darksiderat | 189783b3b3a79e4174d71f09838ec3f201fac343be076b7011670647f8fdbf07

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe
Size 1.3MB
Sample261110-a2skyaxtbt
SHA256 189783b3b3a79e4174d71f09838ec3f201fac343be076b7011670647f8fdbf07
MD5 f065654707e54a87bdcd51dac8731810
SHA1 e2d32d4ada130409b27f2b233a8948381d9fb2c7
SHA512 8ebb207b4c3ac2b7e43cba64967f0ff4dcf6a8d36c6afaf87dc7c8d299d73ad6d49f33869cb46d2f69c7ea54c83be79e00dbdbfe3d56940dfb93189f0d5d36f7
SSDEEP 24576:RPVnmTrQMNrG4i/MSWhsgt9bSAW0VzTTQAek:RPVnCrdrzPfHP/a
TLSH
T16F558E29974102B9D4B6C1BDCE538591E2767C5D4BB24ACF0BA4BAA12E335D48E3F313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/2388-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2388-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Executes dropped EXE 2 IoCs

pid	Process
244	loader_next.exe
2648	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 824 set thread context of 2388	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	89

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1757644537\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1757644537\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1757644537\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\manifest.fingerprint	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1700	msedgewebview2.exe
1700	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2648	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2388	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	89
PID 824 wrote to memory of 2388	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	89
PID 824 wrote to memory of 2388	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	89
PID 824 wrote to memory of 2388	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	89
PID 824 wrote to memory of 2388	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	89
PID 824 wrote to memory of 2388	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	89
PID 824 wrote to memory of 2388	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	89
PID 824 wrote to memory of 2344	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	90
PID 2344 wrote to memory of 5368	2344	msedgewebview2.exe	91
PID 2344 wrote to memory of 5588	2344	msedgewebview2.exe	92
PID 2344 wrote to memory of 1736	2344	msedgewebview2.exe	93
PID 2344 wrote to memory of 248	2344	msedgewebview2.exe	94
PID 2344 wrote to memory of 4420	2344	msedgewebview2.exe	95
PID 824 wrote to memory of 244	824	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	96
PID 244 wrote to memory of 2648	244	loader_next.exe	97
PID 2648 wrote to memory of 5012	2648	2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe	98
PID 5012 wrote to memory of 1752	5012	msedgewebview2.exe	99
PID 5012 wrote to memory of 6044	5012	msedgewebview2.exe	100
PID 5012 wrote to memory of 4752	5012	msedgewebview2.exe	101
PID 5012 wrote to memory of 2140	5012	msedgewebview2.exe	102
PID 5012 wrote to memory of 3456	5012	msedgewebview2.exe	103
PID 5012 wrote to memory of 5744	5012	msedgewebview2.exe	108
PID 5012 wrote to memory of 1924	5012	msedgewebview2.exe	109
PID 5012 wrote to memory of 1700	5012	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.189 --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --no-sandbox --mojo-named-platform-channel-pipe=824.4452.10119699853986711370 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView /prefetch:4 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb5f715fd8,0x7ffb5f715fe4,0x7ffb5f715ff0
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.189 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1764,i,9253982158455804205,2768919781348782893,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.189 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1924 --field-trial-handle=1764,i,9253982158455804205,2768919781348782893,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.189 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1764,i,9253982158455804205,2768919781348782893,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.189 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3156 --field-trial-handle=1764,i,9253982158455804205,2768919781348782893,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601 /prefetch:1
    3⤵
    PID:4420
- C:\Users\Admin\AppData\Local\Temp\CHEATCTRL\loader_next.exe
  "C:\Users\Admin\AppData\Local\Temp\CHEATCTRL\loader_next.exe" --updated --swap-onto "C:\Users\Admin\AppData\Local\Temp\2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AppData\Local\Temp\2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe" --updated
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.191 --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --no-sandbox --mojo-named-platform-channel-pipe=2648.5536.16406630273346167144 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView /prefetch:4 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffb5f715fd8,0x7ffb5f715fe4,0x7ffb5f715ff0
        5⤵
        
        PID:1752
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.191 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,18008390592445476320,17610685522262879098,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
        5⤵
        
        PID:6044
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.191 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1892 --field-trial-handle=1784,i,18008390592445476320,17610685522262879098,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
        5⤵
        
        PID:4752
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.191 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1784,i,18008390592445476320,17610685522262879098,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
        5⤵
        
        PID:2140
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.191 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3272 --field-trial-handle=1784,i,18008390592445476320,17610685522262879098,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601 /prefetch:1
        5⤵
        
        PID:3456
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.191 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=1784,i,18008390592445476320,17610685522262879098,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
        5⤵
        
        PID:5744
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.191 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=1784,i,18008390592445476320,17610685522262879098,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
        5⤵
        
        PID:1924
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView" --webview-exe-name=2026-11-10_f065654707e54a87bdcd51dac8731810_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.3.191 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3940 --field-trial-handle=1784,i,18008390592445476320,17610685522262879098,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2dc820f69ea60b1e883f8501b235ae0851fd6601
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

00939d7d-6287-4812-b0c6-3b16af4a03df.tmp

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\00939d7d-6287-4812-b0c6-3b16af4a03df.tmp
Size 2KB
SHA256 c8add0a59666a8230f66159d598dc9ed024f914bd3005fc6f1238d0508f28471
MD5 de031dafe8788af9663c635e324bd6d1
SHA1 aa37fbe133258b689382edcd7c5268e802884bbf
SHA512 b8577eb4af3041b504110d11824b88f454a20f635b429c23ffa40a2bec0839422287b257c9182a2c7b57b69682dca8c32e711d9effa66f47ea58e92392f67785
TLSH
T145519733B814AB7795F29A10B90A7F23DF759066EA631F249ADD0B2802DB51D1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

503a1f91-8d3d-452a-92ea-dd141dc8f19c.tmp

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\503a1f91-8d3d-452a-92ea-dd141dc8f19c.tmp
Size 3KB
SHA256 63a239ec53577d7f4a40576904e341d0432d41bfeccc5f17bfa0e88c745b4800
MD5 de47f415f0a71d9d45ee45b2639e23a1
SHA1 3cbd725560150130074e8a879fe2c5e39abc5ee2
SHA512 a2244d58adfbc984c14bd93234ceb55d23a1494500b1810d2c9cdc7687413fecd465958cc2c1fdfe6228cd79a9a09fa02a872e186366ca4d2204913a2f1b64cd
TLSH
T11961A837B874A63B4DF29A00B9463F17A7A55027E5923F64CAED0F2C02D72581341C27
MD5 SHA1 SHA512 TLSH

Submit Download

75051c86-4ae3-4a8b-b4a3-8fc908ce53a6.tmp

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\75051c86-4ae3-4a8b-b4a3-8fc908ce53a6.tmp
Size 15KB
SHA256 ac2e8ab60f372099ecc401d6fd6e628d796cf5288621af8ece38d1e6bda345db
MD5 bc336bf2c7c16fd7e8d3aa08afd20827
SHA1 48e00c464cd02fae14e09c50b121fabd9708fc26
SHA512 a0c45f47c2ff4964e3803da84c23043c2188c96ecb1ed2ab0dd51c79516e426e266d8ba982866c9ad800ffbdf0e60704f22f8050c3f3292014731a7518d51173
SSDEEP 384:o+OBqImmJvGBLx3NaFMJFNNBSpbHS62Sg6rm:RcvGtlNKH3D6
TLSH
T1FB72AE3A28656B232CF78909BE8E634BCB616253C0E57BE8DCEC9F1F126F0441351812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2ffae76d68ddd8a9f090328af07ed102dfd3bda440dbcb1890a4415b8a6deff5
MD5 8eba4c7b2ed978c523860a38283500f9
SHA1 081ac6ac9612d74ddc2bda608c00341ee7d45371
SHA512 dc2f729b5e1bb583a3a97d759cdc7454ed463361a6675630cc20a5197f87554a2344467822a999f2161f73793f49147ca75f22a9fd0b7d482063ca2ee225dc65
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 688010196caf4874aba4f6687e7faabbdef680c9434d67ebe8ad0a322a699989
MD5 210351aa987ad46226719a324baaa6b1
SHA1 ae50933f03eb2323ab8d7c47da9c33513c6bd7b5
SHA512 6d72a0c32863f8f4e650f54ca56da6740c26a78f28352dd54851c4b0422987b1d921040f6a1183a8f13b85a0d56061d4472768a536471060b6b4adad53d4095e
TLSH
T12BD0121276020138C0102433000365092C00C11B820554126C3CC92DBE044702B024C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4dfc47076c98488eea68d05526def7bd729e79ad93b28d536b34b04863628010
MD5 1480463fb16b6f06721c55d60a16da94
SHA1 eccd6e3f4097d04678498437ee65601dd1538852
SHA512 4daef97c8d08ff1befd9def4477709ee9b3e00f06a43fd6b1d3bc70b2a03d483a6bf10f79b07609c05101aaf61f8690167b37ff2c771382dfaa60216e3862990
TLSH
T1A0D09B1177014A78D6215D331247D5063D91F11BC205E579BC3DC97D7D144F41F554D6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4285c1e1a6318bd42225af6a1919140dd543a75fade0ba001476d055f896c9ec
MD5 000afd93a17c4e4b1cca73b04d45c804
SHA1 9582fd1ff727f6e8f290e38e8774c666e1533c75
SHA512 e91ac9bd6a37e5a4b0ba97cb14a87cebfc6deb2086a22de626527b6a5979c8d9fd8161a51c78e506a83613d0d7fccc174180cc0f0b629d8833f86ae51425a32c
TLSH
T10BD0C00732110A2CCB20AD33134189453BC0F10B8442D57AA4BCCD3DBC080A40F014C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fcfeeb4c8c928c71478b1e2418666a49171e8725c6ff8442f548c617d8976740
MD5 c9f78029777b84fb6854b5af1e147ad8
SHA1 0deb65a6575f38ad2852d32ff9833aded33ded3d
SHA512 daac0a01a5a7fd5f28ed7e2cff4c269fec8a03f40efa6b2f8c7594bf0f8f71c8e1c4674cb23f236b861acc4511468c6bf6e5a8484713db6fce343526dcfcb9e9
TLSH
T1E5D0C0073211062CCB20AE32130089453BC0F00B8542D67AA4BCCD3DBC080A40F414C2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8a24b140-3e36-4e57-b8dc-af80f20699b2.tmp

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\8a24b140-3e36-4e57-b8dc-af80f20699b2.tmp
Size 6KB
SHA256 f8270e11b5990d0c26fd132a033c410b7fe358efdecd810cde7487d5614504e6
MD5 a4018f031ea610504ff799b0956c9d47
SHA1 056c6419cde2eba9a904422bf819f8e992739709
SHA512 1baef30ab9b9b5c5180ed0818e4718d4da7c3ef6b006c4cf735765c91535bb10a92969d9c2cf7b550e531828881e583b68c005fba1754d7387620c354af89cbf
SSDEEP 96:stc/dHECDbDAkyo5h16ZZs7/x+6Mhmuecmje6K+gaO28XM1C7K:stQBMXo+sV+FijiAOG6K
TLSH
T1EBD1A5066E24797B4CC6E518BE36BA47D2F96032B0D51E58EBF8462C14EB5CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e66522c23f6f077d15db1fa54c35c627b27d1ce4cdaa362c29f5745d4b400670
MD5 dfa2415b43a0206de4a8a9b6372beb40
SHA1 6ed4bdecfacd5ef25eb97dd91055013d22716d49
SHA512 1b1cf92b00a6c7c3f4b4028705f0553bafc33620f0cb9116c92958d8a1ec652354c59d2f2fac3ac6265015f435154b7780fb6a6dfec9f3dabf014d69e451f63c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 67635825c229bd8d2f0e870a47c06b6ccbffcc87f2efeb45604e95981d42785c
MD5 98a7380ae43775f2bdd8483bd90b1182
SHA1 665c1b2e56035272eeb0f44f3665a0e681419afd
SHA512 8eddfd2827065b1f4c47130f37785745e21f67667f63281b1ec049fa6c12f5f934922d6957c244596d93d256f3acb1e44f60a5194fd8b1fa9fad141f72e5bd30
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\GPUCache\index
Size 256KB
SHA256 dff26798dd5cdaba9f02bc8ffb7c4f11b851d1a70a3617ec13b3c7c7adc746ab
MD5 4ada7c20587d09f9ff99f32b21b98d1c
SHA1 002b7cc18b786e8963902eb4a564e3837de88ef3
SHA512 d70b7f2cfa4c2e64392e7d651278ec581c47fd4197fca1a0df0c3f54e6da6348aafdc02f37e07988ee3d94242858ccd59bd9f8ffa6548fcafd8936d172cccdec
SSDEEP 3:LsOllllklkXlollt:LsUlPot
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\History
Size 164KB
SHA256 deba77bc71479c2e98a7f985233a7dc3a386ebc0dce33a347c6ac21d9ee1c573
MD5 a52a55fd35156c4962d5056465aa9d95
SHA1 c22a74097d6717d550758cf6f7ac16c3a4bce1e8
SHA512 2683277a6451aec89c9e40cc554ec5d16f22cb44c12ff404ea6c13acd8306552861b279f9a4e6aea3b715ece2e0f1969ff4c37f4c2e4b67336c4aa07d0a2adc7
SSDEEP 96:MBaLqL/uejzH+bF+UIYysX0fxQp97sXEHt/DfLVVVN6zRk/E0:MBGqL/tH+bF+UI3iWGVsXWNVVV63
TLSH
T10FF3EA1E5F643722CDBD923668E745B3597CF03F876326856CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Login Data
Size 42KB
SHA256 0c1c2e0223f73fea44686ae44f4e78411de421f7aef7d89617be3837d3fdbc11
MD5 cec405af1bb4df2029eacdcbc7e05fd6
SHA1 835e45888f49095a184a62a229a437399c9c62cd
SHA512 4ce266cc942447ac963f4652c058a28d7641e37a06a5cfa4b290e70d77efb80e00312363ee5adb9e502fa32ad1cf661c18ac9581d1fcb2f83e7cb6429325458e
SSDEEP 96:klpeymwACn8MouB6w9f/FlXqiEqUvJKLuyn:klrAG7Iw9ftFqidn
TLSH
T1B213350F2B682401C8AD8636ACB114B66E7CA13F4B639FD52CB104259D75C63B12D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Preferences
Size 5KB
SHA256 61c8227b1e2e1f9f9001f3492e355fe8c2a42f29e6178197c008755bd2fc2131
MD5 19b080a97844b473b9c761025bae3503
SHA1 3cb19c4ee27408542cf293b9af7cdfaa6ba59bb5
SHA512 3b4e784c2aafaea6b3bbe508d1c287c675607fd665ec6afa241843a15b8c8691fce01061c0026ce3f78283da58e8c4b95ee14651e769ae981e79186e505c23b8
SSDEEP 96:stc/dHECPmb9Akyo5h16ZZs7/x+6Mhmuecmje6K+gPWI8XM1C7K:stQBPXo+sV+FijiZWg6K
TLSH
T1DBC195066E28797B4CC6E518BF35BA47D2F9603270D61E58EBF8852C09DB6CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 240e64007a8e90f742940113862eb00ae0cb0cb8b8f8c1d64b1db7b9e1c7e325
MD5 4e49467bfb8d96eeb8d2b87f142791ad
SHA1 2bbdc6e95e386c683396adcfcd039bf5a776b8d1
SHA512 26ce6811dc6023d27a9930c754042820abf249b57bbc0c1495a0165e74528d191abba204bfd2421b8bd0fa1277c3e75f25abfacf1f8a1e3de14eea9566a4cf32
SSDEEP 96:vEi8Plf/ROo1pkF5d1Eip7VaTEv9V5h5pg5+e0yNGPr1FFOAMm/tq7:9ovgP9lXrsx7
TLSH
T1D9C195A7096CD5B8BF445BFBE8293ECE99B600DF89D54C1996D2C04807C2EFC21DA895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 e92c2f89745f786a7d88d56f1277a2e262bfb9938285458d2861b0b4a17a0267
MD5 f4f20dd407dd24c4cd8ee3c99edaff9a
SHA1 2f973d9d1eb20ec46f1ff978f4e44ef46666a024
SHA512 f1624b3775553cd009934ccf2fd8211f15f9b189808f8a23f6ccde56a729fd439697dacb4c5c36e43ec327585a4d975f077c39777c64c0aa813c269079ab9448
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Site Characteristics Database\LOG
Size 307B
SHA256 4799d08208b1ffa34942341e72886e448a9b2a7eb85acd0df12c8c8783c14185
MD5 f9f599b700e34d8acbe8422a7352754e
SHA1 3f4ef01df0f36d50b01ecc2dd0b2f245b895baaa
SHA512 6034b513e6d1f57e8fbd78707fecba279a9d49a0c9b74a654952a81e28ebaa82e2812f720f75e4a8da8748035c42205006cb85e0c07302a0a64c193771794d0c
TLSH
T17DE0262169DAC627434B18AF12B2B34CC6236405FECE12191FE8DAC82207304B062682
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Sync Data\LevelDB\LOG
Size 283B
SHA256 34c0137db75e4ad4c80b79b3f63749458fe129a50f883bdcd2e1593eb6aa8ad7
MD5 68aa4c05edbf1f88a4e48db238c7d7c1
SHA1 2f7d10a16862c0a12b9beab90e240a9931c68728
SHA512 a8fc8acff6f194b9404d4b06c123044c618af7155d00fd912a51f95154c040301382f0c7b5720056e1c617313fae4758e51738e4d94f12e09c29a51c7fb058e5
TLSH
T1C5D0CD3194D9C639494599EF06F1675DC67564097BC637495FC8D4CC2503304B0B45D2
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Visited Links
Size 128KB
SHA256 bd36cf1f4aef6808f4216e934ea443fd8373c82cc6ff6d4a568c6463726619d6
MD5 af9acbf1b56f164b3c41850c6d380dea
SHA1 81e32e1a8b3b9edee9385e8420231270400fd799
SHA512 7a578b58c2507e9d81b3221ea8e81c84cb176dccc55c4d2734f4cf85d86f04d7a447a21568afaae8e786e650de1df88716a2993ea052c6e9e52013d63e0ccc8c
SSDEEP 3:ImtVsMWhl:IiVsFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e70a3769-b636-421a-b078-b5c1d7691ecf.tmp

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\e70a3769-b636-421a-b078-b5c1d7691ecf.tmp
Size 6KB
SHA256 d30079c1da229f0c4a55acd0d788c0d76fe9c38272440810150f5d15b68676ac
MD5 ea814f0b6c34c913ed3133e6a6773d60
SHA1 a9008309131ef3ed43b2b7cfbdbfafc227bbe9e5
SHA512 1f5f28719f1a095dbe4d5abb4e1415ca749ef9a2ae16979872606bd6fa47b0de45b65d286aa38071eaed4c3816e01f272d8573630dde1008514cc2fb8f39e274
SSDEEP 96:stc/dHE5GDbDAkyo5h16ZZs7/x+6Mhmuecmje6K+gVQO28XM1C7K:stQByXo+sV+FijivQOG6K
TLSH
T1E0D195065E24797B4CC6E518BE35BA43D2F96032B0951E58E7F8462C15DB6CC6307907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\shared_proto_db\000003.log
Size 100B
SHA256 c83848b49a734f0892972625b70108d27abfc1a5b799d91c3ce11b89d5e51194
MD5 72be20d992cf12ff688d9c672a7edafd
SHA1 7d01a82eed7dd41776b04e0f9cc80059ea9715e3
SHA512 ed0a108ab089f3cde11da9409ff15ec94442b726863423c0e87eeaf47a3b112adb4b92d4d28ba0b0f01a2da112821d010186d3e40d0804dcca6c33a07385382d
TLSH
T1D3B00245B7806869EE9325305C130B083B30CC200E300DC387C831B45C6E362AD842AF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\shared_proto_db\LOG
Size 277B
SHA256 bcff1d4559bbb8b41c8f877b97e7e91bbd2910fef7b2b6f8d4364ba845503ac1
MD5 1ad56d319e13a365bd22a8825c3c2fd2
SHA1 01c535344cccd2050ba06123003ed85c25f7da12
SHA512 57cbaf3ad13c8a4566c7e36b4882ac0240ab3dfd89406e0108a65128ddaa2c5023decc8f5067606adaf1b09454bc7dc102f19cd4801544fbdb89944f6e07152b
TLSH
T145D0C211F8A9C4BF82685AAF22B26388C70A240ABED9264E0FC4D8CC2443308B565683
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\shared_proto_db\metadata\000003.log
Size 651B
SHA256 9c33d8e1edbd8c11c41fcced63741cf745a9dd96d55a31dbae0b7d03e26c4c33
MD5 2d8772875a82c28cd47559022d17c07f
SHA1 8d0ef437af6293c2738c8cf866229a21a6d26b26
SHA512 52d760c5780fdf6fd712cb2a0527e169af8b74b204ac830f70b589a6f9d661433044d830e52a73f07512c34eb611d3039743d5b6f4ec4bda0daaa3480e849c9c
TLSH
T1DDF0E546F330D020D246923B507D7B1A1734C8449FB4DD1F08B564201F717462E4B3EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Default\shared_proto_db\metadata\LOG
Size 297B
SHA256 d9ad9bd7f7f236abf075bc2527f1f1e51c176cac37ac5848160b5fe42d5f2e36
MD5 8c4f019949ba634852237a6c6b624d8e
SHA1 71b0ae913bc54a9e02f17095c86288541221e540
SHA512 01f6e7741b98c7c83825b94b135cd0dcacfaf3d7da3ee1481ab69a8c53d9d0c25765f7a97036985ead686a1c5bc963ba08c4afcdd5b4a43922da09042b6a2759
TLSH
T1BBE0CD51F859C4BB815659AF15F167CCDB16244ABFC51F4D0FC8CDC81D03304B55A683
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Local State
Size 1KB
SHA256 220fa938bfdf81c724c5061a7dd7610aa3dd043fc06348f78194b832b91ee023
MD5 2a6b01d819d2368ad75cb0e1d3265052
SHA1 920d88a51a15cb91e9f082d60e1d0de7c3b93fe0
SHA512 e2dfaeb81385471a72246e9d6a79708d55c8a58e805ac8f9c4954c08f0eb66061c7ee0231e0cd2ff499bd985b60c464e48876909292bd16ec233fe479a26de7c
TLSH
T1A52165B3F4645B37ACA17612A217BF575F31607BD2228F1426CE4A3803E706E9566C33
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\ShaderCache\index
Size 256KB
SHA256 29c95e74710cd384a6e838336ee4d66618ce4327a3f751954f19c31606038b27
MD5 d6157834b59551781eb03b8f50b47bc5
SHA1 819592d80d57763f3c27bd05c00cb87a1c76dab3
SHA512 aaf0a5174ee7fcad472d6784c70bb223b0366dcca92000d7542afdd7a7464c04165bdd235407466d46ad7b77c9e4ba4cbb6d2b61e65c6cdeea61dccbbfceb776
SSDEEP 3:LsOllllklkXlMqX:LsUlPMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\CHEATCTRL\wv2\EBWebView\WidevineCdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

b.dat

Path C:\Users\Admin\AppData\Local\Temp\CHEATCTRL\b.dat
Size 2KB
SHA256 3431c343c32318f524a73caf0d8bd44d367a42dfa494b8b5b36aac59ada57479
MD5 05d83de9086e2b63ec607a02103d426a
SHA1 858cd6357969c5d76534c546148a2ed4285375b0
SHA512 db4361c012a2b317298a34121d4903bdf7f1a1771cbb930cabd7103c7c0d1cdfa2430c2b78707468bb4fdcbe3771cd0b92655e1c9c8340875c35b46d7c897b0e
TLSH
T10F4133D4DB222C93D48A1BB496EF7F9820D2EC6993F386407F937434997B6519120F02
MD5 SHA1 SHA512 TLSH

Submit Download

b.dat

Path C:\Users\Admin\AppData\Local\Temp\CHEATCTRL\b.dat
Size 2KB
SHA256 03062f1eff06cc9b8540624347b5ee83cc028bf6495ffdc01e649371d789a822
MD5 575be6c32a9635a0eb73053d56125c32
SHA1 621598e1fcec2c079ef5a78b1f96ccb9ce770c1c
SHA512 e8840bd704d3c877dd1302ccb65fb373f0fb2f808551610bec773786e5ed9357b1b15c9db4a18bff90cf638b00e0fc8a97306d6f1038039be5d14422c8a76721
TLSH
T14F411FD4DB222CD2D48D1BB596EF7F9811D2E86993F38640BF93B4348A7BA509120F02
MD5 SHA1 SHA512 TLSH

Submit Download

b.dat

Path C:\Users\Admin\AppData\Local\Temp\CHEATCTRL\b.dat
Size 2KB
SHA256 52bf8f5b8aa2012672fd0f4f2f2f7c5fec25381430dd8428739cab8be3511536
MD5 a70e0e7ac60c65c063ad3cadaf6873f5
SHA1 ab06724e54aec5aae8097ef9eb1c14184a9a7749
SHA512 e977c3f7a33dcfa8816a3139f08f839494ddc72e967ca1937ceb32b4bb770bf1303603c227873127331fce957dcc68283d4a21f8591e5522f47a7042ddddb8c2
TLSH
T1555132D4DB212C93D48D0BB596EF7F9811D2E869A3F38540AF937471897BA50D160F02
MD5 SHA1 SHA512 TLSH

Submit Download

loader_next.exe

Path C:\Users\Admin\AppData\Local\Temp\CHEATCTRL\loader_next.exe
Size 1.3MB
SHA256 1916864d261a89cf7ac55aa226cff95a35193bfa0eff42df904280e56635312c
MD5 9e1aeda90e86c84b26adc03b36ee19b8
SHA1 10dd47d774e387c5b025d262130cb4813ee492b4
SHA512 33e7c0a3a2d2f8d7da2f431aa40966a4c358cdea8ee2c92b3c97394e781c03a9db8c909363691c1fd7516619eecfc5b4db29c391ee227af039c9f636a01b2f8e
SSDEEP 24576:pbFnf2IEbmlb8w2OtPNUHXhsgt9dxOsQAet:pb9AbYbO+sVxW
TLSH
T1AE558D29974102B9D476C1BDCE638551E2767C5D4BB24ACF0BA4BAA12E335D88E3F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\_metadata\verified_contents.json
Size 1KB
SHA256 a6ce8c1d0d27c54034e67a83270bf3fd2bdfcc45ffc4b9084357169c00c90f77
MD5 42b331a107b7320d16f115eb7872b3c5
SHA1 3438a81f13c76becc7eb8bf0a7881088e5ad358b
SHA512 afc9393c7a63ec8d95c708eab601ab76887e4600a03b10f3c8c6e6c78c1c48d8b8bc6f059f8f38e66f1e54c5040656b75b6d46b91a795f76dbb5d3c6ac59b333
TLSH
T12F31B7414DD5369EA14E42245AB873AB9F0E71B372C8A51DA9C5900CF4F914ACBD308F
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\_platform_specific\win_x64\widevinecdm.dll
Size 21.9MB
SHA256 e1f9ad648017e2cb0f0cd798d815dc51012b279ba32571e7b6eb5120b0ed2c05
MD5 046fdd0c07bbac0c160b03a2cea5ad4b
SHA1 fbe9107b962ff2c77070579a8769ce7188c4b473
SHA512 0a3e385a3d27883e6495e4cb4fd20bd5dd0c61176e04df2762fca9d13847c9ae88de7ac57648732ce6d6cce27f2eb9da4dbf9c54d1953504de784c4cb35c8fd2
SSDEEP 393216:DKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHk:MWCmz0dwJIkpqCw
TLSH
T15A37E14AE35350E9E81ECDF0866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\_platform_specific\win_x64\widevinecdm.dll.sig
Size 1KB
SHA256 868171d91275d1e180a452621f66428afec0a9288ab96344ce92fc904ac1f70d
MD5 c7bf17a2f118fdb4a4344196706b6393
SHA1 d07695b35bf2f4bd746586fe56ce2ae9d7c99f69
SHA512 11abb5b2ea4120df63216ac38aa85c8deaa7d96b9e0a8867b8f281b0652211f4600bd4107d182f3ea0c657d8a1675ff56d0279837a7c33410a7968f2c5a9a754
TLSH
T1742108F4A215A94A7F50C142053DE827CF3E8AC12C6188B644BFC23628EE7C00F8457C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1218174682\manifest.fingerprint
Size 66B
SHA256 56d1fe98928ebd4be664fc103e35673a15c2dfa98ff241478bbd39beb15a0754
MD5 bef72178d2d9f61006676a8323ac4a20
SHA1 281541cc22aaab5d71703791192ef66ee2e831ba
SHA512 ee3664c72ee9a894249799b642ed8c1f10b7a7a422d1277d7097f43b4f892d7b267200d323f861bb90b0436262da13dd3c674c4425dfdc264c1cce3755a593a3
TLSH
T154A022CE0CC208BC30008300FC8C8B222000282823280022F8A023CA32EF30AB000C02
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1757644537\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1757644537\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

memory/824-286-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/824-0-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/1700-541-0x000001D1EA160000-0x000001D1EA161000-memory.dmp

Download

memory/1700-535-0x000001D1EA160000-0x000001D1EA161000-memory.dmp

Download

memory/1700-537-0x000001D1EA160000-0x000001D1EA161000-memory.dmp

Download

memory/1700-546-0x000001D1EA160000-0x000001D1EA161000-memory.dmp

Download

memory/1700-542-0x000001D1EA160000-0x000001D1EA161000-memory.dmp

Download

memory/1700-544-0x000001D1EA160000-0x000001D1EA161000-memory.dmp

Download

memory/1700-543-0x000001D1EA160000-0x000001D1EA161000-memory.dmp

Download

memory/1700-545-0x000001D1EA160000-0x000001D1EA161000-memory.dmp

Download

memory/2388-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2388-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download