b13029af04e175dce4eb41fd04682121ab62a9f7b9106ef6e2e8261f6acd085f

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 8.8MB
Sample260511-d13lasd15r
SHA256 b13029af04e175dce4eb41fd04682121ab62a9f7b9106ef6e2e8261f6acd085f
MD5 18e0d4a8f45b08ec5c6313fe963e9985
SHA1 4c576adfafc7e69606c8db090dedf38fa57c77d8
SHA512 227652d965e16eab3f35ed0b6c1f7462a953ed6e1dfa7459b4df1d0f86737a6d899d4d8889e9d6ed0dbdaa800b45aeab64dd761e9d9dc9f90be7ff1d2b0f8573
SSDEEP 98304:9DxgcMMvi6pj3I0vv4qV92TE65CixSBC2XaxNU:91mMvimjb34qV92TE65FSBjXa/U
TLSH
T16B969D1BA26901F4C0A6D178DA438D13F672748A433596EB3BDC45161FE7BE0BE39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
behavioral2/memory/2124-0-0x00007FF7D4D50000-0x00007FF7D5621000-memory.dmp	INDICATOR_SUSPICIOUS_USNDeleteJournal

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral2/memory/2124-0-0x00007FF7D4D50000-0x00007FF7D5621000-memory.dmp	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
behavioral2/memory/2124-0-0x00007FF7D4D50000-0x00007FF7D5621000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/memory/2124-0-0x00007FF7D4D50000-0x00007FF7D5621000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2480	powershell.exe
2956	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\G:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\I:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\O:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\P:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\Q:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\R:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\S:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\V:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\F:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\B:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\E:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\H:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\L:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\M:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\N:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\T:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\D:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\K:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\W:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\X:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\Y:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\Z:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\A:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened (read-only)	\??\J:	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5224	tasklist.exe
1192	tasklist.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\us_tv_and_film.txt	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\Part-IT	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 6 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5316	net.exe
5424	net1.exe
4612	cmd.exe
324	net.exe
2596	net1.exe
5144	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2452	timeout.exe
3284	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229437942307123"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2124	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2124	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2956	powershell.exe
2480	powershell.exe
2956	powershell.exe
2480	powershell.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4960	msedgewebview2.exe
3728	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	5224	tasklist.exe
Token: SeDebugPrivilege	1192	tasklist.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeIncreaseQuotaPrivilege	2480	powershell.exe
Token: SeSecurityPrivilege	2480	powershell.exe
Token: SeTakeOwnershipPrivilege	2480	powershell.exe
Token: SeLoadDriverPrivilege	2480	powershell.exe
Token: SeSystemProfilePrivilege	2480	powershell.exe
Token: SeSystemtimePrivilege	2480	powershell.exe
Token: SeProfSingleProcessPrivilege	2480	powershell.exe
Token: SeIncBasePriorityPrivilege	2480	powershell.exe
Token: SeCreatePagefilePrivilege	2480	powershell.exe
Token: SeBackupPrivilege	2480	powershell.exe
Token: SeRestorePrivilege	2480	powershell.exe
Token: SeShutdownPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeSystemEnvironmentPrivilege	2480	powershell.exe
Token: SeRemoteShutdownPrivilege	2480	powershell.exe
Token: SeUndockPrivilege	2480	powershell.exe
Token: SeManageVolumePrivilege	2480	powershell.exe
Token: 33	2480	powershell.exe
Token: 34	2480	powershell.exe
Token: 35	2480	powershell.exe
Token: 36	2480	powershell.exe
Token: SeIncreaseQuotaPrivilege	2956	powershell.exe
Token: SeSecurityPrivilege	2956	powershell.exe
Token: SeTakeOwnershipPrivilege	2956	powershell.exe
Token: SeLoadDriverPrivilege	2956	powershell.exe
Token: SeSystemProfilePrivilege	2956	powershell.exe
Token: SeSystemtimePrivilege	2956	powershell.exe
Token: SeProfSingleProcessPrivilege	2956	powershell.exe
Token: SeIncBasePriorityPrivilege	2956	powershell.exe
Token: SeCreatePagefilePrivilege	2956	powershell.exe
Token: SeBackupPrivilege	2956	powershell.exe
Token: SeRestorePrivilege	2956	powershell.exe
Token: SeShutdownPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeSystemEnvironmentPrivilege	2956	powershell.exe
Token: SeRemoteShutdownPrivilege	2956	powershell.exe
Token: SeUndockPrivilege	2956	powershell.exe
Token: SeManageVolumePrivilege	2956	powershell.exe
Token: 33	2956	powershell.exe
Token: 34	2956	powershell.exe
Token: 35	2956	powershell.exe
Token: 36	2956	powershell.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 5144	2124	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	79
PID 5144 wrote to memory of 5316	5144	cmd.exe	81
PID 5316 wrote to memory of 5424	5316	net.exe	82
PID 2124 wrote to memory of 4016	2124	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	83
PID 4016 wrote to memory of 5656	4016	cmd.exe	85
PID 2124 wrote to memory of 4960	2124	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	86
PID 4960 wrote to memory of 5968	4960	msedgewebview2.exe	87
PID 4960 wrote to memory of 2880	4960	msedgewebview2.exe	88
PID 4960 wrote to memory of 2880	4960	msedgewebview2.exe	88
PID 4960 wrote to memory of 2880	4960	msedgewebview2.exe	88
PID 4960 wrote to memory of 5772	4960	msedgewebview2.exe	89
PID 4960 wrote to memory of 5560	4960	msedgewebview2.exe	90
PID 4960 wrote to memory of 5560	4960	msedgewebview2.exe	90
PID 4960 wrote to memory of 5056	4960	msedgewebview2.exe	91
PID 4960 wrote to memory of 5056	4960	msedgewebview2.exe	91
PID 4960 wrote to memory of 5056	4960	msedgewebview2.exe	91
PID 2124 wrote to memory of 3092	2124	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	92
PID 3092 wrote to memory of 2452	3092	cmd.exe	94
PID 3092 wrote to memory of 5224	3092	cmd.exe	95
PID 3092 wrote to memory of 3528	3092	cmd.exe	96
PID 3092 wrote to memory of 1192	3092	cmd.exe	98
PID 3092 wrote to memory of 2708	3092	cmd.exe	99
PID 3092 wrote to memory of 2092	3092	cmd.exe	100
PID 3092 wrote to memory of 3284	3092	cmd.exe	101
PID 2092 wrote to memory of 4612	2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	102
PID 4612 wrote to memory of 324	4612	cmd.exe	104
PID 324 wrote to memory of 2596	324	net.exe	105
PID 2092 wrote to memory of 4044	2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	106
PID 4044 wrote to memory of 1636	4044	cmd.exe	108
PID 2092 wrote to memory of 3728	2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	109
PID 3728 wrote to memory of 3392	3728	msedgewebview2.exe	110
PID 2092 wrote to memory of 2956	2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	111
PID 3728 wrote to memory of 1608	3728	msedgewebview2.exe	112
PID 3728 wrote to memory of 1608	3728	msedgewebview2.exe	112
PID 3728 wrote to memory of 1608	3728	msedgewebview2.exe	112
PID 3728 wrote to memory of 4576	3728	msedgewebview2.exe	113
PID 3728 wrote to memory of 4616	3728	msedgewebview2.exe	115
PID 3728 wrote to memory of 4616	3728	msedgewebview2.exe	115
PID 3728 wrote to memory of 3428	3728	msedgewebview2.exe	116
PID 3728 wrote to memory of 3428	3728	msedgewebview2.exe	116
PID 3728 wrote to memory of 3428	3728	msedgewebview2.exe	116
PID 2092 wrote to memory of 2480	2092	2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe	117
PID 3728 wrote to memory of 2264	3728	msedgewebview2.exe	121
PID 3728 wrote to memory of 2264	3728	msedgewebview2.exe	121
PID 3728 wrote to memory of 1780	3728	msedgewebview2.exe	122
PID 3728 wrote to memory of 1780	3728	msedgewebview2.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\cmd.exe
  /c "net start w32time"
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\system32\net.exe
    net start w32time
    3⤵
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:5316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start w32time
      4⤵
      System Time Discovery
      PID:5424
- C:\Windows\system32\cmd.exe
  /c "w32tm /resync /force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\system32\w32tm.exe
    w32tm /resync /force
    3⤵
    PID:5656
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=2124.4964.6291529897876067789
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff89b3eb078,0x7ff89b3eb084,0x7ff89b3eb090
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,15041882567372881558,892277783694131957,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1880,i,15041882567372881558,892277783694131957,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:11
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2284,i,15041882567372881558,892277783694131957,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --enable-gpu-memory-buffer-video-frames --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3528,i,15041882567372881558,892277783694131957,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:5056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2452
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq LoaderNeon.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- - C:\Windows\system32\find.exe
    find /I /N "LoaderNeon.exe"
    3⤵
    PID:3528
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Loader.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- - C:\Windows\system32\find.exe
    find /I /N "Loader.exe"
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe" --post-update
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Windows\system32\cmd.exe
      /c "net start w32time"
      4⤵
      System Time Discovery
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Windows\system32\net.exe
        
        net start w32time
        5⤵
        System Time Discovery
        Suspicious use of WriteProcessMemory
        
        PID:324
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start w32time
        6⤵
        System Time Discovery
        
        PID:2596
  - - C:\Windows\system32\cmd.exe
      /c "w32tm /resync /force"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4044
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /resync /force
        5⤵
        
        PID:1636
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=UseChromeOSDirectVideoDecoder --disable-gpu-driver-bug-workarounds --disable-software-rasterizer --enable-accelerated-2d-canvas --enable-gpu-memory-buffer-video-frames --enable-gpu-rasterization --enable-native-gpu-memory-buffers --enable-oop-rasterization --enable-zero-copy --ignore-gpu-blacklist --num-raster-threads=4 --mojo-named-platform-channel-pipe=2092.1648.1549051913174352405
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3728
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x178,0x7ff89b3eb078,0x7ff89b3eb084,0x7ff89b3eb090
        5⤵
        
        PID:3392
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --disable-gpu-driver-bug-workarounds --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1756,i,1181885324377082763,8913342174289975002,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
        5⤵
        
        PID:1608
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1920,i,1181885324377082763,8913342174289975002,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:11
        5⤵
        
        PID:4576
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,1181885324377082763,8913342174289975002,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:13
        5⤵
        
        PID:4616
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --enable-gpu-memory-buffer-video-frames --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3428,i,1181885324377082763,8913342174289975002,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
        5⤵
        
        PID:3428
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1220,i,1181885324377082763,8913342174289975002,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
        5⤵
        
        PID:2264
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView" --webview-exe-name=2026-05-11_18e0d4a8f45b08ec5c6313fe963e9985_akira_glassworm_icedid_luca-stealer_njrat_stealc.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4688,i,1181885324377082763,8913342174289975002,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
        5⤵
        
        PID:1780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -First 1 | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2480
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
MD5 a71e351e0584693771a3e1ab5ed855ee
SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
TLSH
T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fa74822cc0dd490facfef42e61e085a4fa8a719c2b7d74a063f47f7a04ca4efe
MD5 c70acbe515b2e7739a13f4a742d35505
SHA1 eb4bad12a84bbb4db58f21f259eccd6eb1940e72
SHA512 3d8aebeef446da685497b4e9f0b5d608cf1645e72d1d77b9aa555021c84bde15de07625b2a8c9155a792653191101b98424aebde1851970b8d2b1007169fd0f6
TLSH
T1F2218B33B79DC165C8D9117A208C9D00B275C3C744DFCF8B2A84C228A97F6DADB945E4
MD5 SHA1 SHA512 TLSH

Submit Download

LoaderNeon_new.exe

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\LoaderNeon_new.exe
Size 11.5MB
SHA256 85fd78530f21747d540c5363b1ef635e4a7a2107d1c992a919ebfcf4dbed8c79
MD5 c22028836ba21150d32a2be976749c83
SHA1 29ab8a455e670a96cd2c9c5635ad74f201f5455f
SHA512 b6f72c369735decbc4fb6122a620f7cc97ec8e3ec9b5427a7abb51a1bbfc57b7c9bab52dcb857c8fed950d31b6e141fbdc0e27a3f3c7e76f452614d20d95418a
SSDEEP 196608:kaY29v7pS9iL5zsAuUZIbCMDP6tQfi8zeNczIClsepO:7Y29vNu4ZvczhM
TLSH
T1ADC6BE1BA65801F8C0BAD0789A478D13F67178894334A7EB7B9C46125FE7BE4BE39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.bat

Path C:\Users\Admin\AppData\Local\Temp\LoaderUpdate\updater.bat
Size 2KB
SHA256 c495275b5e9f764c29d45dd609e839a8678333022c470b951902222bf0b14a3d
MD5 5874eadf75be4fa3f5046fd4f9964cf8
SHA1 e5d2c7415db37758f58bd7738cc7837e9c3cf386
SHA512 501afa1f7c14b526f813c4e98962c3f428adc7da08ab86853f03111968da0075d2ba5b44ca3a8f5ce0ce3d02e7b3f124ea378aa0bb15cf94d6712dd1a2987c91
TLSH
T10251EC02426BCF5B4012946B46B2461FC5AE844F5F126B537AA8CD1E73C248FAECA7C8
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b1ao0uto.r45.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b1ao0uto.r45.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 26abfde5030a55e70ba0e0239c1487dd014d0089573026aa06c1a1a0ec6b54a0
MD5 3f47f85c3343ebd3c7c1e2ded89ca13b
SHA1 485441c4e0300f2502e93c02210cdbc008681861
SHA512 e79c55c11a32841325cdd5c72066d707d3d7d40590d0b1c3f49fdcdab67b46d43c428c6081e5057e844b49e8f2bbd0af17c004027c33264c365aea183992339e
TLSH
T19FD01216360115B4C43021330403B1890940C20F4089C0487D2C9D6DAE040540E224C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8db19cf68cb0c43ba5354e7a1ea85ef1bb7ae40de87729a0b6318d7e6eb04867
MD5 f53b08238481ebea33a51cfbe4e5500d
SHA1 0757089f85d401413f3c9359fed993cd5105c07b
SHA512 833cd9191bbb260c279e8a0380a7c886a76efed8214016816bc4049cad0fb5cc6935206d979532e9564c7593b0592f1e7c80e3ca452a3e58572c7a7925f5f19a
TLSH
T10FD00414550434C0C43111370411D1C14750450400D5C14C3F541C5CDC4000545710C0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 e4fb8a9769dbc3535344994f18d4e2d6bc8d0d89ccd6ce01f61bdad66e801842
MD5 f3507701be9d48c6903f7d7403f63075
SHA1 fcc053c4c7c30abc405365ab32320d4c8f30f10b
SHA512 e998dbcfc4a6c3aba27e52a88fd2957604f0a9325f37081ac5f492063bb15ab961cdb220b99667324e98a5d71e1d43f32d6ebf53fca776b816616735405efd58
SSDEEP 3:LstlNllkll/lmVat:LsX3lEtmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Local State
Size 1KB
SHA256 9f515a7bd49783be7ef4cf4e3a51b6b4a1fc71ee0e28e926b9b6439dd1429f3b
MD5 5d912db2dfea23b499b5b7430f8febf5
SHA1 92e36e16a887392bcbdee4edc13a057a5b4dc9a1
SHA512 02f806404d76b2388572f1291d63ec7b418bb8e5ea316c0a6a81d3459036200eceeafad088a5b05da27ab1a23aa8e30213c04cf9715871be44534bdaae230390
TLSH
T134318572F5E80B3368C21916B506AA573EF0203AC2518F1466EC8F4C01EBA9CD53AC27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Local State
Size 2KB
SHA256 60a9904c3192132ad14905c11eb0167d66239415d1b5a10bf5996eb38285ec44
MD5 dab3eb0c0671f461955faf3426b18de2
SHA1 f1850944a26426f0be6f02fc101e7178f56ac053
SHA512 ea9f111a90f76293ace1f2666e809b991b174065ffe652e155ff4b3eb40b052de93565fc16b326daa7bb100efb0d9983297b2a614c0a86bee0ea7de6aac02463
TLSH
T1D451C873B998463799D30915BD496F136EB5507AD7A22F605AEC0F0C01EB59C2305C6F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Local State
Size 3KB
SHA256 8cbb271d94fe5d1b4ec85b921be742ee840b96f0e4d70722c10d5dc7aff9d648
MD5 3b570b136fd5f64780c46dfcc34e4f9b
SHA1 d179d11c64080b905e19755a19727befd4a7d0af
SHA512 fbdba0cf36f72d19dfd221b716ca5e5c14d8e028b9a03dfa681a7ab83d2321c1c6016213fe8b411769c11ffe4ba7bc1412569609132115c0d984675e1f983535
TLSH
T1B371A632B9A895374DE39915B8852B167AA5513BD2D13FA4DAFC0F0C01EB7DC1301C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Local State
Size 16KB
SHA256 c88d2facfd598bd2e189ee3c5efaf1eee69864aef8dae5303969125abbe1982b
MD5 5cbc43ebc76b904158a40732a888365f
SHA1 2f65afb344c0fc552c0ca6c5bbe5de6506786938
SHA512 8b53ed86e0b7f2f892c8fc7bdb37d5b80df1cdc63e3e32f98b5dceeda98200e85207776bb677d90fe3f627292ea28b07b9fe04b52ba41d1abe02e9e1625f6d8b
SSDEEP 384:z9vsrvyOiyp4+IWA1eUVWGfvvLD3NbL3Zo2vGruR6Ty:J0raxyp4sQe6WGfvnp3ZnOe6u
TLSH
T10472BF711AB45A37ECE69C07BC4F7A177EE8906ADAD12F94A5D8AF0D018E58C0706C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585b1b.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\Overlays\EBWebView\Local State~RFe585b1b.TMP
Size 1KB
SHA256 857dfb1a14fe58c326dec98cc4a5f6cd4c3059dae8df867c4cdb1fda93c8e8b6
MD5 149b76e36c8158a64a333a0398786d97
SHA1 bd979663ec0bbcd8c0ff7f1f1263da625adaca34
SHA512 12ac6c058c9a0d533582cf63a8dc41878296a266626149923dac76def6b9988c7effaf2990dcfecbc8263482a56f9f797057baee39f239868ddd5cd73a0f1c32
TLSH
T18E218773E4E8063778C20815F516AA473DE0607B82508B18A5EC4B4C01EFDECD63AC77
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 089e595b9c5085d4749a1dce1a141d8cef4750424b3b8c769cb7e51d2bbec953
MD5 227958ffba3624660677871789f1e1f0
SHA1 9ac7bdb23063f2eeb40e1af91738b57a5e9f83c8
SHA512 a002d5c998f5370af852fdaff492481fc707a3fff36fecc2b4f1cede94d0a13bdbcc049ebee98926f0420531e0db268fc1ad9645e0a27dab7f500d52bac22d18
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 76c8a7feebf074b41ab6d8a536b6a3018ac85ff228a77a4ca9176c4b34bc28f8
MD5 d1f370884045545b9f1c8aa1f1c4b4b1
SHA1 e7c2f30048ef66c8a1e3649e386debf201447ca1
SHA512 15ba52288b2eebac7d6f028e3e72ef222f7e66c5150ce8cb125056545b431209703e7a71b2b238588beb7978c4b3f82dfab921abd30b2871a0c9675a63936bc9
TLSH
T144D024137301033DCC1030331047F14D04C0C10FC40540457C7DD55D1F0C4500D03441
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 303e2c9908d51a271a06ebe4b59d115f18b502f79ceb133f0bd1d56667060ff7
MD5 1337c3a4a7091d001e92fe2118158614
SHA1 6fc0f2f1dd0876053e7928eac354b778cb7025bd
SHA512 03cf14ec99d61447ed336a74425267e0137ee90cd8fd18c99bfa89a7f0aa890f9e927714deea2aabd58969e9c260c27000eecbd4b77d2d27c1f29061e491e0bf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 343eb09d25d2c07b603f0ef9163dd29adfa507efe93e1c420b010bb5f1ce0337
MD5 2fa429adbb560ad7e46464e3f7e2b1eb
SHA1 2649293a305c370a25146480c8799a0bfb1eaca4
SHA512 ee8a4c6ec52cd567cc22ad919ac4e6f2767ca8ca5f642e4164447b15db7bafd38e33b53b510e9b9e01d728db021dac0f7fed8b1deaf8fa1e33371460ba213595
TLSH
T1ED21DCC7A8536CA8C720B17F6FC84E01B2B594797A8BDF03F36E0534835C35A952822A
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 ebd0ee0f322df9b56641ed42f51929d769921589a68ad73536fd699fd4d71a94
MD5 b47928ec197bc96588912024a9b5bffe
SHA1 89a07dbefff9c3b5501199876409fea2ca2eaa50
SHA512 3f05a8ff58567921a5230eeb099c227c756f5fb59e359ea8a789df806628d8c84e71c01c98b2f75f87e1a01b37c6ddca3e254350cbb0e13cdd735f9cb005c524
TLSH
T109317AE7C3E4413DD95216F92B25291FCD1D1D1443283DB6C9E5BF8E93E0824E30066B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59a4c2.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\Network Persistent State~RFe59a4c2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 0146b8b903cedecca331ae3e1437d7e4b5d2491afbb482f52ff584766e2bf976
MD5 c666061aa8c5f16217f66d45e8041130
SHA1 3299e341397999bc6941054ed86306758a60c33b
SHA512 41fa4f4d37c9a07ad1d4d0d57fc8695b25eeee4c719f584d52d7b75f8dc1ba1e2893b832c1ce2eca6f5cdc97280f1d68d50315b786fa28be6bda83a3e504c9a2
TLSH
T1E1F05933867EF47710F8096A8D887D425E7BF43280D360F8C776422CA420CB79606413
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 421cd45e26e48d3d55dee84e1be1112f5db0aa04a57385269c160b0d88bc5cf0
MD5 8ae9684ddbc23448b7f337479db487c7
SHA1 223cd5d80f35f14b3c77b79176fe916a2aeb95af
SHA512 bcc7f383c99c32b4ca52bd864d5ee542d2415d2c9ff85b76ccfa59455497882304444f1173b2a55edb806fd1321928694831321bb5f38d542b8cb7b4dbe119df
TLSH
T11AF05933817EF47710B8096A8D887D525E7BF472809360F8D736452DA060CB79A06003
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 984db59616227f3ec6b3b858b57ec42988cf30eb8d7559c40ca77a8f403c654d
MD5 619ebdd2c4645a467a607d6a46f4deb6
SHA1 a45821c1ce49be31abfde2ec99b506cf2e751ee8
SHA512 0652e13aacd40fe5c912a64717d55803a5b8e87e2662fdc20fdb514c5563f89643a96fc5a7b89ca82080389f02772b27ea5d7389852302c93cb96f7c722848a1
TLSH
T187F0E273827EF47B50F849AA8D487D826E7BF47285D360F8DB66462CA460CFB9607413
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 c34f3031bf21ebb1972118867f4963db0598af6d09f8312898a601f6b07edf51
MD5 95387327efa07f04f2bc219027cfb93f
SHA1 dae11beb63754f4d04c4ce3fc2795f096139f3bb
SHA512 4fcf79d2d54008de7b42213f9278c16261b03613986c2fee20c1fcbb1cabeffd8731d6d56aa3ca9fb37a1fb6a00a960bfe0549129a07218948868da86b959a27
TLSH
T133F02433817EF4A750F809AA8D0879426A7BB43280A360F8C776422CA0208B79606413
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 493b177ae2c3c8d7b5e69e9b3eda452c9236df98b13b729437bf93f3d4ab68a0
MD5 fc8ebd22cc61f028e5ea5538d112d0e1
SHA1 ba34b85ce0e577a1b212f01445e40d5f06888154
SHA512 a385e8aecbe84b4bfbaa94aa07a56c57718bc1ff49918b36c0de344150d70ba195c9e86e87c466e0a10bd5d676d24240d4bffef22ae6389bb6b0bb8dffefad35
TLSH
T12DF0242781BEF46710F8096A8D4879426A7BB472809360F8C626462CA0208FBE606002
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 1518701a812f7e10f6d45028601bf5043c72b70998d9e9195de1ae6c0582c41d
MD5 38ef1e094907bc53edd76bb41b2a37ac
SHA1 5502177306b17105b3f18b23c5786426f5d8ce6d
SHA512 f1373d86505f290c4a8a7e272b10152b5d28c397f52cc557ef08aa084a67d0ea0fe9b94cdb588785056585ba5f0e4d89fe7c5e9339290b436fdc573b9028f339
TLSH
T154F05933857EF47710F8096A8D887D425E7BF432809360F8CB76412CA420CB7D606003
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58d4cf.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Network\TransportSecurity~RFe58d4cf.TMP
Size 522B
SHA256 18df037ba83f6a31c61d41bcb5cb7cc0a8b0b8bece1c07f31a7df2ac06e6c3eb
MD5 e37ad7aaa550633a04d475c83b97d667
SHA1 df03675d3a9350bc00b770819fd47c9440070ed5
SHA512 b25665ea544326bd0b21f84f539d0fa57c7df811e806f678206fd650374907bade91d8bde11658b00aebadc0a7eec24b7d27e1c2fa03a7c3b47fa4a4d4e1232a
TLSH
T14EF0E2B3827EF43B60B8896B4D487D426E7BF47681D360F8DA66452CA460CBB9607453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 db52c6f72946f0fce86d5c03c16d6d039ba5c3c6cd4309de9c18d4152446b81e
MD5 4df4aec343a429c5f5fccd4b00bd03ec
SHA1 bb80b587af7e94d6a251353a230b3bfdbda60438
SHA512 36129c6b4abe5aea57aba28350c03bc25bb4caa387d4fe13b65f392c186cede2a53fde55135408af7ff69b6f0186a54af7b85822918986f1e0f1c7179ddfeaa5
SSDEEP 192:st90yYoqSf8Z8panM/S+Wi9fEwY7j58jas+MC:stmySSb9/Vqw3vC
TLSH
T1C7E1C9136E3869775CC7E62A7A35FB16E2F5602266D10E98EBFC860C04E66CD5207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 40dfbccad3d4df7f3e32d3482922e4c16fed4e193dfc19dee97dbff1e9a31d67
MD5 3116df4e81f63956207ffe5821a31c79
SHA1 d6753810ffeefca719b2821b4dac4ad0405bd215
SHA512 11a8d6c372207264c9ba23ccaffc3d4b9b1b1ff5a1a7abf7a1d27a677d1a0c8110b89b915fb94d6178e23397abd42df39456bb08a660bce6ef015c80d98c40c8
SSDEEP 192:st90yYoGSf8Z8panM/S+Wi9fEwY7j5kjas+M8:stmy+Sb9/Vqwpv8
TLSH
T194E1B8036E3869774CC7E62ABA35FB16D2F5102266D11E98EBFC861C08E66DC5207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58d627.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Default\Preferences~RFe58d627.TMP
Size 6KB
SHA256 25034ef5d871497476dfc6470a2a070d195e3eb6945120906876a7621862a1a4
MD5 df82693e11c7b84297bde3b7ff7d1e4f
SHA1 752f72281ea96d9635f217b0fe97aa41196de365
SHA512 f50746a0f40df1b15b8ad41e3e854d751f90bbc97aaecb702afc2c6cfffd9f0a990570e2b733238454cf6e36d690c2c7db45e0055208a2ae0a4d0c08f99efa41
SSDEEP 192:r90yYoGSfwZ8panM/S+Wi9fEwY7j5kjas+M8:rmy+Sn9/Vqwpv8
TLSH
T198D1A8036E2869774CC7E62ABA35FB16D2F5502266D51E98EBFC865C04E66CC5207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State
Size 1KB
SHA256 53079ab80ce03514c9f2ca67cf2eeba71495feeb100c754b1fbca67a66d914cd
MD5 85edab169e6f6b0e0b58f6cffe14a263
SHA1 be5ef15468726ac75e353f6cd43c0974aa81f528
SHA512 87e47053558397280cb8ad0106ba42595e7c402b4e3a56692a63d0e68cc513a1b41c7e5a21e200f1c334aae0c39ee5adda9abff76ab3ae1373d61cc8ff536c97
TLSH
T138318772F0A81B7278C20456764ABE632D205077C2624E5CF5DC4B5802D259C963EC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State
Size 2KB
SHA256 8b71f26a27fe5895a9300810950e5165d5f413bbc8befd1df9f5df704b06c352
MD5 87726912ef8b542ca693c29445a5fc0c
SHA1 1bcd3a7ad2c9f0f9412308f08a1db46b73e26981
SHA512 c9cd6ea844ec3c0649dd4c847dddf9847d1b9f8062897ec2a3ba01536b21397dc8ba07ad53312db536f3c135d13d16b958a89a6cefef2947c659733728a86a6d
TLSH
T16C51C733B4185B77A8D34955B94E7F239D31907296A31F68E9EC0B0801D665C2306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State
Size 3KB
SHA256 2a2ebb0f33f983153d205ce076355f4306ffac3e5afa0e3e176c1f852ce91f20
MD5 e2be7faf722216cf6eda8a21671a12ee
SHA1 b46b0baa18c9e1eaa84b97e3fcf899f53c028519
SHA512 e7f3ed600a2907f303e60f01a4a31f717dcc56f96de290ff5ff16e4f056138d36b309b38f27f4433ff3cadc79813852ed2b3f40e093f9cff851e64ff199fcd60
TLSH
T1F3719632B5689A775DE38D45B98A6F22BA615133D5D23FACD9EC0F0C02D73981352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State
Size 4KB
SHA256 f244c8e5734b1489eddb771ec827ba74dce5c87da3fd4f8404d7d1527cb26ba0
MD5 8d106670fbfdae166cc6f8b0598af24b
SHA1 e682e3d4132e6c91b5b46d694ecb33f7c2e476d5
SHA512 dbd78ef1235e27a8bc1c862381558552c6a6df95e909476c137b3157c9b00d6fe40fa5aa1561cc94137834faccd4988ccc8f6d8ea4e51f08a58ffcd1db11b0a9
SSDEEP 96:zufbNkCE8XcfpJ40uNb58Frh/cInURoDotoif9DYB4uf6EfZFQjZiT5lsa:zybNbLXIJ40uNmooDUDds4u+aP
TLSH
T169917532A5789A675DE39946B98E3F1366615033D5E62FACD9EC0F0C02DB3982352C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State
Size 15KB
SHA256 4eca26ba634e2c12b2bb65526a0ca34e8273f7cdd82dfb120939ee663bf1a61a
MD5 3f35026e59578b3908e6f92a0a879fc3
SHA1 aa75b85962a66b8315d80564ea9761ad6794f299
SHA512 864512da0aabca17e79947503c9b5a9ea8e8ef3ddce671419ca28b3e111450104b4422c57dea27712dbf9bc9b5fa0105fa310fcf659ecebe473d24524dc4661f
SSDEEP 384:z4vsrvyOiyp4+IWA1eUVWGfvvLhNbLXyb1RzOuMIL:U0raxyp4sQe6WGfvLXyxp9
TLSH
T1F172BE711A789A37ACD25C47BC4F791B7E94946BCDD22F88F4D4AF1E024A28C0706C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587d88.TMP

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Local State~RFe587d88.TMP
Size 1KB
SHA256 42391986776a9c868f290cccc2c6c569622362650fb2eb9f6cb316ee56fa18c0
MD5 f61dcd05b0cd3630b3113a11f711acfd
SHA1 4ad241eaa316777f059f1bdc55a304861383450d
SHA512 3c187f25100b27d3e308ce5aa70c7cedf8c32d15f69a2614d84eb4dc8304b3d712ca7565f3e67de8cc6c23e7cd9b29a9b85d59a186ddcd1540f68d1d32d10852
TLSH
T164216572E0AC1BB2B8C20456B64BBA932D205077D2654F1CF5DC471906D65A8977AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\1622894485\WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adblock_snippet.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\adblock_snippet.js
Size 2KB
SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
MD5 f5c93c471485f4b9ab45260518c30267
SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
TLSH
T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_1906225333\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3728_495477963\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1192-315-0x00000213FDB10000-0x00000213FDBBF000-memory.dmp

Download

memory/1608-675-0x000002201C400000-0x000002201C4AF000-memory.dmp

Download

memory/2092-325-0x00007FF7D2050000-0x00007FF7D2BE3000-memory.dmp

Download

memory/2092-672-0x0000017D543A0000-0x0000017D5444F000-memory.dmp

Download

memory/2124-0-0x00007FF7D4D50000-0x00007FF7D5621000-memory.dmp

Download

memory/2124-200-0x00000262EF970000-0x00000262EF97C000-memory.dmp

Download

memory/2124-196-0x00000262EF850000-0x00000262EF8FF000-memory.dmp

Download

memory/2480-619-0x00000282E28C0000-0x00000282E2973000-memory.dmp

Download

memory/2480-640-0x00000282C86A0000-0x00000282C86AC000-memory.dmp

Download

memory/2480-612-0x00000282E28A0000-0x00000282E28BC000-memory.dmp

Download

memory/2480-636-0x00000282E2B40000-0x00000282E2B6A000-memory.dmp

Download

memory/2480-641-0x00000282CA310000-0x00000282CA3BF000-memory.dmp

Download

memory/2480-642-0x00000282CA490000-0x00000282CA4A2000-memory.dmp

Download

memory/2480-637-0x00000282E2B40000-0x00000282E2B64000-memory.dmp

Download

memory/2480-635-0x00000282E2980000-0x00000282E298A000-memory.dmp

Download

memory/2880-27-0x00007FF8B9BF0000-0x00007FF8B9BF1000-memory.dmp

Download

memory/2880-312-0x0000019A05060000-0x0000019A0510F000-memory.dmp

Download

memory/2956-500-0x00000201B5E20000-0x00000201B5E42000-memory.dmp

Download

memory/2956-648-0x000002019BEC0000-0x000002019BECC000-memory.dmp

Download

memory/2956-649-0x000002019D9D0000-0x000002019DA7F000-memory.dmp

Download

memory/2956-650-0x00000201B5CA0000-0x00000201B5CB2000-memory.dmp

Download

memory/3728-674-0x000001E50AE00000-0x000001E50AEAF000-memory.dmp

Download

memory/4576-676-0x00000268BFA60000-0x00000268BFB0F000-memory.dmp

Download

memory/4960-313-0x000002A030400000-0x000002A0304AF000-memory.dmp

Download

memory/5056-146-0x00007FF8B9BF0000-0x00007FF8B9BF1000-memory.dmp

Download

memory/5224-314-0x0000021C66110000-0x0000021C661BF000-memory.dmp

Download

memory/5772-281-0x000001B984600000-0x000001B9846AF000-memory.dmp

Download