b13029af04e175dce4eb41fd04682121ab62a9f7b9106ef6e2e8261f6acd085f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 8.8MB
Sample260511-d13lasd15r
SHA256 b13029af04e175dce4eb41fd04682121ab62a9f7b9106ef6e2e8261f6acd085f
MD5 18e0d4a8f45b08ec5c6313fe963e9985
SHA1 4c576adfafc7e69606c8db090dedf38fa57c77d8
SHA512 227652d965e16eab3f35ed0b6c1f7462a953ed6e1dfa7459b4df1d0f86737a6d899d4d8889e9d6ed0dbdaa800b45aeab64dd761e9d9dc9f90be7ff1d2b0f8573
SSDEEP 98304:9DxgcMMvi6pj3I0vv4qV92TE65CixSBC2XaxNU:91mMvimjb34qV92TE65FSBjXa/U
TLSH
T16B969D1BA26901F4C0A6D178DA438D13F672748A433596EB3BDC45161FE7BE0BE39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
behavioral1/memory/4568-0-0x00007FF6BBBC0000-0x00007FF6BC491000-memory.dmp	INDICATOR_SUSPICIOUS_USNDeleteJournal

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral1/memory/4568-0-0x00007FF6BBBC0000-0x00007FF6BC491000-memory.dmp	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
behavioral1/memory/4568-0-0x00007FF6BBBC0000-0x00007FF6BC491000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral1/memory/4568-0-0x00007FF6BBBC0000-0x00007FF6BC491000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1632	powershell.exe
1408	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Executes dropped EXE 1 IoCs

pid	Process
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\S:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\U:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\V:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\X:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\Z:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\H:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\L:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\P:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\W:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\Y:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\D:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\F:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\B:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\E:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\G:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\K:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\O:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\T:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\A:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\I:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\J:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\M:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\N:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\Q:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3348	tasklist.exe
4648	tasklist.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Part-FR	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Part-ZH	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_1507577766\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Filtering Rules	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Part-ES	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Part-IT	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Part-NL	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_1507577766\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_1507577766\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Part-DE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\Part-RU	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\adblock_snippet.js	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3700	net.exe
1604	net1.exe
1152	cmd.exe
2620	net.exe
5044	net1.exe
4764	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1036	timeout.exe
2352	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229438002630093"	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
4568	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
1632	powershell.exe
1632	powershell.exe
1408	powershell.exe
1408	powershell.exe
1632	powershell.exe
1408	powershell.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4736	msedgewebview2.exe
1080	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	tasklist.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeIncreaseQuotaPrivilege	1632	powershell.exe
Token: SeSecurityPrivilege	1632	powershell.exe
Token: SeTakeOwnershipPrivilege	1632	powershell.exe
Token: SeLoadDriverPrivilege	1632	powershell.exe
Token: SeSystemProfilePrivilege	1632	powershell.exe
Token: SeSystemtimePrivilege	1632	powershell.exe
Token: SeProfSingleProcessPrivilege	1632	powershell.exe
Token: SeIncBasePriorityPrivilege	1632	powershell.exe
Token: SeCreatePagefilePrivilege	1632	powershell.exe
Token: SeBackupPrivilege	1632	powershell.exe
Token: SeRestorePrivilege	1632	powershell.exe
Token: SeShutdownPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeSystemEnvironmentPrivilege	1632	powershell.exe
Token: SeRemoteShutdownPrivilege	1632	powershell.exe
Token: SeUndockPrivilege	1632	powershell.exe
Token: SeManageVolumePrivilege	1632	powershell.exe
Token: 33	1632	powershell.exe
Token: 34	1632	powershell.exe
Token: 35	1632	powershell.exe
Token: 36	1632	powershell.exe
Token: SeIncreaseQuotaPrivilege	1408	powershell.exe
Token: SeSecurityPrivilege	1408	powershell.exe
Token: SeTakeOwnershipPrivilege	1408	powershell.exe
Token: SeLoadDriverPrivilege	1408	powershell.exe
Token: SeSystemProfilePrivilege	1408	powershell.exe
Token: SeSystemtimePrivilege	1408	powershell.exe
Token: SeProfSingleProcessPrivilege	1408	powershell.exe
Token: SeIncBasePriorityPrivilege	1408	powershell.exe
Token: SeCreatePagefilePrivilege	1408	powershell.exe
Token: SeBackupPrivilege	1408	powershell.exe
Token: SeRestorePrivilege	1408	powershell.exe
Token: SeShutdownPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeSystemEnvironmentPrivilege	1408	powershell.exe
Token: SeRemoteShutdownPrivilege	1408	powershell.exe
Token: SeUndockPrivilege	1408	powershell.exe
Token: SeManageVolumePrivilege	1408	powershell.exe
Token: 33	1408	powershell.exe
Token: 34	1408	powershell.exe
Token: 35	1408	powershell.exe
Token: 36	1408	powershell.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4764	4568	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	86
PID 4764 wrote to memory of 3700	4764	cmd.exe	88
PID 3700 wrote to memory of 1604	3700	net.exe	89
PID 4568 wrote to memory of 4384	4568	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 4384 wrote to memory of 3628	4384	cmd.exe	92
PID 4568 wrote to memory of 4736	4568	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	93
PID 4736 wrote to memory of 4328	4736	msedgewebview2.exe	94
PID 4736 wrote to memory of 944	4736	msedgewebview2.exe	95
PID 4736 wrote to memory of 944	4736	msedgewebview2.exe	95
PID 4736 wrote to memory of 944	4736	msedgewebview2.exe	95
PID 4736 wrote to memory of 4700	4736	msedgewebview2.exe	96
PID 4736 wrote to memory of 3048	4736	msedgewebview2.exe	97
PID 4736 wrote to memory of 3048	4736	msedgewebview2.exe	97
PID 4736 wrote to memory of 3892	4736	msedgewebview2.exe	98
PID 4736 wrote to memory of 3892	4736	msedgewebview2.exe	98
PID 4736 wrote to memory of 3892	4736	msedgewebview2.exe	98
PID 4568 wrote to memory of 4620	4568	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	99
PID 4620 wrote to memory of 1036	4620	cmd.exe	101
PID 4620 wrote to memory of 3348	4620	cmd.exe	104
PID 4620 wrote to memory of 204	4620	cmd.exe	105
PID 4620 wrote to memory of 4648	4620	cmd.exe	107
PID 4620 wrote to memory of 3036	4620	cmd.exe	108
PID 4620 wrote to memory of 3496	4620	cmd.exe	109
PID 4620 wrote to memory of 2352	4620	cmd.exe	110
PID 3496 wrote to memory of 1152	3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	111
PID 1152 wrote to memory of 2620	1152	cmd.exe	113
PID 2620 wrote to memory of 5044	2620	net.exe	114
PID 3496 wrote to memory of 3440	3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	115
PID 3440 wrote to memory of 3472	3440	cmd.exe	117
PID 3496 wrote to memory of 1080	3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	124
PID 1080 wrote to memory of 4424	1080	msedgewebview2.exe	125
PID 1080 wrote to memory of 3880	1080	msedgewebview2.exe	126
PID 1080 wrote to memory of 3880	1080	msedgewebview2.exe	126
PID 1080 wrote to memory of 3880	1080	msedgewebview2.exe	126
PID 1080 wrote to memory of 3724	1080	msedgewebview2.exe	127
PID 1080 wrote to memory of 2700	1080	msedgewebview2.exe	128
PID 1080 wrote to memory of 2700	1080	msedgewebview2.exe	128
PID 3496 wrote to memory of 1408	3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	129
PID 1080 wrote to memory of 1736	1080	msedgewebview2.exe	130
PID 1080 wrote to memory of 1736	1080	msedgewebview2.exe	130
PID 1080 wrote to memory of 1736	1080	msedgewebview2.exe	130
PID 3496 wrote to memory of 1632	3496	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	132
PID 1080 wrote to memory of 2308	1080	msedgewebview2.exe	138
PID 1080 wrote to memory of 2308	1080	msedgewebview2.exe	138
PID 1080 wrote to memory of 5012	1080	msedgewebview2.exe	139
PID 1080 wrote to memory of 5012	1080	msedgewebview2.exe	139
PID 1080 wrote to memory of 1032	1080	msedgewebview2.exe	140

C:\Users\Admin\AppData\Local\Temp\2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\system32\cmd.exe
  /c "net start w32time"
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:1604
- C:\Windows\system32\cmd.exe
  /c "w32tm /resync /force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:3628
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=4568.5080.12215655182614344764
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffc39d8b078,0x7ffc39d8b084,0x7ffc39d8b090
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1728,i,13579929479767884923,15660839826134254727,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2040,i,13579929479767884923,15660839826134254727,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:3
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,13579929479767884923,15660839826134254727,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --enable-gpu-memory-buffer-video-frames --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3620,i,13579929479767884923,15660839826134254727,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1036
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq LoaderNeon.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\system32\find.exe
    find /I /N "LoaderNeon.exe"
    3⤵
    PID:204
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Loader.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\system32\find.exe
    find /I /N "Loader.exe"
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe" --post-update
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\cmd.exe
      /c "net start w32time"
      4⤵
      System Time Discovery
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Windows\system32\net.exe
        
        net start w32time
        5⤵
        System Time Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2620
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start w32time
        6⤵
        System Time Discovery
        
        PID:5044
  - - C:\Windows\system32\cmd.exe
      /c "w32tm /resync /force"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3440
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /resync /force
        5⤵
        
        PID:3472
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=3496.4408.11565658283664551142
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffc39d8b078,0x7ffc39d8b084,0x7ffc39d8b090
        5⤵
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1812,i,3537618155639924715,2823118201675941896,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
        5⤵
        
        PID:3880
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1876,i,3537618155639924715,2823118201675941896,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
        5⤵
        
        PID:3724
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,3537618155639924715,2823118201675941896,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
        5⤵
        
        PID:2700
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --enable-gpu-memory-buffer-video-frames --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3536,i,3537618155639924715,2823118201675941896,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:1736
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4676,i,3537618155639924715,2823118201675941896,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
        5⤵
        
        PID:2308
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=760,i,3537618155639924715,2823118201675941896,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
        5⤵
        
        PID:5012
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAADCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4856,i,3537618155639924715,2823118201675941896,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
        5⤵
        
        PID:1032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1632
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1080_1507577766\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1080_1507577766\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1080_508125016\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b0afc3da2392e562807fd75eb884e4788ed4b227ab1052e4555ef7cc0ef3f2be
MD5 432763a6b76fec678dd4d3249ffba039
SHA1 257d181c8d3d72a7d09542d79eca7f7ff0fe51ae
SHA512 879f668cf3a67831d0ed8b08c06e088779ce510322760fcce938290b7f55b085dfc7d362003de1d44942e7ce0597ba660fd7bf148aa5ce54d2bc629dacab6ae6
TLSH
T13441F858A6EE114CB3B76E56AFF3A95E087EBC372F06949D10110E4F0A27A40CD61B33
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 15063607abc9da40afdd3a4360b3f9527271a4eced8c48a2c460cb70c82bf85f
MD5 450a27c7ff7af0116cc0100b75d8c320
SHA1 ce091ceea8449e6171a99ab2315641eb3e29a787
SHA512 235e2cd45061161027a36f108842c0d0cbdff30f11b2d4ceb853773d3a634b6eda3769d28f231876dd45a6ccef403774cdef81b984ff9f2927b220bd1e1916e3
TLSH
T1BA216527B39CC821CC95153A109CAC55327683C7809ECF8F6EC0D225A07FA84CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

LoaderNeon_new.exe

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\LoaderNeon_new.exe
Size 11.5MB
SHA256 85fd78530f21747d540c5363b1ef635e4a7a2107d1c992a919ebfcf4dbed8c79
MD5 c22028836ba21150d32a2be976749c83
SHA1 29ab8a455e670a96cd2c9c5635ad74f201f5455f
SHA512 b6f72c369735decbc4fb6122a620f7cc97ec8e3ec9b5427a7abb51a1bbfc57b7c9bab52dcb857c8fed950d31b6e141fbdc0e27a3f3c7e76f452614d20d95418a
SSDEEP 196608:kaY29v7pS9iL5zsAuUZIbCMDP6tQfi8zeNczIClsepO:7Y29vNu4ZvczhM
TLSH
T1ADC6BE1BA65801F8C0BAD0789A478D13F67178894334A7EB7B9C46125FE7BE4BE39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.bat

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat
Size 2KB
SHA256 c495275b5e9f764c29d45dd609e839a8678333022c470b951902222bf0b14a3d
MD5 5874eadf75be4fa3f5046fd4f9964cf8
SHA1 e5d2c7415db37758f58bd7738cc7837e9c3cf386
SHA512 501afa1f7c14b526f813c4e98962c3f428adc7da08ab86853f03111968da0075d2ba5b44ca3a8f5ce0ce3d02e7b3f124ea378aa0bb15cf94d6712dd1a2987c91
TLSH
T10251EC02426BCF5B4012946B46B2461FC5AE844F5F126B537AA8CD1E73C248FAECA7C8
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_u4lhzmqx.etl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u4lhzmqx.etl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9d28d3c72cc2c808a0bab4903bab36e56e7b1bfc1c0224b29775efff800bc20a
MD5 542edd7305a2ab29d0104414148a61ef
SHA1 d741b08559c57e2e519010fbd31aab03adc87842
SHA512 302d42190b24faf142405aa5573856a71c85d5b1d4be2d0f35b6a247573810bf94d597393a3e533779c7b4886f4b57b0d2b185f93a0acb00af6a355b37cf5722
TLSH
T188D012163B410134C1202073064261490800D54B404541809C38961D1A440A04902481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 75beab206bc0b1d34e5ae96254a606a52cc473b9d1e5c7a1ad511ce0ecbcca44
MD5 214e1aca113c145556f66c241d440f9f
SHA1 c286790e8258ca31bcd65f66343ce33927de2c2a
SHA512 64d20de3f911f0886ebf78a2cb4159f7011cdef83b73903bf773a55cdce220baf21723103fcf2092f23513eef34744a4ab9ecb27d492a989ad0b9be6ef1f43a3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Local State
Size 1KB
SHA256 165f1002a826595e220d70ae54a41a3f978733533f5657801750d90bc461807a
MD5 23316b931d620679102fb35d971f1ac6
SHA1 f4cd40a5f9c3a827ba087cebc9a5dce00f6c231d
SHA512 fca645b4c8c89c0499f4ea1a22b8bd7f255a01f70493f557d290aa8ff26aecf5979cd70ba99ff171b6ad74eb90ed5f5a78fc6daeb64f2765a28af0da3ec9fdf4
TLSH
T18D3185B7F8942F3758C19E06B3416B4B7D20503AC2144F58A1DD0F0C43EA18CE16AD26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Local State
Size 2KB
SHA256 16017ca61044c8d578cdccd5bebe902e52676742da62c83281f2726bc461f1fd
MD5 65fb0ddb9a6d98a4adab5e65dbdeb29a
SHA1 cebefe26e6ff01ec0d91c7168138949aa5977218
SHA512 6dcddfab428c988837807d55b6da6b2612c737867735877e88cfa558af756f794318586403d276bd47ce1700dfe97e89b0966725e0285d18f4dba7a6204ca9a4
TLSH
T1A0519473BC186B3789E28E05BA457F13BD35507597A52F60A5DD0F0C02EA59C3346C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Local State
Size 3KB
SHA256 f80fe03cfb785a09b6a585a8a656a42bbda582af6a9e0338e188eb1a7b81d20b
MD5 00941e2c3fda6ad63cb84cc4b1b3a9a1
SHA1 4a5fcd9fc734d281d3db692b8acf2acc199038b4
SHA512 622318bd8d466695e2d558b14c2ab4c76d3f6939bff9a0b17c80fb3fb1844a7ba8b9d587eef980220ab30c8785421fc42585fe3dd1abef028bdde17df07031ac
TLSH
T19171A777B868AA374DE39E05B9852B06BE615137D6D53FA8D5EC0F0C02DB29C2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Local State
Size 4KB
SHA256 828462331c55418ee5b218f330564fb8f14d2ce5ad14a58753130d3ad2bd78e3
MD5 57846520d1f268902080774d523c2709
SHA1 76421952c47ba8bbbc7747ab869bd45e92bc8dcc
SHA512 0c1a92d05df86d7ff58705dc0cded0056e90e4f626fbd6264643e7a2a3203714447e48f948c5de7051e9ef0c85369a72bce57eea50753dfe2e65c1dc29b297d3
SSDEEP 96:zuIhF3NkCE8YPbYcfkrRkO58Frh/cInURoDotoT6QjZDnBcwE67WZkvZETulkDa:zvF3NbLYPbYNrmNooDU4FJBcw38S
TLSH
T1A891A536A8749A274CF2DE05B9853B07BAA54037D5D52FA8D9EC0F0C02DB29D2342D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5846d8.TMP

Path C:\Users\Admin\AppData\Roaming\1575709424\Overlays\EBWebView\Local State~RFe5846d8.TMP
Size 1KB
SHA256 bc979353ff1a5fde8be0154c9026c1481d177751b438377dc56da1965ec4d4b1
MD5 aa2e6f42fd4f7e15ffa7d242106517da
SHA1 ad6ff3ae6e50e4fe48bd2bd3c97cf04b23c437ea
SHA512 fa1da9c319c8cd8174906e8140560bd7f88edee9f4188d81d0c8e2f921365064d9c4081e6ec60263b3538c6499058962356f5f57331da11c6bdf935e9199bc97
TLSH
T1592187B7E8582B3799815D15B341AB8B3D20503AC2185F1CE1CD0B0C53DB49CE2BAC33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4129631b09b8ca756151684236882b0681b750793f420c5d1cbfdfd9f81ff17d
MD5 3aa50c11f6661cc5572bf964a150a027
SHA1 12c17c850b346004696afa2b952dbd4d7352514b
SHA512 c74f948b049b680bba80805d1694d559e2b8a6f2cf55172b84dfedd6fbf9df86c45b7a08abd4b0784ce8f30294cb4763e4db98ba62c030e750c0a37d40807a0e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ead0a66cbc2c7802b9b54e224b502c0623974584d69e1562f20cf56a2f63e43a
MD5 a9e1a8451db4fffca1ebbf8bec9bf0d0
SHA1 68189a0993c6f4bfaef5c313ab8de9bfc86ce98e
SHA512 76126dcf9a5b9985ae1b68536f6ea9ed09539420c04b870985434b8cd68f029223c8fbb9be18222e5edf4783591cc7a2660dd6dc567341fed5d0f5a877fdd5ff
TLSH
T17CD0121232015234C81029730002B10805C0C30B410E44019828891E1A580D00913851
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 9a79b4ebcdfef107d560af14624c8abf29cb0a80b9462877ffb98f986c07f505
MD5 1e7114ec8d95de653cab4794dc43a0a9
SHA1 032c2d483dfbc63928868952479420a51f82bcd2
SHA512 746ae6b9d5ef00b355cb45e859cc0d14a9dbc72709eb83d5e7c0f49bcd3294e8134ad1d742762b0215c8d5ec2249572c369ae37fea221d59d478cf8f846194cf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 aeb914a996ad3f778f11673b3ebd603cec435a0ba3a9ffc64e379b8d11463cbf
MD5 8c7c59619c3bb401187a9624eee4796b
SHA1 069ea6db2c869172932d2aa68ee3fadb200d32b8
SHA512 1635cad1986266e1d41cf0031e137eb8bc8c5c689b4bdb3239d96bab37f457e602fbf5d981f15ec5c777ced924a65f2473905b4607a56b06128f413ddfe545cb
TLSH
T169216684E46244E6C71FDC7B29F5BD04B67CC06849971ED573A7F4748328F46C97421A
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 7b2d368e6e573858ea59506b20382beaaddcceacc7f75517497c18407443ce64
MD5 8b8a4877ee153a30f90c1a8c61f76a83
SHA1 ea93bfbc9f98b6a895d74df9b6564b48d5e744d4
SHA512 4fdab1c50d6f581a60aa353ed78d2bb5cc657fa50fcbb0135e3db54ffe16922e870494b9976c3cd02c9ce98ea1c211d70d4373ccf73cc172ba66dd9fa6e0f406
TLSH
T1953189E7C7E4452CD94206F92B65292FCE1D1D1043283DBAC9E5BF8E93E0820E3006AF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59d8f1.TMP

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\Network Persistent State~RFe59d8f1.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 6a2f1558b22b4702672bbbf46a7c48383c799b30eed753a0dd6b35f060e82fa7
MD5 f1430a154ff1d70c7a989951f56a093a
SHA1 6ae9b6e743f1274b9f542f601e7751db0534a74e
SHA512 5c59ce6102b09c3feb3be988a45385e11c4470e4831ef286e6550a4f469983a46e7280dc549a1f5d93f5b9c379332469916da39aa45945a73502184291b60490
TLSH
T17AF059B3827EE47650788DAF0D44BD06AE7BF8754093B0FAC736426CA430AB39602423
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 361360e039c686bd74a435e14ed7f6159d55403aebf1d3e59ee715e3ea2be932
MD5 291a2813a46ab22ac6be60d002d640ce
SHA1 28eb91dfa2c4a87bcc1abd264536fd0598970f30
SHA512 3afeaecd472586f1c9e3381422459a0caf2bdbcb6ecbe5d09251c60622979ef08dd478f392a8417ffac834adcb99709772d3b5cd093e36e3f76638924509d955
TLSH
T134F05973827EE4365078496F0D087E06AD7BF8758093E0FAC726416CA4349B39A03423
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 b5a6bb736e7a9cbe020e986fe64f3263b438a2d033529a331f143a14f4a410bd
MD5 59fdadf19377faa19674e6fea2dde045
SHA1 4d71b83a5a4ef28b00a4f26e512a5d8df9441bdd
SHA512 02973bbb105801be74018094fd21f1988abe1f45ae9af9501a020f11cbd6977ceec752a3477a6ebb8fefc6321d5bdce7b44828b7d49eaa38f5d60e5fad9a8262
TLSH
T14EF0597382BEE436507C89AB1D087D06BD7BF8754093A0EAC72641ACE434AB3A602433
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 860a7a85581de0e596519044aa58953ead7fcf952ed2acf13d87c202f4fc02e6
MD5 ea6ad4976d78b5423f7cbc8aedfed35f
SHA1 19d2992c7705b80bb3fe742ed0e15747a3b35198
SHA512 194d5a91730eff8409e9d15bca64825df9f8ac3f8d84b2117ca2d5dc0cfae032fdd67c9999609897f4925b912e6378e8e354b277feeddb61c46dd736618074ac
TLSH
T15BF05073C57EE476507C896B0C087D06FD77F4754093E0E6C725415CA474AB36502433
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 4cf126b87e35ca67a5fa746a1532e7855c785779631a8784d68f6e18be10ea6f
MD5 9682e409ee747d0f226b10805ace4d73
SHA1 64894c3be629023f025645d6dbebc66daef38a95
SHA512 823e0d6eacc6486de8a5bdb96d09bfa26b0526c5d762319784123db123d3b7d12a5d23c32bf2f739c2f00697ffa704892bd518c765cc6a70496ffe94982fa24d
TLSH
T136F05973827EE4375078896F5D047D06ADBBF8754093A4FAC726416CA434AB39602427
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 2bfae7f4f3abc1992a826190ca86f105c07869f4262a7a25e1686c4082305709
MD5 06b38200a8034449843840b9e4be39a0
SHA1 0d929113e86cad25817900dc027b7cf7582bb213
SHA512 0766cba0482ad605ebad1d87521b0042423209f0250f0e20ccb8f03ac8e713df0ceee8d5bbb5c0f506726e4fa4d7f44eeaf9f1b5168d92c8e9f2fa6d59608187
TLSH
T1D6F05973927EE43650B8896F1D047D06AE7BF87540A3F0FAC766426CA8309F39A02433
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 37e32eae99a6307a3e2315f26c714bdd9b31943dc0645873d9ceb075dc89dfb2
MD5 5a8fa586c086558c09551cfca8a43d30
SHA1 d7f8b4610ca718438d927882aa60af7358e644a6
SHA512 6aa0c094a13f6c6f636c6a0af270cbd076c6389c3f0a46e59fec2bb61eb9ab5288d97a1426800b3957a38873deeeeca3950862765b8e90bbc0b9fc2c4332bd0f
TLSH
T17BF0597382BFE47750788A6F1C047D06AD7BF8764093A0EAC726516CA474AB3A602433
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5908e0.TMP

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Network\TransportSecurity~RFe5908e0.TMP
Size 522B
SHA256 18c8d0343e767675e70275070a8d13ef6b7fcbfc8ece1bb4c36c3a3654bdba4e
MD5 c75e110e069ff6721591de4817238172
SHA1 7a279f7553f6bce7b4f146aa6d01219f562a387a
SHA512 9e284c184e4c226b0716b3c56af754bff53bee96436cc8ed23f38701197daf3390353f5de4f5a2844261ef4d2994131076e65dd431752982d076a53dd28b7b26
TLSH
T18DF0503381BEF47710784D6B5D047D067D77F47640A3A0E6D666411CE4746B36202033
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 6610d60d2ffab6ad85fcc26c0901909077124a4cdb8a44438218596b0735ac26
MD5 b8398064ed86a6ea73372c8367b9c20b
SHA1 d1978b1a8fb18d3ee11a8fdbb17409318ee07acb
SHA512 e85e72f44c8308e281f7d34f95d7ba11fc24739904a90ccb6d8ca3fa96752806944f1bec774227a15566ba006b28eb266c503dc26481fa1e5eda781841c2e2c1
SSDEEP 192:stH0yZsbfgZ8paCQ/S+Wi99rwYFd/TvMC:stUyZsbH8/VXwpC
TLSH
T167E1B8136E6859775CC7E72ABA35FB12E2F5502262D50E98EBFCC64C04E65CD520BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5950a7.TMP

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Default\Preferences~RFe5950a7.TMP
Size 6KB
SHA256 fcf8623d4949010880ee170f4ac5c29d77f1f755dd8c8c6cbeeb8440f79857e1
MD5 9efee8b6ffe287268c236742bbbb72c0
SHA1 3d9b3d5d147d2a320fde9265632f2f925b1396a8
SHA512 68f6ca2a1b6073efea1a4bd682ab6eefbf251e9152d64bdedb5e8f6f2c365682cfacdb900e674b37bfa2ceff10f4c7534d4d816c1e947f721e4cb2d188fa90b1
SSDEEP 192:stH0ySsbf8Z8paCQ/S+Wi99rwYFd/zvM8:stUySsbL8/VXwv8
TLSH
T11FD1A9139E28A9774CC7E329BA35FB12D1F9502166D51E58EBFC864C04E65DD520BC0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Local State
Size 1KB
SHA256 8cb2391461bc83ed63a731f08cb40633b4a28d4bcdcde1b2aa405dbce8e8972d
MD5 d595ae7aec9f48f889c6a3e504dfed45
SHA1 bc8cc0f8aad47ef7b32dd46fdff1b707b99b9af7
SHA512 c7f4f796332bd0f02a1e85cb37194f033c8fc47b8b4f3718834c96efa28c855d63c35f700731eaab97f9bed50cce492758ef4f26a7a3454ab91ca1ede7c06206
TLSH
T151316572B4A45B3368C16646F642AA433E21D12782514F68A6EE8B4C01E769C5A35D37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Local State
Size 2KB
SHA256 09333f5b4d2084928884faf46faf690ecaec51ce0471e5b5637a4c65a69130ab
MD5 4882ed27defc757033d14c505aa45a06
SHA1 ab56e20f0326c1d74a09ed4d95cd67ad17145fdf
SHA512 1768d01e0ff4fb8825f1209a69510d78329a6c7d61a5484d69f8e0b5bdb7c3f2bdcdb95742905bcb9814c756e7c90f75bf86fb58713e5f43c9a2dee39cbae8fe
TLSH
T12B51C733B818977349D25644FD466F136E35D16296612F74D9EE0F4C00EB6AC2301C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Local State
Size 15KB
SHA256 2174706425662ac5a87579e998ea3e3bc5638698eeb00593f120b43bf5ce808f
MD5 f43a5c41227efa1121ce11a89387f49c
SHA1 d6f141814f0e191af864e032d1f51b8778edf74b
SHA512 7b9137153de568b66a23a87a88ea21877a0c922e9816fae54c31b34dd0dcd4b77d90bca46ab5181f38b6ae8a2e4e1c6dab2055d7c596bd179bdc0b223541fb2f
SSDEEP 384:z1vsrvyOiyp4+IWA1eUVWGfvvLhNbL07bHHlvhcFJ3:B0raxyp4sQe6WGfvL0flvO
TLSH
T18C72AE721BB489379CD5A947BC8F75077EA8C46BD9C02F98A8D4AF1F004B28C1706C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Local State
Size 3KB
SHA256 2b92a57af91a6dd186938a4a15886b2f051a923f5a73dd915797c1a17fd440f1
MD5 5e859cde3237ad9c9dda7a78d0819251
SHA1 26ac1e9efcb02f98c035a80bd637cf45c739291c
SHA512 ba9ce3c03dcfff80bd9f2252da5406b78fc8039fa2d9a22d0ab0f85bab004e835a54fc5b87794b08f919bc35af416f04641d34bfcdc33cf454da16b20fa5e6cc
TLSH
T1A371A537B964D6374DE29A45F8852B027B659133D1913FA8D9ED0F0C01E73D81341C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Local State
Size 4KB
SHA256 19421fec0f7b58837430d2901184781631ebe791a207c8c36ac52c16b8e8083c
MD5 1812171dfc84211f707b3d0065443d15
SHA1 0f89f730dabb7f8527b193c570ea8149bad8055d
SHA512 140c8ff45eb474692db3515e25fb1ad652f97494f397641895f7c2f8ac463deff0de417a1575e234402ead0e66a23b03de0e03aec02dc699f546c2492fb08fe7
SSDEEP 96:zu+tbNkCE80Wfk9858Frh/cInURoDotoiSADQBKYc6helZfZSTOl9a:zZbNbL0H9ooDUDXUKYHOKr
TLSH
T1D391A536B9749A334DE2EA45F98A2B037B649123D5953FA8DAED0F0C01EB3D81351D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58b3da.TMP

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Local State~RFe58b3da.TMP
Size 1KB
SHA256 2d4e87d32a8a805c7e6e3a599ac785249dadaa285a75ae629f115b7e1c4e1c21
MD5 ad6dec389ccfa066ffdfefa184a3fded
SHA1 40cf347f7cb076fef39a45e0a4f5fd1b6f102d52
SHA512 6973146da231e9744bdc83fc1de5e9420e26c6aec49657c2d420e3cb10300845cc4fa64168368dd79e1e69b300235eefbf3bc4ad0bbddf7815ce54f623eec294
TLSH
T157217233E8A86A3268C06541F252EB432E10D13382104F28E1DE574C01E7AA84A35D33
MD5 SHA1 SHA512 TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\1575709424\WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-303-0x000001B64E510000-0x000001B64E63A000-memory.dmp

Download

memory/944-27-0x00007FFC55B30000-0x00007FFC55B31000-memory.dmp

Download

memory/1032-1027-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1032-1032-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1032-1028-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1032-1029-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1032-1030-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1032-1031-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1032-1020-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1032-1026-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1032-1022-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1032-1021-0x000001B9E4B50000-0x000001B9E4B51000-memory.dmp

Download

memory/1080-732-0x0000025B82F00000-0x0000025B82F2C000-memory.dmp

Download

memory/1080-733-0x0000025B82F40000-0x0000025B82F4C000-memory.dmp

Download

memory/1080-751-0x0000025B8AD90000-0x0000025B8ADCB000-memory.dmp

Download

memory/1080-750-0x0000025B8AD60000-0x0000025B8AD87000-memory.dmp

Download

memory/1408-587-0x000001D7331D0000-0x000001D7331DC000-memory.dmp

Download

memory/1632-579-0x000002156CF70000-0x000002156CF7C000-memory.dmp

Download

memory/1632-489-0x000002156F1D0000-0x000002156F1F4000-memory.dmp

Download

memory/1632-470-0x000002156EF70000-0x000002156EF92000-memory.dmp

Download

memory/1632-488-0x000002156F1D0000-0x000002156F1FA000-memory.dmp

Download

memory/3048-78-0x00007FFC55900000-0x00007FFC55901000-memory.dmp

Download

memory/3048-77-0x00007FFC54F10000-0x00007FFC54F11000-memory.dmp

Download

memory/3496-314-0x00007FF602670000-0x00007FF603203000-memory.dmp

Download

memory/3880-734-0x000002E3648D0000-0x000002E3649FA000-memory.dmp

Download

memory/3892-114-0x00007FFC55B30000-0x00007FFC55B31000-memory.dmp

Download

memory/4568-0-0x00007FF6BBBC0000-0x00007FF6BC491000-memory.dmp

Download

memory/4568-197-0x0000015AE0FE0000-0x0000015AE0FEC000-memory.dmp

Download

memory/4736-304-0x0000020F1CE60000-0x0000020F1CE8C000-memory.dmp

Download

memory/4736-305-0x0000020F1CE90000-0x0000020F1CE9C000-memory.dmp

Download