe
3176	powercfg.exe
1876	powercfg.exe
6044	powercfg.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\123\ui3.css	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\1.png	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File opened for modification	C:\Windows\SysWOW64\123\	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\2.png	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\secureboot.html	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\neterror.html	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\app.js	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\jm.html	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\jm.js	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\ui3.js	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\ui4.html	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\memoryintegrity.html	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\index.css	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\index.html	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\jm.css	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\ui3.html	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
File created	C:\Windows\SysWOW64\123\ui4.css	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
5884	msedgewebview2.exe
5884	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6072	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2856	powercfg.exe
Token: SeCreatePagefilePrivilege	2856	powercfg.exe
Token: SeShutdownPrivilege	2808	powercfg.exe
Token: SeCreatePagefilePrivilege	2808	powercfg.exe
Token: SeShutdownPrivilege	5860	powercfg.exe
Token: SeCreatePagefilePrivilege	5860	powercfg.exe
Token: SeShutdownPrivilege	1212	powercfg.exe
Token: SeCreatePagefilePrivilege	1212	powercfg.exe
Token: SeShutdownPrivilege	2392	powercfg.exe
Token: SeCreatePagefilePrivilege	2392	powercfg.exe
Token: SeShutdownPrivilege	5264	powercfg.exe
Token: SeCreatePagefilePrivilege	5264	powercfg.exe
Token: SeShutdownPrivilege	5828	powercfg.exe
Token: SeCreatePagefilePrivilege	5828	powercfg.exe
Token: SeShutdownPrivilege	4344	powercfg.exe
Token: SeCreatePagefilePrivilege	4344	powercfg.exe
Token: SeShutdownPrivilege	2784	powercfg.exe
Token: SeCreatePagefilePrivilege	2784	powercfg.exe
Token: SeShutdownPrivilege	1176	powercfg.exe
Token: SeCreatePagefilePrivilege	1176	powercfg.exe
Token: SeShutdownPrivilege	252	powercfg.exe
Token: SeCreatePagefilePrivilege	252	powercfg.exe
Token: SeShutdownPrivilege	1168	powercfg.exe
Token: SeCreatePagefilePrivilege	1168	powercfg.exe
Token: SeShutdownPrivilege	5408	powercfg.exe
Token: SeCreatePagefilePrivilege	5408	powercfg.exe
Token: SeShutdownPrivilege	4732	powercfg.exe
Token: SeCreatePagefilePrivilege	4732	powercfg.exe
Token: SeShutdownPrivilege	1220	powercfg.exe
Token: SeCreatePagefilePrivilege	1220	powercfg.exe
Token: SeShutdownPrivilege	3176	powercfg.exe
Token: SeCreatePagefilePrivilege	3176	powercfg.exe
Token: SeShutdownPrivilege	1876	powercfg.exe
Token: SeCreatePagefilePrivilege	1876	powercfg.exe
Token: SeShutdownPrivilege	3344	powercfg.exe
Token: SeCreatePagefilePrivilege	3344	powercfg.exe
Token: SeShutdownPrivilege	6044	powercfg.exe
Token: SeCreatePagefilePrivilege	6044	powercfg.exe
Token: SeShutdownPrivilege	1992	powercfg.exe
Token: SeCreatePagefilePrivilege	1992	powercfg.exe
Token: SeShutdownPrivilege	4936	powercfg.exe
Token: SeCreatePagefilePrivilege	4936	powercfg.exe
Token: SeShutdownPrivilege	2092	powercfg.exe
Token: SeCreatePagefilePrivilege	2092	powercfg.exe
Token: SeShutdownPrivilege	1736	powercfg.exe
Token: SeCreatePagefilePrivilege	1736	powercfg.exe
Token: SeShutdownPrivilege	2156	powercfg.exe
Token: SeCreatePagefilePrivilege	2156	powercfg.exe
Token: SeShutdownPrivilege	4372	powercfg.exe
Token: SeCreatePagefilePrivilege	4372	powercfg.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2856	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	89
PID 4436 wrote to memory of 2808	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	91
PID 4436 wrote to memory of 5860	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	93
PID 4436 wrote to memory of 1212	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	95
PID 4436 wrote to memory of 2392	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	97
PID 4436 wrote to memory of 5264	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	99
PID 4436 wrote to memory of 5828	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	101
PID 4436 wrote to memory of 4344	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	103
PID 4436 wrote to memory of 2784	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	105
PID 4436 wrote to memory of 1176	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	107
PID 4436 wrote to memory of 252	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	109
PID 4436 wrote to memory of 1168	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	111
PID 4436 wrote to memory of 5408	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	113
PID 4436 wrote to memory of 4732	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	115
PID 4436 wrote to memory of 1220	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	117
PID 4436 wrote to memory of 3176	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	119
PID 4436 wrote to memory of 1876	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	121
PID 4436 wrote to memory of 3344	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	123
PID 4436 wrote to memory of 6044	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	125
PID 4436 wrote to memory of 1992	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	127
PID 4436 wrote to memory of 4936	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	129
PID 4436 wrote to memory of 2092	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	131
PID 4436 wrote to memory of 1736	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	133
PID 4436 wrote to memory of 2156	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	135
PID 4436 wrote to memory of 4372	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	137
PID 4436 wrote to memory of 6072	4436	2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe	139
PID 6072 wrote to memory of 2540	6072	msedgewebview2.exe	140
PID 6072 wrote to memory of 5920	6072	msedgewebview2.exe	141
PID 6072 wrote to memory of 5920	6072	msedgewebview2.exe	141
PID 6072 wrote to memory of 5920	6072	msedgewebview2.exe	141
PID 6072 wrote to memory of 5920	6072	msedgewebview2.exe	141
PID 6072 wrote to memory of 2324	6072	msedgewebview2.exe	142
PID 6072 wrote to memory of 3392	6072	msedgewebview2.exe	143
PID 6072 wrote to memory of 3392	6072	msedgewebview2.exe	143
PID 6072 wrote to memory of 3392	6072	msedgewebview2.exe	143
PID 6072 wrote to memory of 1600	6072	msedgewebview2.exe	144
PID 6072 wrote to memory of 1600	6072	msedgewebview2.exe	144
PID 6072 wrote to memory of 1600	6072	msedgewebview2.exe	144
PID 6072 wrote to memory of 1600	6072	msedgewebview2.exe	144
PID 6072 wrote to memory of 1600	6072	msedgewebview2.exe	144
PID 6072 wrote to memory of 5884	6072	msedgewebview2.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe"
1⤵
- Modify Registry: Disable Windows Driver Blocklist
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -s 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -x -monitor-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -x -monitor-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5860
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -x -disk-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -x -disk-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5264
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5828
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c fea3413e-7e05-4911-9a71-700331f1c294 0e796bdb-100d-47d6-a2d5-f7d2daa51f51 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c fea3413e-7e05-4911-9a71-700331f1c294 0e796bdb-100d-47d6-a2d5-f7d2daa51f51 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:252
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 0012ee47-9041-4b5d-9b77-535fba8b1442 6738e2c4-e8a5-4a42-b16a-e040e769756e 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 0012ee47-9041-4b5d-9b77-535fba8b1442 6738e2c4-e8a5-4a42-b16a-e040e769756e 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5408
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 02f815b5-a5cf-4c84-bf20-649d1f75d3d8 4c793e7d-a264-42e1-87d3-7a0d2f523ccd 1
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4732
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 02f815b5-a5cf-4c84-bf20-649d1f75d3d8 4c793e7d-a264-42e1-87d3-7a0d2f523ccd 1
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 0d7dbae2-4294-402a-ba8e-26777e8488cd 309dce9b-bef4-4119-9921-a851fb12f0f4 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3176
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 0d7dbae2-4294-402a-ba8e-26777e8488cd 309dce9b-bef4-4119-9921-a851fb12f0f4 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1876
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 19cbb8fa-5279-450e-9fac-8a3d5fedd0c1 12bbebe6-58d6-4636-95bb-3217ef867c1a 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 19cbb8fa-5279-450e-9fac-8a3d5fedd0c1 12bbebe6-58d6-4636-95bb-3217ef867c1a 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:6044
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 238c9fa8-0aad-41ed-83f4-97be242c8f20 29f6c1db-86da-48c5-9fdb-f2b67b1f44da 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 238c9fa8-0aad-41ed-83f4-97be242c8f20 29f6c1db-86da-48c5-9fdb-f2b67b1f44da 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 238c9fa8-0aad-41ed-83f4-97be242c8f20 94ac6d29-73ce-41a6-809f-6363ba21b47e 1
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 238c9fa8-0aad-41ed-83f4-97be242c8f20 94ac6d29-73ce-41a6-809f-6363ba21b47e 1
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setdcvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 238c9fa8-0aad-41ed-83f4-97be242c8f20 9d7815a6-7ee4-497e-8888-515a05f02364 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\SYSTEM32\powercfg.exe
  powercfg -setacvalueindex 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 238c9fa8-0aad-41ed-83f4-97be242c8f20 9d7815a6-7ee4-497e-8888-515a05f02364 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe --user-data-dir="C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=CalculateNativeWinOcclusion --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4436.1660.10389231063055427128 /pfhostedapp:a54702eb8749296019c5733d0aa50c6a90de7b5f
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView /prefetch:4 /pfhostedapp:a54702eb8749296019c5733d0aa50c6a90de7b5f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff806255fd8,0x7ff806255fe4,0x7ff806255ff0
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView" --webview-exe-name=2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,1961707427397843615,17841862520494373775,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:2 /pfhostedapp:a54702eb8749296019c5733d0aa50c6a90de7b5f
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView" --webview-exe-name=2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2184 --field-trial-handle=1780,i,1961707427397843615,17841862520494373775,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:3 /pfhostedapp:a54702eb8749296019c5733d0aa50c6a90de7b5f
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView" --webview-exe-name=2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1780,i,1961707427397843615,17841862520494373775,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a54702eb8749296019c5733d0aa50c6a90de7b5f
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView" --webview-exe-name=2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3520 --field-trial-handle=1780,i,1961707427397843615,17841862520494373775,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion --variations-seed-version /pfhostedapp:a54702eb8749296019c5733d0aa50c6a90de7b5f /prefetch:1
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView" --webview-exe-name=2026-07-20_c0ceb4b33a449c70cb80735783d51712_icedid.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4304 --field-trial-handle=1780,i,1961707427397843615,17841862520494373775,262144 --enable-features=MojoIpcz --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a54702eb8749296019c5733d0aa50c6a90de7b5f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 34ad9eaf775205511be4dc53b9a5c40f0e0bd8dca387e1c8fde4fab54634e4c8
MD5 197293b76326f50f1e11555f74d3c771
SHA1 12aedd8ad3f2dbab9a843566b32cad1dccefe6fe
SHA512 74428c24c260989befc845f3f0680df407160546b64f45d3e3e8d3a01ebf9ac9db3a891211b494cecb3c47789fa8d945e1631d1a354c63db64d971bdf13159b9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 67e6c0ebf216038c3a5a6c689dd59bf953250432aa4a44f7614e223ab22fe37d
MD5 7fde0e0ac556288cecd4c92bcbdfc85c
SHA1 704402b01da3d454a66ca427962d2549cf6b7b01
SHA512 5070e3d87f8ff517ff22f4b0ad8d02bee95496e1676c000b9cf6d888cf59a40b61eac9ce9aa61da26becf88e8a3318f7f16a881f73aebc16407b940c986f41a1
TLSH
T197D0113233020A38C02028B32002EA282A88C20F828A8008A8388A2E2A088A00E02883
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

08e0e0ba-c943-44bb-901d-155cfc039adc.tmp

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Default\08e0e0ba-c943-44bb-901d-155cfc039adc.tmp
Size 5KB
SHA256 f2f4b6d62001252b11568143935c0948764eb58c80c868413d93d387828b7834
MD5 44c0bfd3bfec53e3347aea3840b8985e
SHA1 da848d89e7473a700d537e1d798a6815d6a8b358
SHA512 6ae5bacd1ea7aeb906b6d47513869d0aafcafebf438bc62c81271a4fbcd8a35104dae723e3e108e90bd01eaf336f5d5a02e2e1edc36d137d3e2993040c7bf3cf
SSDEEP 96:rOgU/dyaDwKeW5Eb9YkMcdo616ZdOxs7/x+6MhmuecmjebtK+gATE28XM1C7K:rOgYLDwteJyoPOxsV+FijaAWTEG6K
TLSH
T132C197065E24697B4CC6F509FA297B43D2FAA03275D52D58E7F98A2C04DB5CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa029.TMP

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5aa029.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 14f582ce4541fcf4c9621bc5bd2e05d0808d09bc67a1ad8abceb971127a63909
MD5 69301baa05fa5d4d2c20d50496e4d0de
SHA1 29d8bd3519bb1d6334b7cfd743ec57e8e100e4ca
SHA512 3f7bc392e426bd773d9d5b4401107319fe50c9e24634328337e0be05596886953905a138a748dfbc7c8e267385c4bb650523b3cc644602d9bfdc0cd072ed1937
SSDEEP 96:rOgU/dyaDwKeW5Eb9YkMcdo5h16ZdOxs7/x+6MhmuecmjebtK+gKAE28XM1C7K:rOgYLDwteJyosOxsV+FijaA8AEG6K
TLSH
T1F7C196065E24687B4CC6F519FA39BB53D2FAA03271E12E58E7F8862C04DB5DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 b85ab58f1f7964968e8538d4d5017b450112a23538fce983d8f976ade4c7d2c4
MD5 9a226fe7cf386343eab13f7212218409
SHA1 329b0fec94f6a17d4dc7e282b1e9b94540becf7a
SHA512 7edbd7572f44b148a5c0ecb0d78be1729a0369b28131b6970e496a230b17cc97aff7393c1923a2a848937f0718d91a4e2cc4f608fb52a617a2c43b2b5d3d84e7
SSDEEP 96:stOgU/dyaDwKeW5Eb9YkMSo5h16ZdOxs7/x+6MhmuecmjebtK+gKAE28XM1C7K:stOgYLDwteJSosOxsV+FijaA8AEG6K
TLSH
T173D197065E24687B4CC6F519FB29BB53E2F9A03275E11E58E7F8862C04DB5DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 ec34ad7b26ec263edf067e6aab29d4179395d48517b0db03fd529ae70ab0d93c
MD5 0c416ff071dcc77ccec643197c2a0ac2
SHA1 54013ed221a53a61c2603b1dd3463946cafcdd0b
SHA512 da79fc0cf2e5824d52b7ae40a77366eb4bbb9e346bae5b85d39c09f351a3f39d1efb34088ade7a0e68e3cafa96e0c58f077db7848f5327e1935e6960861fb9dc
SSDEEP 96:stOgU/dyaDwKetG5Eb9YkMSo5h16ZdOxs7/x+6MhmuecmjebtK+gKAE28XM1C7K:stOgYLDwt0JSosOxsV+FijaA8AEG6K
TLSH
T1E3D195065E24687B4CC6E519FB29BB53E2F9A03271E11E58E7F8862C04EB5DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Local State
Size 2KB
SHA256 cb3dd444ff5a1083cdcc80870a93786f914f79dd31565c3c0047d0708b2b7f3a
MD5 ce9a5d904a45777e72850a96a7a5ab71
SHA1 0ffcd6d4469303a164c5cc7b12f64d32edfaf301
SHA512 7168a0c457c52a2ea7e287e94e68b0519a115a09d306830832fbfed2aefb47655795816bac89978d1b76cdcdf588d1ca7ce6c0f38e4a45a310fc2ca6715ce30d
TLSH
T11E51A873E8505E3789E34E08B98A7F638E7A9065AB621F50E9DD1B0C00DB44C2707C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Local State
Size 3KB
SHA256 76b145c771ef56b3a8f65695567b027d24c72b52bc32ca1986b998807386e2db
MD5 c4fbbffe416149232be3b5ae6e5174ee
SHA1 e9c5e079d4149055680d7af1a9162f51d77bb39e
SHA512 26f0da2b3713245027e7f461cc2525c2d87c82f00b85a4b956fc68055a4453edc1d6ecde82b30414c72f5d0fb4acce7937cab1a069b95c574d4e5cd10afde2ba
TLSH
T19E71847BA9A09D3B4DE39E04B8C63B57ABA59026E6917F94D9EC0F0C01D72881756813
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Local State
Size 3KB
SHA256 85c5fb407331ebbe3d6e59682d070d48b076a5b9b836356b52c2d4c35da6248a
MD5 8c73884a3553313aee370693ecb282a4
SHA1 7e068c67d3b7b4bb52379b7253c9b28b224ffb21
SHA512 b6401779b088971c6d89b0af86bd08cf6873ab8b1074211c3e201e1e0c7a6d079f153c965274d8c599c433b575a56439ec7b2de7e6399ede435591d712cdf8f7
TLSH
T12281A73BA8A0AD374DE3D908B8863B53ABA59027A6D27F94D9EC0F0C01D72881347813
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Local State
Size 16KB
SHA256 ff5e21b8c952dc456268466cdc93b9ebebbb0e0f2ce3777978386aedeff82172
MD5 100b093cd02d97d1d96fe5c796043f41
SHA1 303a8b8e9a089230d51cbd9646f924d4a47c3ecc
SHA512 a082ee356da5a1fb25fdb2a55041b60b605cd75b58fe6c776519eae66ca553e6a1aaa6f471817236be2172349daed27a7ec426b51a520d067bcf7842ee51ac4f
SSDEEP 384:1srv+89zHqlDNP9oid6NBSIsEmMWYO7bRNz:Crv+4UNbdBlvbRNz
TLSH
T126728D32E568EA375DF38684B58BBA4B6BB8515656C20BD0D8C92FCC46CB4CE2317D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Local State
Size 5KB
SHA256 3694b826e52d8919fe789645fd626a83991028ae2267426e070ace7008b4ca06
MD5 09cee8f2a9f78238f00202d6a5fe43f1
SHA1 b9cbf6d48282e364e40bd1feed30a98dcc086304
SHA512 d98ec295a2c8791d9d6de872371e790303ba8a6ed560bca949d081b23d5c05515aee99f0ef8010c0d899ef78f1f92f78e7d87a211de0a54cf7ad8ea79f8d350d
SSDEEP 96:4eNkGSCyYUqfaEf158kh/cI9URoDotoiOuOkpB42c2p6DNiaH1ZXeZHXTdbJVa:4eNBSzNufleoDUDOu5v42c2giM+jd+
TLSH
T148B1943AD8A0DA275CF386857A877B97ABA04123A6C56FC4C9DC1F0C42C768D1347C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59718c.TMP

Path C:\Users\Admin\AppData\Local\IOSSystemTuning\WebView2\EBWebView\Local State~RFe59718c.TMP
Size 1KB
SHA256 4c5dd96c11bfc845597b3e0235043d3c450bde603b693ddf15e167e9b235e1d6
MD5 d37a476d6588705231e139e673cdf88d
SHA1 8e32370c2096f54d292651ce802ce2296e05050c
SHA512 b17b191353cf616f4164ea7834a82f8705920347c913413d2a51ccedd71a906704321ae0b7072bc4a66b43cda4d65ba100b7b140ef17d3bb9eb088a5c49240cb
TLSH
T1713174B7D4901E336CC25A4A31C2BAA78E65507A93524F44B5DD8B1D16DB04CAB3F832
MD5 SHA1 SHA512 TLSH

Submit Download

evb5EFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb5EFF.tmp
Size 1KB
SHA256 99e91cf2c594579a211975aa11b767fb71454d2cb2c88f5f224fbf05c35907e9
MD5 5629c31ee76eefc18d3399860296c744
SHA1 f1f74223a7c5bc788edf4065bf21d4365b433338
SHA512 61085a136669d38278fa342fe050d11dbed879f7c7e54db9c86ca3cc0d092632b428ff6052e1bcea2ff69717112ed82e2e576e251b75e363af4836c403b170d4
TLSH
T125315E13D6118AB3C14D073996E29A2C66B8AC3453F916560FF0047DEC953304A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

index.css

Path C:\Windows\SysWOW64\123\index.css
Size 43KB
SHA256 3e3da1a0521f4af08e7ba0eeebb84f6f2114e4fd9367e1ee0bb20ac87da2c56a
MD5 c228da4836484d1156ae2249c50c246a
SHA1 aeb46e0bff0b89c0f2f178b92541d3816db6b79f
SHA512 e70f971c1917571246742df5d9461785dbe8782af39dbf840711a9ed821b5e8cf0c7218b04b322b4b665ecb58b0a1f5f6b2d3ee73c28f4394a35d180ade4c46b
SSDEEP 768:ZcENEvwwxBfCFR5RgC2OFyaSyBgoXI9u4/vJIJuPYKQuMMGwCL+Z+JIuDb:ZM/nCTFxiYKQuMMGwCL+yL
TLSH
T17F13C7319942001EF133D9867BE1964EE53CC407FA230A6EB2BA3196CF627D94B77794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Windows\SysWOW64\123\index.html
Size 47KB
SHA256 6fd6134c3fbda955c09a126a013e22504e4776a747f1c8789ac624f800016bd2
MD5 3a533a6c8f05ca20f7fde4c34679e340
SHA1 17ba7f5e6ea8df42c667b0c1bfa145f04cf226a3
SHA512 42c60ff9f9339527299000fe2452284b9f2f693fbbbb1abcc3bb8aa6e373675414432f53c75fe0983d47338c5405810d8b406f9c122f5f661a944a544e51f4a7
SSDEEP 768:9oppY5cIII/YEIII2D6/CtcGtX/SiQsBkgkc:uK5cIIIPIII2G/CiiXt
TLSH
T17C23B56562A515374173C0EADFA35709FCA59003EA83D6087AAC53931FF7C42E877AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1600-139-0x00007FF827DA0000-0x00007FF827DA1000-memory.dmp

Download

memory/4436-205-0x0000000180000000-0x000000018002C000-memory.dmp

Download

memory/4436-1-0x00007FF82881F000-0x00007FF828820000-memory.dmp

Download

memory/4436-10-0x00007FF828950000-0x00007FF828952000-memory.dmp

Download

memory/4436-11-0x00007FF8286C0000-0x00007FF828923000-memory.dmp

Download

memory/4436-355-0x0000000140000000-0x0000000140A07000-memory.dmp

Download

memory/4436-6-0x00007FF8286C0000-0x00007FF828923000-memory.dmp

Download

memory/4436-203-0x00007FF8286C0000-0x00007FF828923000-memory.dmp

Download

memory/4436-8-0x00007FF828930000-0x00007FF828932000-memory.dmp

Download

memory/4436-206-0x0000000004900000-0x00000000049A8000-memory.dmp

Download

memory/4436-204-0x0000000140000000-0x0000000140A07000-memory.dmp

Download

memory/4436-17-0x0000000140000000-0x0000000140A07000-memory.dmp

Download

memory/4436-15-0x00007FF826200000-0x00007FF826202000-memory.dmp

Download

memory/4436-236-0x0000000180000000-0x000000018002C000-memory.dmp

Download

memory/4436-235-0x0000000140000000-0x0000000140A07000-memory.dmp

Download

memory/4436-239-0x0000000140000000-0x0000000140A07000-memory.dmp

Download

memory/4436-240-0x0000000180000000-0x000000018002C000-memory.dmp

Download

memory/4436-9-0x00007FF828940000-0x00007FF828942000-memory.dmp

Download

memory/4436-7-0x0000000180000000-0x000000018002C000-memory.dmp

Download

memory/4436-12-0x00007FF827DA0000-0x00007FF827DA2000-memory.dmp

Download

memory/4436-4-0x0000000180000000-0x000000018002C000-memory.dmp

Download

memory/4436-2-0x00007FF8286C0000-0x00007FF828923000-memory.dmp

Download

memory/4436-13-0x00007FF827DB0000-0x00007FF827DB2000-memory.dmp

Download

memory/4436-14-0x00007FF8261F0000-0x00007FF8261F2000-memory.dmp

Download

memory/5884-330-0x000002283E700000-0x000002283E701000-memory.dmp

Download

memory/5884-332-0x000002283E700000-0x000002283E701000-memory.dmp

Download

memory/5884-340-0x000002283E700000-0x000002283E701000-memory.dmp

Download

memory/5884-341-0x000002283E700000-0x000002283E701000-memory.dmp

Download

memory/5884-338-0x000002283E700000-0x000002283E701000-memory.dmp

Download

memory/5884-339-0x000002283E700000-0x000002283E701000-memory.dmp

Download

memory/5884-336-0x000002283E700000-0x000002283E701000-memory.dmp

Download

memory/5884-337-0x000002283E700000-0x000002283E701000-memory.dmp

Download

memory/5920-224-0x0000014DF0AA0000-0x0000014DF0B48000-memory.dmp

Download

memory/5920-63-0x00007FF827DA0000-0x00007FF827DA1000-memory.dmp

Download