213e6b1d5300566556d2cea41f046c8bacad62ba10f432b8fc29559671a5fdb2

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 2.3MB
Sample260810-c3pxjszcke
SHA256 213e6b1d5300566556d2cea41f046c8bacad62ba10f432b8fc29559671a5fdb2
MD5 562384177b4072115895ad0a7eb5e632
SHA1 570282df40e0d10f77e6b8fa46a4bbe995d477a8
SHA512 4b031c19272af789064acb0b80d292952a823adcc06d3681758097235278791e54d4d8595f5e4257fdb0db92c357987daa1b4df15d0c491fe7acc5c0e15cba81
SSDEEP 49152:srZ6zsqv56eG8ONQvf88nb+J/TlUJSLYVMxeDP:NrrG8OmN+lUJSLYVMxe
TLSH
T168B5AF0766D900F8C27EC578C52A9583E772B429C3A4D6EF17D899A50F232DB1BF6702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
47	4540	2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Executes dropped EXE 1 IoCs

pid	Process
3536	laddon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_608105576\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_518715895\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_608105576\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_608105576\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_518715895\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_608105576\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_608105576\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_518715895\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_518715895\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-hu.hyb	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5928	powershell.exe
5928	powershell.exe
4540	2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4540	2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4540	2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4540	2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
2156	powershell.exe
2156	powershell.exe
2156	powershell.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe
3536	laddon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5572	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5928	powershell.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe
Token: SeDebugPrivilege	3536	laddon.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 5928	4540	2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 4540 wrote to memory of 5572	4540	2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	91
PID 5572 wrote to memory of 6108	5572	msedgewebview2.exe	92
PID 5572 wrote to memory of 2516	5572	msedgewebview2.exe	93
PID 5572 wrote to memory of 2516	5572	msedgewebview2.exe	93
PID 5572 wrote to memory of 2516	5572	msedgewebview2.exe	93
PID 5572 wrote to memory of 2516	5572	msedgewebview2.exe	93
PID 5572 wrote to memory of 5080	5572	msedgewebview2.exe	94
PID 5572 wrote to memory of 4816	5572	msedgewebview2.exe	95
PID 5572 wrote to memory of 4816	5572	msedgewebview2.exe	95
PID 5572 wrote to memory of 4816	5572	msedgewebview2.exe	95
PID 5572 wrote to memory of 1264	5572	msedgewebview2.exe	96
PID 5572 wrote to memory of 1264	5572	msedgewebview2.exe	96
PID 5572 wrote to memory of 1264	5572	msedgewebview2.exe	96
PID 5572 wrote to memory of 1264	5572	msedgewebview2.exe	96
PID 5572 wrote to memory of 1264	5572	msedgewebview2.exe	96
PID 4540 wrote to memory of 3536	4540	2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	98
PID 3536 wrote to memory of 2156	3536	laddon.exe	101
PID 5572 wrote to memory of 3360	5572	msedgewebview2.exe	105
PID 5572 wrote to memory of 3360	5572	msedgewebview2.exe	105
PID 5572 wrote to memory of 3360	5572	msedgewebview2.exe	105
PID 5572 wrote to memory of 5796	5572	msedgewebview2.exe	106
PID 5572 wrote to memory of 5796	5572	msedgewebview2.exe	106
PID 5572 wrote to memory of 5796	5572	msedgewebview2.exe	106
PID 5572 wrote to memory of 2680	5572	msedgewebview2.exe	107
PID 5572 wrote to memory of 6092	5572	msedgewebview2.exe	108
PID 5572 wrote to memory of 6092	5572	msedgewebview2.exe	108
PID 5572 wrote to memory of 6092	5572	msedgewebview2.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /C Get-Service -Name WpnUserService* | Restart-Service -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5928
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --allow-running-insecure-content --disable-features=msSmartScreenProtection --disable-gpu-vsync --disable-web-security --dns-over-https-servers=https://cloudflare-dns.com/dns-query;https://dns.google/dns-query;https://dns.quad9.net/dns-query --enable-features=MojoIpcz,UseSkiaRenderer,UseDnsOverHttps --enable-gpu-rasterization --enable-smooth-scrolling --enable-threaded-animation --enable-zero-copy --ignore-certificate-errors --ignore-gpu-blacklist --run-all-compositor-stages-before-draw --user-agent=LoaderVnm --mojo-named-platform-channel-pipe=4540.4628.14073261278614061523 /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView /prefetch:4 /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa0b375fd8,0x7ffa0b375fe4,0x7ffa0b375ff0
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1888 --field-trial-handle=1892,i,1750626248628757568,15506775614379632113,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2076 --field-trial-handle=1892,i,1750626248628757568,15506775614379632113,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1892,i,1750626248628757568,15506775614379632113,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --run-all-compositor-stages-before-draw --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3436 --field-trial-handle=1892,i,1750626248628757568,15506775614379632113,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb /prefetch:1
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=1892,i,1750626248628757568,15506775614379632113,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4548 --field-trial-handle=1892,i,1750626248628757568,15506775614379632113,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4524 --field-trial-handle=1892,i,1750626248628757568,15506775614379632113,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4644 --field-trial-handle=1892,i,1750626248628757568,15506775614379632113,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3b1810440ac2390113b7e9047603bae593835ecb
    3⤵
    PID:6092
- C:\laddon.exe
  "C:\laddon.exe" 4540
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAAkAGMAcAB1ACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAgAHwAIABTAGUAbABlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAgAC0ARQB4AHAAYQBuAGQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYwBwAHUAIAAtAGwAaQBrAGUAIAAnACoASQBuAHQAZQBsACoAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBJAG4AdABlAGwAIgAKACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIATwB0AGgAZQByACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15.4-laddon-temp.exe

Path C:\ProgramData\Intel\ldc\15.4-laddon-temp.exe
Size 4.2MB
SHA256 9d5684ef35feeb0f54b344f5adbb39b86043c8af763ced32b6b99761dfaa13b4
MD5 5d91b28fd756b5f62f7af842779b3365
SHA1 97a19d7a706224c441628ef4077f4f6b1e58acc4
SHA512 5030502073cfd8517036462b72c188691390f1951ea3a36b0052ef0958712baeced019487fad314749c3ee8e52fc1ba0ef82ae5c5adee094432b537fdf5f4efb
SSDEEP 98304:A39uRc78/wbyd9EXWMqzfJFTO0TQo+XXc/:A398xoeGhqzfjTO0Tlk
TLSH
T1982623956DDF00B2E4B8CF349C3A651ED4B8EF9A44319215038A33AE653563E08EFBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chairfbi_addon_to_sdk

Path C:\ProgramData\boost_interprocess\17000000\chairfbi_addon_to_sdk
Size 25.0MB
SHA256 7a7bb6df6f6825284d49fb8cc7e5e7181da38188e1c453dcb7b6605de2c664a9
MD5 43076fb4ca9593e14fbc74d714acf0e8
SHA1 dedfdaf70547825cbfbadb8704752a69ffd35d72
SHA512 02222b57259d5ba4bda12acca49876019dd9a091f137f5e80e67faff2d8f55b5deccdcd97f0fe2f5e75b8a78038d40bad5847a358abdde5668ed271740da8d80
SSDEEP 6:akXn0E0XPl/nia+l/P66+l/3Ses620Sskl:akXn0E0XlnSP63y6HSFl
TLSH
T1D647C2B3880B228FD098037844DE1BB1777B0918A6508B03C3A60A24DE65686AF59C01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chairfbi_sdk_to_addon

Path C:\ProgramData\boost_interprocess\17000000\chairfbi_sdk_to_addon
Size 25.0MB
SHA256 422df3189dd9f9f7fa3480b2aa2517dc02a6ab194b52a43b54b0cf3d8dba799c
MD5 d984233042742d66f97306aac9792918
SHA1 15efa1770e5db6da79c567881dc9d940864f8388
SHA512 dbfef6fe5b6a780060372b900d6af3f5cb0f6253ec1cfcd169938a40b5ba6314b5106df0fad4c52a13010b30831914d532bdb58d42ff8e98f612198ec8c3255d
SSDEEP 6:sUSkXn0E0XPl/nia+l/P66+l/3Ses620SskligGKO8cAu2bl/:sUSkXn0E0XlnSP63y6HSFligGKpcF2B
TLSH
T11F47D873980A228BD494027448DD177077774504A6008B03C2A61A24DE66285AF19800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 124123e5f5deae1f5deaafc9edc8aa4c1d2bcdc2be10edcdfda2910ed68bc489
MD5 10c32c4eda61ea0599d4a10ebcce006e
SHA1 4b32dbdc5abd18c13e4c5c6f6c17a2bc05d2d69c
SHA512 0823e27af408d7c12dc5a925188ea55ddc5db92a8b08c4c371eba38a0a708616df87cac67b345bdd6b55e9260755e8db64f40d642a80ad9a39c904913d7433ee
TLSH
T128218633F3CC8620C88A403650CEAC1036B687CB408EDF6BBB84D044B42F598DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

363531303031303931305253434647.ini

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\363531303031303931305253434647.ini
Size 81B
SHA256 5b0962d0eeb8de6e30f11f3859f99375972e7fa31e6ec97ac7cece6dba034a4f
MD5 3c0fba4c005cc76afad9aa8a0937bd61
SHA1 b7449380a2f3b85b838ac042f56ce3f84065811c
SHA512 1bbd451e0f6cc7ae6ead018ea5a2dbca2c338d17585906d9cb95ed34d1bd3b1b44991c1dee53f84718945a65aade8ff56311aaa57228aa4fa46e64ece038feab
TLSH
T112A002BD0612E4285C0DFC2B628269C9CFC791C161391D9FD6343E73B1AA2D0B50E40F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fb88e572999c19da60c72df4d11111aa1e0463443c1010ad0bceaaa4589163b2
MD5 6e45ac150f9308866b9855fe1a673a7f
SHA1 7c7ca5aeb029f5ed3949637bf414a79e95587261
SHA512 8c2937e9024b7ab09bcbd9613a7a3137b257b6bf98cc18202f2d51a2c5959377604d3e32ce226cfd118517ac1186e8a03a9ad26e8da890de7de381ec28ffaa73
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ab8b6308e6daa3f48879a5f9f273f30d63a1db31e1be8f51eb4c0124ac1e026a
MD5 35b479b533d4d7039d1c0a38630c2b0b
SHA1 9f3d712ffea8d19b39d3c86fdaa8f54c4648ef1d
SHA512 bd4e4eb8d87ae35172901685e12d1e70aa0f5ff4658ed9fdb1bc2b77f1504001001c9e26bd192deb7e5e66e0f014983c8cd89e2b477b3177e8c28437284620b3
TLSH
T190D0121272510578C4202473187372080400D30F8005810094288B1D1A580640D22C55
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

9ff08ac5-5955-4793-afb8-c1189abbf462.tmp

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\9ff08ac5-5955-4793-afb8-c1189abbf462.tmp
Size 6KB
SHA256 533eb73dcc3c983de4b65bee819eef74f8e08205294064dfe24ab3e0f3d92853
MD5 fa824a1b0333d888201c3346b820d479
SHA1 a105cd1e78a0a4957a1d2878468ae6f71d60af3b
SHA512 e95c7be93c062173a9cb2c566ee34ef4dae165a56518daccce52e3bec46e9089d9caa060d8b902b956fffbe7c09354a99f1173c595e8e43f211e80b2f04f0b5d
SSDEEP 96:stu/dJxTpSfb9Nk7o5h16ZZTAs7/x+6MhmuecGNh1eje8SK+gB28XM1C7K:st2VKWo0TAsV+FKNhQjR1TG6K
TLSH
T14CD196015E28797B4CCAF11DBA39BA02E2FA603275D51D58E7FD862C04D6ADC6307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 01a6598a0866a0cdca6f034212b18ab238458800fbbe5e4d86ce5016c584d5cd
MD5 1a6fe25d673d711673395f5b86268605
SHA1 81cfb45cea5210031198e2a0f2aa211c56fe1c45
SHA512 0b61f304a900c80780be529c6cf196545b122a2c5dc3682f0aca118fa0e84ff6362c5f8e3e5c109dadbb10a5d0712ec5c8d21f3c33b0e0944409e7e898b743dc
TLSH
T1D1D0A9D8888602E0EFA8EEF422C42C7831301C7208131B2F02938C3C80663ED45A3809
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5972e4.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5972e4.TMP
Size 48B
SHA256 ba75fcc2cf2b7da4e78a397d45daad020d20d38d4d1021f59c57cae11086623a
MD5 91b5baf38a36aa47a2dd00b6f312018e
SHA1 613f31e0f9d258a1e68c43cced3a3f0abcaa00cf
SHA512 2627d90129d2be28b137d2e718cfe7cd1521774ba2dd847922aaa7731d2dc8622b32bedf8ca674719f42dd5d6458f033d8f55bf6a86a92e50c908fb81870a21b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 131f638de323d8c02ffb1e9e6349418409f1d7da6bc73f8cf35ef2cfffe39029
MD5 56c4af2049200a3d3528f9d5a56a2441
SHA1 895271588bc49f5959a015da748528e1ee97fee2
SHA512 d5db69d6dfabc55d9414fb169bcd039b758eb032e9a84f648f353ec9bf23748694197fcd55cc0ba16111a62d4d7270f891d66a88fadaa3607fca2b0246cbe745
TLSH
T14D316CF6C2D48A6CC8A151F467603A17EE2D041593683E19CADDFF8FE7F0478E211A09
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a36a2.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\Network Persistent State~RFe5a36a2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 def79449799a87f32a42b6c3d7ebc2fe7bd8d629cbc8a4cfe35dadbf0abd146c
MD5 026c2b41f919c250fc8fd5448e05fe7b
SHA1 51eb7a1946edd5976e0b623dd546022105e6661a
SHA512 53815546dc7d350f96f1dd35425fa388a83bd196db7e166ea549a19299c50be5d27148c365064ae526c2c35a6db0aa2c2e67c1aa48ff0d25aadc05833dd7991c
SSDEEP 96:stu/dJxTgGSfb9Nk7o5h16ZZTAs7/x+6MhmuecGNh1eje8SK+gm28XM1C7K:st2VMWo0TAsV+FKNhQjR1cG6K
TLSH
T177D1A8025A28797B4CCBE11DBA39BB02E3FA603275D51D58E7FD451C04D6ADC6307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 15KB
SHA256 d22a41197e38787e8ef5d69465278f66d7752a5c3152caf39da9df3c5fa61d92
MD5 dff129f01d74c6e8de448e46984b8d09
SHA1 f35b5fa1a6021ee9d0a74e871c19186f76b09818
SHA512 91080c6b737adba00be86b4fcb58d9481d0ddec805a1b101410458afad33d733ce115124a224e8f9474b8e6c1cc96d9d26bc4984ecf40c6cb4c13e3afc4e11cc
SSDEEP 384:7+aQikB+z/xvxjg/qhEwNBSOET79sHSAVdp8e9zH:a/UxvxjgC+GEfmHSUbFH
TLSH
T1F272AE27A4353E37A5F7EA097D4E478BCBB984B290C16E744AF99F0D06C72D81302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 2KB
SHA256 60b4db2b4b2d8b037c80d1fbbff39793c9b4ef1cfb8c7d1bf30353ce0e083cda
MD5 1979464c2a77dba702633aeff297a678
SHA1 63ba95192316ebd7f9cb9e0785b94f1d11f34837
SHA512 8ba0b0f390dce15eddacf6b9cc7326585358181fb49764aedf24b230611cf10d16173590718f3cc8de403c2890ab369e229bab25c00f853292f5c03effceed3d
TLSH
T1F851BA3379206B3799E68A49BD4B7B13DE3AD062AA921F2096DC1B1C40D765C2306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 3KB
SHA256 8d86a1bdd45cdca7deb844d63a5db1ec471c43035c0901c98ce2794f18fae067
MD5 3d4cdcf1f771a7e18161a567bf52a6a0
SHA1 e8046fcf06c0cb08f8787659e1893d111fa8ddba
SHA512 3505c1605e7d955edfe71820f2e2508d1be34a8b8ac64db1e867524d5a312ffe475579c5ea601cef9c9deacefe892e13e1254326c212143c70900673ef226149
TLSH
T1AD6184376970A93B5DE6DA05BC872B16FBA69023E9D17F64C6EC1E1C01D77882302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe590df0.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-10_562384177b4072115895ad0a7eb5e632_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State~RFe590df0.TMP
Size 1KB
SHA256 66a2452bc33f263b5fa75dfe3730e12d77aa03f9594bd538b9998e594e45f8dc
MD5 cf70879163b920a9c3e60a72927a82bf
SHA1 8ef57b179a7bbc6c9245a0696a44f42d9b825d89
SHA512 87e996ddfba1861ae9a9178d9b9e8cfe6cd6b4877a354af431e21ce0d9a90810b566e608b51adfb7762afce448201fb474699c230c56b9b25578c2918da6dd7a
TLSH
T1CB2184B2E5605F32BC86A6467547B717AE32907792918F0091DD0A2D42F764C661BC32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5572_1382476121\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 3KB
SHA256 32971b0adb5c3b38c50f1a3e56b0e2becce7a5f8b70380e5e895ccdfeb7ef21d
MD5 4b1d875e04e2372ae0777086d280e3ba
SHA1 4b8cb06db4d38fb5f857e480e9c00a95b812d091
SHA512 6b212ade2c37361cf0a6c4f21d1eeb2623d16c3886f3dec03dd9168efcaa5e9e95b980e30b716101e52dcead7775b18659cdd869fa02a607e02d1c978e4ad12e
TLSH
T11271109BE2AF33DFB5103AAC1E60B6431698C060A6E7D3C0F5CA0259143597E75F3089
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 663B
SHA256 5c55188f8c6f5fa0965d8b7768d66b57c4cca39365a3dde63329ba87eeb9b6bd
MD5 4b4dcfeb38a6762e1fcf69768f499efe
SHA1 6ab899bf6bb7c92aa843c6eb23c0bd1397d4640f
SHA512 d316cc297fffac2ada17f0709f97c244cb1cc1804a0add6312fd4e0235bdb53cefe7a3d3a73efa7c4bd50106003aaa7b618b9be7d6bd8d3512bd798895e0fb5c
TLSH
T157019EFAA77C3ACB2044767C9E1C3283D968D87453CFE3C5E7D621AD10399352AD1265
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 3KB
SHA256 6e5811cb8ab76187814f87b033ea3b6edd0ad598c5deaffed911bb8f90c1dc84
MD5 3eb1950e25f3072b50680a1978e464e8
SHA1 a4da79bbf541db3e354d121899c3fd4324b83087
SHA512 710ddc92e871c2698839ccdba29a75d82305d1b96f57b08e1900f43441f7e62fdd4881f1f8508e7b48b1d8710625b57e1f1bccba529863bc98f6bf004405a8b7
TLSH
T1F061109BB3AF33DF74103AAC1D60B64326A8C060A6E7D3C0F5CA025D143997E75E318A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1264-117-0x00007FFA2CD20000-0x00007FFA2CD21000-memory.dmp

Download

memory/2516-41-0x00007FFA2CD20000-0x00007FFA2CD21000-memory.dmp

Download

memory/3360-1062-0x00007FFA2C7B0000-0x00007FFA2C7B1000-memory.dmp

Download

memory/3360-1061-0x00007FFA2C7A0000-0x00007FFA2C7A1000-memory.dmp

Download

memory/3536-422-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-736-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-248-0x00007FF6A7DE0000-0x00007FF6A88F1000-memory.dmp

Download

memory/3536-253-0x00007FF6A7DE0000-0x00007FF6A88F1000-memory.dmp

Download

memory/3536-247-0x000001685B000000-0x000001685B001000-memory.dmp

Download

memory/3536-267-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-296-0x000001685B070000-0x000001685B071000-memory.dmp

Download

memory/3536-287-0x000001685B010000-0x000001685B011000-memory.dmp

Download

memory/3536-251-0x00007FF6A7DE0000-0x00007FF6A88F1000-memory.dmp

Download

memory/3536-252-0x00007FF6A7DE0000-0x00007FF6A88F1000-memory.dmp

Download

memory/3536-246-0x000001685AFB0000-0x000001685AFB1000-memory.dmp

Download

memory/3536-243-0x00007FF6A7DE0000-0x00007FF6A88F1000-memory.dmp

Download

memory/3536-338-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-340-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-350-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-242-0x00007FF6A7DE0000-0x00007FF6A88F1000-memory.dmp

Download

memory/3536-1042-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-432-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-438-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-523-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-549-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-553-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-557-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-565-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-567-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-576-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-640-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-659-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-667-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-686-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-705-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-707-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-715-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-719-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-728-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-249-0x00007FF6A7DE0000-0x00007FF6A88F1000-memory.dmp

Download

memory/3536-744-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-748-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-750-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-795-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-800-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-818-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-823-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-244-0x00007FF6A7DE0000-0x00007FF6A88F1000-memory.dmp

Download

memory/3536-1028-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-870-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-872-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-883-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-901-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-902-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-906-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-917-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-922-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-933-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-939-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-965-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-966-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-979-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-998-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/3536-1002-0x000001685AFA0000-0x000001685AFA1000-memory.dmp

Download

memory/5928-14-0x00007FFA0AF30000-0x00007FFA0B8D4000-memory.dmp

Download

memory/5928-2-0x00007FFA0B0BF000-0x00007FFA0B0C0000-memory.dmp

Download

memory/5928-12-0x00007FFA0AF30000-0x00007FFA0B8D4000-memory.dmp

Download

memory/5928-11-0x00007FFA0AF30000-0x00007FFA0B8D4000-memory.dmp

Download

memory/5928-10-0x00007FFA0AF30000-0x00007FFA0B8D4000-memory.dmp

Download

memory/5928-9-0x00007FFA0AF30000-0x00007FFA0B8D4000-memory.dmp

Download

memory/5928-8-0x00007FFA0AF30000-0x00007FFA0B8D4000-memory.dmp

Download

memory/5928-7-0x00007FFA0AF30000-0x00007FFA0B8D4000-memory.dmp

Download

memory/5928-6-0x00007FFA0AF30000-0x00007FFA0B8D4000-memory.dmp

Download

memory/5928-3-0x0000018A07910000-0x0000018A07932000-memory.dmp

Download