7ca7e5cf7fcc712bc3fcf07900066879c771642563c6d192bbb4fc234b3e8af9

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 1.1MB
Sample260730-gpdpksdn8t
SHA256 7ca7e5cf7fcc712bc3fcf07900066879c771642563c6d192bbb4fc234b3e8af9
MD5 1079d7988bafba2887275617846c887f
SHA1 d79ebc864d8d578108d3fcfff8730be41cd3fa64
SHA512 bb03f427209bcc6904386c92bc9b20140c8445608e1348e5ab9894ffdbfd144fba717910cb4e2b104462af06b39312c946ecece4ecd69f7a658eebb702109ba0
SSDEEP 24576:iXoLtxz1wzrWVC9Dgh0lhSMXlsr+K1Kiuv3LC5:iyxBwzqqDVcdKvDY
TLSH
T184359E2A67A901FDF0ABD17C99975A01F379B40B13518ADF139412663F9B2E19F3A330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

Contacts third-party web service commonly abused for C2 1 TTPs 18 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	raw.githubusercontent.com
27	raw.githubusercontent.com
36	raw.githubusercontent.com
38	raw.githubusercontent.com
43	raw.githubusercontent.com
52	raw.githubusercontent.com
1	raw.githubusercontent.com
29	raw.githubusercontent.com
44	raw.githubusercontent.com
46	raw.githubusercontent.com
48	raw.githubusercontent.com
49	raw.githubusercontent.com
50	raw.githubusercontent.com
24	raw.githubusercontent.com
25	raw.githubusercontent.com
51	raw.githubusercontent.com
41	raw.githubusercontent.com
47	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	msedgewebview2.exe
4816	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2968	msedgewebview2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4896	2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2968	4896	2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	89
PID 2968 wrote to memory of 704	2968	msedgewebview2.exe	90
PID 2968 wrote to memory of 4736	2968	msedgewebview2.exe	91
PID 2968 wrote to memory of 4736	2968	msedgewebview2.exe	91
PID 2968 wrote to memory of 4736	2968	msedgewebview2.exe	91
PID 2968 wrote to memory of 4736	2968	msedgewebview2.exe	91
PID 2968 wrote to memory of 4196	2968	msedgewebview2.exe	92
PID 2968 wrote to memory of 3932	2968	msedgewebview2.exe	93
PID 2968 wrote to memory of 3932	2968	msedgewebview2.exe	93
PID 2968 wrote to memory of 3932	2968	msedgewebview2.exe	93
PID 2968 wrote to memory of 3716	2968	msedgewebview2.exe	94
PID 2968 wrote to memory of 3716	2968	msedgewebview2.exe	94
PID 2968 wrote to memory of 3716	2968	msedgewebview2.exe	94
PID 2968 wrote to memory of 3716	2968	msedgewebview2.exe	94
PID 2968 wrote to memory of 3716	2968	msedgewebview2.exe	94
PID 2968 wrote to memory of 4816	2968	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4896.4216.4168651513967446060 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView /prefetch:4 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffc069c5fd8,0x7ffc069c5fe4,0x7ffc069c5ff0
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --webview-exe-name=2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1376,i,7055683976891910896,7287383959893129660,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --webview-exe-name=2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1376,i,7055683976891910896,7287383959893129660,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --webview-exe-name=2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1376,i,7055683976891910896,7287383959893129660,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --webview-exe-name=2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3300 --field-trial-handle=1376,i,7055683976891910896,7287383959893129660,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView" --webview-exe-name=2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4384 --field-trial-handle=1376,i,7055683976891910896,7287383959893129660,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:e83060b64702c13617b7e99ae7e695319d18789e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.js

Path C:\Users\Admin\AppData\Local\Temp\saturn_ui_00001320\app.js
Size 22KB
SHA256 56a092e81d3ba791fa921a34ad826f2390cd863f84a6786d67ce1fa6fc34c7bc
MD5 3b4e01de661938de0518994dbac58f4a
SHA1 ccdb340bf1c4ad400c09fe5ea7ab83b772a52dcf
SHA512 98c9b9c8d0ba3941aa3c5251a2afe66449e5c16640cec39cbf241f948dc25ed14b7e83e04dbd47b71a841a6840560a8241a9af8707fec476e5d513c05222c389
SSDEEP 192:L1X3bqo9U0AQ8AK81KV8QPD8wWgnXhLmEINSn5nxD8v8M+jDmt6WbIaMLpDuwpO9:LBbqb0AARwcNcVfmsDpDuw0/wG4va
TLSH
T112B2B37B3AB5243479BBD1BF924B6298392470033846DA51365C75808FECFA161BB8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\saturn_ui_00001320\index.html
Size 174KB
SHA256 e03fadfeb504c03c4eb0b2eeac884791765e351c2260f736fb28a4a8d95f50dd
MD5 98d862a82d3ef97ad2b7b1d8be3c6f33
SHA1 50af870696045a676134b0ae54559c80738f6a58
SHA512 069f472e4cd9383fd3aaf5ae4d7b2dc226628839ecfa71a006a2bcb503fe24849c725a16cfd886029dab9fd256ae8c96d2728c1d90f126107965780a51a6eec4
SSDEEP 3072:ZJ6/EeFhp+MNr0kJ/h2MKwV96JI/mAhCze4LZ5oWiq8HJD8:4Fhp/NQo/hD96JvQC64LMG858
TLSH
T15C04027100F359B5F1A6D04C69571A294DE8B5A3B2850208F5FC36E44FCEDAACC2B4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

styles.css

Path C:\Users\Admin\AppData\Local\Temp\saturn_ui_00001320\styles.css
Size 30KB
SHA256 91c136796e21f46bf14d3ec01d0da75ed144468dd317ac3d02f3e45c48793041
MD5 c969854690d1262992a29d6e1ee080b6
SHA1 3ebd50fb9e9aa521ded202bcec85c991f85eb405
SHA512 15ca1190b8b42394129880a28902aae11b53571def6239d65823535a7250abfce357a6ef0c848713d648679e9dc46cef1f2ddb3b71c56b0d3a70cec4a79a010f
SSDEEP 768:u1oeBu2Of0kjq6B62jH49WyFF78viM54Q6PYGoC:u/t6qxX3YGoC
TLSH
T1E2E21DB1AA1606187523D24D2993975E73787502BA07D93CE7F7308C8FCD2DEE262674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f0e47bdd3164ef829bae4b4085d484c31bcf032ab5f69cb8623182bf3d788a1d
MD5 1ab6ad461c151927680c66107c17d3f1
SHA1 c91a3e791ad7062b949e3ff6af5a80b07f8efee6
SHA512 b0dbfcce11c71c15577a3923a59cbebbf1e040b6d397f68dc364eadb84a2afd0b79359bc0e6150c4c8f85feeb221f6a603002c6d2fdfe07dc4e0003a69263c1a
TLSH
T1B8D0241377010F34F43434330543714C0400D10FC00DC041543DD51D1F144540D37551
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a2cbf61745759979fe700e2b535828fdea113743e161383a0768c296565d3d23
MD5 a3a5e1f32a7aadf5fe3990ac19119ba8
SHA1 d27ae0599dfdaa7756d162c61c158b7ad4ddaf46
SHA512 47f8a43da05f027ef57de1b0902c571b030c1887e5af23c5ac1ea5da12964698f9e3c470f0be9440738d40816c9285d305020a62b2bb422657cb84ff4594f680
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a3492b506ad07665adfd12c69cb5eec4f2391fa57b202abb0e6c1edb4de8fdb4
MD5 187f9d14858e15fc2f2a3ef395aa6fdc
SHA1 cca6cfe27ce2435b6f946ec826e8e5f9813db9fe
SHA512 d5584c41793878c9e824b5b967b05f06e0241994df8a97044b754b64cb20016510938ebedcc03439634d429ff047081040c37088b6d79aaae5de903012b78e20
TLSH
T188A0029602D5107EC391C77079E602643734E9154213064D84D640E598747D94B82056
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598ab2.TMP

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe598ab2.TMP
Size 48B
SHA256 44723aa2171259403ecde28155d7a2e5655b7b1c964716d3eada7cd64703cc54
MD5 3af32f70b3dd927a077e247420b2f4aa
SHA1 a93703e6c19e7535ce893573694772d5d1301c21
SHA512 d375ecc6ead585d1483832d04b410c98cc1848484a4332614c494a0c064e8a927f8ec62ec3c1282abfdd726d3eb21723f7d65559f2725db66556a023298dcd52
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a5f09.TMP

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Network\Network Persistent State~RFe5a5f09.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Preferences
Size 6KB
SHA256 b973ad317f8439230f740cdf97deae8d5546b1f8b98a3c06f0607130da6a78ca
MD5 bdd2a834a5863ac3333e7a8b9e68418f
SHA1 4b7beee0ceba00d4fc904f154c7bd9160a9727f5
SHA512 0197236e87c16bbe45b47504ed03997bf69616770042eb459773f1e139795e063fc1d34a2093a79f61855b8ddf64496a25bb7412bdfa44841b2b29afa73949ad
SSDEEP 96:stB/dya0FG2b9ikro5h16ZhVs7/x+6MhmuecNJ21ejeUK+gJ28XM1C7K:st1LD8oCVsV+FxJ2Qj8XG6K
TLSH
T154D1B8065E246D7B4CC7E119BA297B43E2F9503265E15E88E7FC962C08DB6CC630380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f2f84208-8a9c-4107-99e1-ed366ee9251c.tmp

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Default\f2f84208-8a9c-4107-99e1-ed366ee9251c.tmp
Size 6KB
SHA256 1aaa751b81134923372083d83bbddf4d826f58a2b2068651c0d427e50824b942
MD5 2e06227cc272fb505b81edc70514e95b
SHA1 cac570a72b0ce7eb48f0d67df51bcf65a805f0e6
SHA512 a784966c22736d486a84815a8c75c5b89b79aa22c5949f0bb71f097ebde9470b41891041aca9be0e2bca3589bf083ab009807a1d54ea4b5bec0a0609c1e268a6
SSDEEP 96:stB/dya0e2b9ikro5h16ZhVs7/x+6MhmuecNJ21ejeUK+gk28XM1C7K:st1Lp8oCVsV+FxJ2Qj8iG6K
TLSH
T15DD1C8065F246D7B4CC6F119BA29BA43E2F9503265E55E98E7FC962C08DB6CC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Local State
Size 15KB
SHA256 c23c086b373bd93609a9e1e2ae730c42f41e36976c4701417fa59374027d0eef
MD5 c207390ade811647e5c7e2fe3d83910d
SHA1 a197bc41ffde0e82158528b4362c3f2950b8093c
SHA512 8ab499ed5b0cfbbaed2ebb2400e32b00505b50659978c3113d95160e947df428140c07df3a5fc4457c4b1d188ebe7096b5d8d92aeadd7713dd51c1113e940ded
SSDEEP 384:M+aQikB+z/xvxjg/qhEwNBS/tNt6Xisdvx9zm:r/UxvxjgC+ToXisfFm
TLSH
T1DB729F3B59397E2395F3E601794E079FDBB9847295C2A9B84EFD6F0D0AC72A40342812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Local State
Size 2KB
SHA256 2a97a0d2245e6e5336e87d4a4e71026d7e5358e7ac599c5e7bc3eee7932f97ce
MD5 e6750e2212a3e6b1e92adf3fc1db3abd
SHA1 24260f0d60e0ba54017d2c18e67876520b651581
SHA512 1558952102005fe24451372d5e5a311e489da461d93cc13da4fe6486466c61bf7e7d5026dfad63b8c6bc04a8981ae2ca07303bb4421eb9c67cb6fef55eefa233
TLSH
T10851A57379209B3798E3435579463E26DE7590A2EE626FA09ADC6B0C00D765C1306C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Local State
Size 3KB
SHA256 f59dd6ea2595b9c83232e4c5b8781de145081c673d6155b286723317de6c0554
MD5 2de2d3e98865b545f9ab83c3150cfbf5
SHA1 6aa252c0b5e78a482d731cfd7d409807fecd1f73
SHA512 bf02aaaa9fd99917e3323b2dec33c7b8b2ab69d190e4492fb8580a1716688ea3cc28252ce51deca41466775e5159d59ae4ea74bca292688db149189d683f70fd
TLSH
T17961967B6A749A3B4DE38715B8863B16AAA55023E9917FE4DAEC1F0C01D739C1342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5937c0.TMP

Path C:\Users\Admin\AppData\Local\Temp\saturn_wv2data\EBWebView\Local State~RFe5937c0.TMP
Size 1KB
SHA256 275839e56ca99f727a419885b8865150a9f1878cb0216be121533d4a6637453d
MD5 215035ddcf7b7cc0bdc4a4709b993e4e
SHA1 283d7596999b73bb9bc93abe82c4f49cd5bf4e25
SHA512 6956d4086a13b73eee5112161e8ce02f75eae57a3d8e2e7dd9eb4a3c17f82d2284ebef304c1b9541bf481fb8f4a850f9991d18004c6139002b08d56a0a1ac1e5
TLSH
T1942192B7EA305F31ACC213573082BA9B5D6120ABD6218F40A6DC9B0D05E769C862EC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3716-53-0x00007FFC28070000-0x00007FFC28071000-memory.dmp

Download

memory/4736-201-0x00000251AC0A0000-0x00000251AC0CA000-memory.dmp

Download

memory/4736-37-0x00007FFC28070000-0x00007FFC28071000-memory.dmp

Download

memory/4816-278-0x000001EDA3890000-0x000001EDA3891000-memory.dmp

Download

memory/4816-276-0x000001EDA3890000-0x000001EDA3891000-memory.dmp

Download

memory/4816-287-0x000001EDA3890000-0x000001EDA3891000-memory.dmp

Download

memory/4816-286-0x000001EDA3890000-0x000001EDA3891000-memory.dmp

Download

memory/4816-285-0x000001EDA3890000-0x000001EDA3891000-memory.dmp

Download

memory/4816-283-0x000001EDA3890000-0x000001EDA3891000-memory.dmp

Download

memory/4816-282-0x000001EDA3890000-0x000001EDA3891000-memory.dmp

Download

memory/4816-284-0x000001EDA3890000-0x000001EDA3891000-memory.dmp

Download