86ae2320346de036bf5672e1de803ddcb3e3337081e20fbfb41e7ff891afd45e

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 2.3MB
Sample260814-fdhcysvxds
SHA256 86ae2320346de036bf5672e1de803ddcb3e3337081e20fbfb41e7ff891afd45e
MD5 39115f628645f2e7fca7f90771c0f163
SHA1 d8a9c1ef4dbd4fbd7461ea412bfff96a03adcfa4
SHA512 c890c4bb1211ba62a4d08a73a1c4cf00581898197bc470f536b231765f72b88fafed129678de6fe1b3378558a10026b76f4c13279cfad4534a2f4bfdd195b0bf
SSDEEP 49152:srZ6zsqv56eG8ONQvf88nb+J/TlUJSLYVMxeDP:NrrG8OmN+lUJSLYVMxe
TLSH
T131B5AF0766D900F8C27EC578C52A9583E772B429C3A4D6EF17D899A50F232DB1BF6702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
34	3688	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Executes dropped EXE 1 IoCs

pid	Process
1664	laddon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1049868521\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1049868521\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_954119311\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_954119311\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_954119311\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-und-ethi.hyb	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311563289413560"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3252	powershell.exe
3252	powershell.exe
3688	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3688	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3688	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3688	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
3124	powershell.exe
3124	powershell.exe
1664	laddon.exe
1664	laddon.exe
3124	powershell.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe
1664	laddon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3824	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	3124	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1664	laddon.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3252	3688	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	86
PID 3688 wrote to memory of 3824	3688	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	88
PID 3824 wrote to memory of 2404	3824	msedgewebview2.exe	89
PID 3824 wrote to memory of 3520	3824	msedgewebview2.exe	90
PID 3824 wrote to memory of 3520	3824	msedgewebview2.exe	90
PID 3824 wrote to memory of 3520	3824	msedgewebview2.exe	90
PID 3824 wrote to memory of 3968	3824	msedgewebview2.exe	91
PID 3824 wrote to memory of 224	3824	msedgewebview2.exe	92
PID 3824 wrote to memory of 224	3824	msedgewebview2.exe	92
PID 3824 wrote to memory of 3056	3824	msedgewebview2.exe	93
PID 3824 wrote to memory of 3056	3824	msedgewebview2.exe	93
PID 3824 wrote to memory of 3056	3824	msedgewebview2.exe	93
PID 3688 wrote to memory of 1664	3688	2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 1664 wrote to memory of 3124	1664	laddon.exe	108
PID 3824 wrote to memory of 3264	3824	msedgewebview2.exe	117
PID 3824 wrote to memory of 3264	3824	msedgewebview2.exe	117
PID 3824 wrote to memory of 2676	3824	msedgewebview2.exe	118
PID 3824 wrote to memory of 2676	3824	msedgewebview2.exe	118
PID 3824 wrote to memory of 5716	3824	msedgewebview2.exe	119
PID 3824 wrote to memory of 3108	3824	msedgewebview2.exe	120
PID 3824 wrote to memory of 3108	3824	msedgewebview2.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /C Get-Service -Name WpnUserService* | Restart-Service -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3252
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --allow-running-insecure-content --disable-features=msSmartScreenProtection --disable-gpu-vsync --disable-web-security --dns-over-https-servers=https://cloudflare-dns.com/dns-query;https://dns.google/dns-query;https://dns.quad9.net/dns-query --enable-features=UseSkiaRenderer,UseDnsOverHttps --enable-gpu-rasterization --enable-smooth-scrolling --enable-threaded-animation --enable-zero-copy --ignore-certificate-errors --ignore-gpu-blacklist --run-all-compositor-stages-before-draw --user-agent=LoaderVnm --mojo-named-platform-channel-pipe=3688.3020.6863264320525401441
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x104,0x7ffaa906b078,0x7ffaa906b084,0x7ffaa906b090
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1692,i,11353919272491800127,3053679283498091077,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1908,i,11353919272491800127,3053679283498091077,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,11353919272491800127,3053679283498091077,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --run-all-compositor-stages-before-draw --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,11353919272491800127,3053679283498091077,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2100,i,11353919272491800127,3053679283498091077,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=864,i,11353919272491800127,3053679283498091077,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4424,i,11353919272491800127,3053679283498091077,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4220,i,11353919272491800127,3053679283498091077,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
    3⤵
    PID:3108
- C:\laddon.exe
  "C:\laddon.exe" 3688
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAAkAGMAcAB1ACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAgAHwAIABTAGUAbABlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAgAC0ARQB4AHAAYQBuAGQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYwBwAHUAIAAtAGwAaQBrAGUAIAAnACoASQBuAHQAZQBsACoAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBJAG4AdABlAGwAIgAKACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIATwB0AGgAZQByACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1049868521\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3824_1055934659\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3824_954119311\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3824_954119311\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

15.5-laddon-temp.exe

Path C:\ProgramData\Intel\ldc\15.5-laddon-temp.exe
Size 5.7MB
SHA256 768bef67e7422b2d11fa169298e8d5fa12bb5a2854e5af69871e72ad20c74892
MD5 9bb76b73db2b005ff1f26055190e8f0c
SHA1 02032280a4a1100220d2ebb229f2e12c4c7dedf1
SHA512 d90b683a883dea4d2c9d84a6ab7edde14b95e227de8be4354a1caa1f69ff82713cee84fa89c31a3d430963294cab084eda15e7139684cc11b5af516ca07a119d
SSDEEP 98304:WZ2FXvtkdpY3Y7YHJRK7Xu//5U6t+YTs7omG6M4MlLn56s7aUFrLXaH:Hht+AY7Y1U2+p7P24OZ2UXw
TLSH
T1F756121B7AAA00B4C89BEF786D175A8EA1EC6FC95D14C216A20C359C313971C5BBF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chairfbi_addon_status_to_sdk

Path C:\ProgramData\boost_interprocess\17000000\chairfbi_addon_status_to_sdk
Size 25.0MB
SHA256 b373e5e358ef473c64781c10ee4cbd38c470d9df8f588292d1f3591bbdebade4
MD5 6a041e4235c3595b13e1850c9179aa38
SHA1 03ef9b941bbb6c2b2ba4651fc96cf195a6d55408
SHA512 9fefedf56111c740e8c7fb2f5f27369244dd55fa62ebf695ef89e24701e0b4ec8324505ca35208e0427f8774f19bec43dea261d9c4f77d1935fdf304bab44f30
SSDEEP 3:YWQRAW6pvAEgWZpB4SePpYlllt:YWQmDvAppPpI/
TLSH
T136471182020028B2CA802AF238AA2A002EA82022E0002802888EA8888220020320382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chairfbi_addon_status_to_sdk

Path C:\ProgramData\boost_interprocess\17000000\chairfbi_addon_status_to_sdk
Size 25.0MB
SHA256 27d5250e5da5bbae04a5de7a1848fc5f480d013b0fa39d61e978d0d3f93bfb13
MD5 bccbbc549cd1918715f1445814dfa1fb
SHA1 d2734de20f4594a461d7d6603bf48fbda2de297c
SHA512 1f9c0ebbee52d6219471b129623ad1f5f4d4a10890831ac9ced110f4a0ea2bb2552181788db26e5a84fcb45cbc158f2ed63604520838197572268fc1ee689876
SSDEEP 6:akXn0E0XPl/nia+l/P66+l/3Ses620SsklWWQmDvAppPpI/:akXn0E0XlnSP63y6HSFlWW4C/
TLSH
T1AE4720B3840B22DFD49403B454DE2B707B7B0515E6409B03C6DA5E14DF65646BF5AC01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chairfbi_addon_to_sdk

Path C:\ProgramData\boost_interprocess\17000000\chairfbi_addon_to_sdk
Size 25.0MB
SHA256 ddd738aebb986e202546c96853f8787635a4750c8bd9785b35689ebab481b3de
MD5 b8f249b4f93a34e5688179f290af8d27
SHA1 47fb9652ae18c3c9bf01a230f232d4694c936885
SHA512 fe60b08673f4d90067920bcc7541509247a7c32be64983e59ce3cc3250d754909ab1119f6f0706094e6ee674c0ab1ad623e70dcfc05f647550b34956add2f9bd
SSDEEP 6:akXn0E0XPl/nia+l/P66+l/3Ses620SsklWWQmDvAppPbl/:akXn0E0XlnSP63y6HSFlWW4B
TLSH
T1BC4720B3880B22DFD49403B554DE2B707B7B0515E6409B03C6DA5E14DF65646BF5AC01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chairfbi_sdk_status_to_addon

Path C:\ProgramData\boost_interprocess\17000000\chairfbi_sdk_status_to_addon
Size 25.0MB
SHA256 6b61090ff66a5e759691b1af5baf20cb2a916dcbeaeec7f50fb156ef8682f1c6
MD5 8a5dfd0bd30e433775d94c8996a2eb9b
SHA1 9eccecd5a7376f13e6a3bdbddef7a3f6861abc7b
SHA512 cc49d435a3dd2c38eed19219b9a32c877fe0e913c3fb6b7344a33598d470784ebd0d54ec85c67150b9812d56af1e0a89eeec849f883f65af8065d17a78bc80a5
SSDEEP 6:akXn0E0XPl/nia+l/P66+l/3Ses620SsklWGKO8cAu2pI/:akXn0E0XlnSP63y6HSFlWGKpcF2C/
TLSH
T19B472073940B22CBD4D4037448DE177077770504E6008B03C2A71E24DF75285EF19C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chairfbi_sdk_to_addon

Path C:\ProgramData\boost_interprocess\17000000\chairfbi_sdk_to_addon
Size 25.0MB
SHA256 18b9187ddaa30cfcbd845e9ba6db3f3f576ac2f543b70c1aadc05d1af15c0c0b
MD5 2cdec0b4d9ac23268f51ed807710af0e
SHA1 80c27fd39bbf39d3079d746f0c2bdcc3b8772acf
SHA512 8753dcb28a81f5d115cb5c6edf6390b019af80efb2d375539da1720e0a3dff961eb8ee853f1e712638f07bb8121cd5b30183dd058f2a3b044f1f549fe3472a12
SSDEEP 6:akXn0E0XPl/nia+l/P66+l/3Ses620SsklWGKO8cAu2bl/:akXn0E0XlnSP63y6HSFlWGKpcF2B
TLSH
T163472073980B22CBD494037448DD177077770504E6008B03C2A71E24DF76285EF19C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 73123d6e562b26b1fd2cf4fece67930d95fc4738bad8d1f386345a5311274739
MD5 92f89789864052cac0862ed6b4f1e706
SHA1 aa6594951427e103fa025c8ebef3ec5a5f85866c
SHA512 71a0261ee6ffcd2e9bb336dde7110f80ac6fa01df5433e77cc170649b7936653d89229255fbeac15692e8736c9f3e5d15d62b2372865fe3d7ab933c511c2894e
TLSH
T1D0610D313375F1E888167F071E28198053BF4355EA94AF5CB298621EEA2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2477cd8fd1940df937d4a6b012df8b6708870ec18e0b3bc48cf49a408ee475ec
MD5 2b14cc7ac94dd8ec71d5368c069a85fe
SHA1 ddf153c49571262b2501c072678f368e536959a1
SHA512 f92d712de311c476d80678bea3f493b9e94e82c86df70259a63891d1454df73195895e42b54cf77f2621183917fa7210af7d87f5b8439bc6b7a897626cb65f04
TLSH
T19D217827F3CC8921CC95163A509D9C1176B282C7819FDFAFAFC0E201A5BF599CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_25rlhtte.2cn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_25rlhtte.2cn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

363531303031303931305253434647.ini

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\363531303031303931305253434647.ini
Size 81B
SHA256 5b0962d0eeb8de6e30f11f3859f99375972e7fa31e6ec97ac7cece6dba034a4f
MD5 3c0fba4c005cc76afad9aa8a0937bd61
SHA1 b7449380a2f3b85b838ac042f56ce3f84065811c
SHA512 1bbd451e0f6cc7ae6ead018ea5a2dbca2c338d17585906d9cb95ed34d1bd3b1b44991c1dee53f84718945a65aade8ff56311aaa57228aa4fa46e64ece038feab
TLSH
T112A002BD0612E4285C0DFC2B628269C9CFC791C161391D9FD6343E73B1AA2D0B50E40F
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 07ffc1b9e8ee3e3adee1d7fb1a7c3e0adccafae06de57e7ad269e9f685a0faab
MD5 ba68135059fabcc0b94f8ba6bbeb058f
SHA1 35efc8e42257d88dce9e95e66928d043905204ac
SHA512 7965ba3ff3da91401848a83d3ebe7e575a83d035a1028d132bd6aeaf9573d9b989ded1fb33ce89960a3ae22eff151e016607d38db4245f68b149937f2741c638
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a42631c5ba7c173d9a413778b39afc35ff46d2012df0cecd8217bbc458fc8079
MD5 622dd06013ab3d5bc00240c0b5ec1db5
SHA1 9942f38293c05c639c25982d5c33fa3ad93ecef3
SHA512 a012d84bcfc5ef341085efb979b97bf9d4aae1717d08a3c10c38bd6d7cc9c5f5b40eb45ab63af8c5d2e5a8fac29eb2fe15474aaf209fbb7046bdbf3229a9ae27
TLSH
T1B1D0121232C1013AC0203533050271490A44D10B4009C0449429991E6A045D00E434C2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8423186c3e98af653c2a9a0e0aef015315becf3277b2ff64656aa07cb003316c
MD5 cf97ac04d202e192da5da59f3fcf450e
SHA1 8235dd34b537ca3c700900110c50f5dc2c0e11f2
SHA512 0a58da3255707997ec339307879d13c7a32c75a6f990d5ff87080c090698b6715255305e45d9972af2a6b531518b68587017ae2e37627edf718b71c496974942
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 acd94223665d5f9eb0851e361678881ead25be2cefd2953cf3a1120593df2a92
MD5 4de1b9e9d2f0705f1e1d3866dd5d5ba3
SHA1 22e04bd993c99517f5b3f400e74904f014eb23b3
SHA512 e0ab39209c1e8e33a783ce6b0fd0cf5deb5f76b4ce89c16174831e0e9da1d6fc9ae0c78c7630e341e522b7360aeee6289b038112284340877a742a3673d2eeae
TLSH
T1B7D01238C0A6B6D0FF55AA7D22975E84B235191E405503AF0CD47D29B4665D944A3815
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 f24fdb8250c28654fe106d1c7cab4fa96925044dfdfd6573a64de8d6166b54b7
MD5 d7ee3589300cac367f1670665ddac105
SHA1 bccd30e80411d40d37272ff75f0260f411d88619
SHA512 77dbc5501046c0ccb01323a4ee0e33744e56de445e3b6d882246d947946727655bcbddf7fc7b36dafc3d460a46bb51757685266e191c9c8eecbaf7595f6810a2
SSDEEP 3:LstlNllkll/lOE5//l:LsX3lEtOE5Xl
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 6020e974f5b447538a178bddd241fcedab471cb34619926915b58c26fa7cb1fb
MD5 3ad1012610be5caba9e663e8af16d1a2
SHA1 5bf49da4059b2e753f87fc63918c8ebaf7b7299b
SHA512 cca4a4ce660394bba53bb79be0fbe160ad0b34896c2b600b1e7cfb5e6113911bd13be3dcc10ae2bdb34b2f09cfa431b01983e2339ef5af457248f5a32e8c5784
TLSH
T1FD318EF2C5D48A6CC89151F477602A1BEE2D044543682D19CADDFF9FE7F1534E111A0D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59e332.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\Network Persistent State~RFe59e332.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\TransportSecurity
Size 352B
SHA256 2ebbee779cc54bffab77eccfbbe17589699f02932539700d0370768f0c7e0102
MD5 e2e1af43bb0224f8f9f87e5d8f997605
SHA1 eba076943c29ccdfb77a41ea50bf79db46cc9964
SHA512 75cdaeccf4625956bda48a4842e24cccae99fb8eb93defae2b34900764f46a5f9bb23ef7559f6fbb77b97c09623f98431e69e08947054e88467c6200a2a81e47
TLSH
T1F6E0D8B2827BA477203849661B897C64BA77A439539198E8DA56593D60C06A61602862
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5938d9.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\TransportSecurity~RFe5938d9.TMP
Size 352B
SHA256 02415382b0e8196ad2cf3f39ae8e58cb6deee08e55ff7bf483003091404f5980
MD5 9944a2c6f328b7ccb7cd8e80eb0bd4ac
SHA1 e653a981fa3d7dca6baf76c6ec79018584c81f12
SHA512 f7b99eafa3d4a6647c579bc975b210b275ec581c9534088af8a544f6aab280c5772c9dbcdc46e1b39795651d20ca71a746a7b40e10ae0a89b705066242f96514
TLSH
T1C8E0D8F2817BA577203849661B897D54BA7AA079539198E8DE56453CA0805B61602862
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 c356d0e3ec71173a6d6af56b6bb411999693d41ea41e15d6ec99761dc69365d2
MD5 c0bfcfd47cb989c6e5a3e33f5b38eb38
SHA1 8ee2c51d55f45b8ffe279e4ae84ed72bf3ce9343
SHA512 97939e367524a8e6a8f991782a37372042691e3a95eb16e2f722caa7065547952768062da33f8fcfee8b103ea8d6cd25650ef64286d0f21aa8ebc35b51526232
SSDEEP 96:std05/x83eb91ff7Z8i0vhEIk+um/7qx+WVHMSm+uecGfz1idQjL+gfQPMOB:std03/fzZ8paY7/S+WiEfzwd+GPMC
TLSH
T12CD184025F6879774CC7F619BA35BB42E2FA106265D50E58EBFCC61C05E66CC620B84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5969ad.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Preferences~RFe5969ad.TMP
Size 6KB
SHA256 74d44d32ef22d201fd81466f3c37941a8191587a5642ed5706518a2f9e0bf5cb
MD5 a0350e60a82ef0570009ba485f50e28a
SHA1 4edf5878faf051302ec090db0837f93fc7c5d420
SHA512 9637a1e75dd433470d9e315ae20592770df9d25660049047473e79a0c76d3a4a893ff2da324c141f454b4007d1d9c03a79500a024b0ef3df7c709360ca169d9e
SSDEEP 96:std05/x83eb9iff7Z8i0vhEIk+um/7qx+WVHMSm+uecGfz1idQjL+gf2PMEB:std03YfzZ8paY7/S+WiEfzwd+EPM8
TLSH
T152D196025F6879774CC7F61DBA35BB42E2FA106265D40D58EBFC851C09E66CC630B94B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 1KB
SHA256 8f711d2b44ffe1e0e5073e307d45ef8a16a2dbf84fa5be932c20a7e5fd7b1712
MD5 886f0153a6b8bda44d8cc19fe243d0f0
SHA1 3a70caf495efcf322e83588f789d2a4dd49cc1a5
SHA512 5be9e9e71b074ec96f3812162c00d9ae66d2e2054a8a5f6fdbff6963ce5e1a0aab41c66e703cdafd1e1646c2a2efe2eba6c81636a2a4347bec49facb4481a843
TLSH
T1793185B3E8D42B735CC13945B24A7E9B6F312066D1108D48A6ED8B1D03D669CA52ED36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 2KB
SHA256 2f4220f42effdfa99a9f8fcacff1cad242e7efaa7302676bc5c4ed08a1ea7692
MD5 9a3a4917b03df323fa8c9b4f2035adba
SHA1 9464b52e473b041e667e818cb374c6c3c36bee29
SHA512 9ddf31ea178ec1a75949f17a6b28b206eff172cb2dbc419a9a798ebb779c49b489b229dc0f91cb19bc75c43685a01beaf3ab7d796b19a147884d8baca5a1ac0c
TLSH
T1CB51B773B884AB7749D26944B94D3E53AF3661A1D9511F549AED1F0C02DA19C230AC26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 3KB
SHA256 9ea2600ca64ce845756bd3a5092cfdb7fec9ae163dc0e479322604ba2a88d186
MD5 64d2ca50df85dfc7ee512c1de119551a
SHA1 cec3b5238e017ba546cb7d8d269ae8c70858ca4d
SHA512 6f1b5cee72330216ec3ed8494c471eb332d858d2925c25f0a68bbc540f8fd7bb9cb3acebce93b39bb73af8018f88c3cc014a711b1efc10f3e9f3b007f8ca1285
TLSH
T12171A622A8A4AA374DE2AD00F9893F16BB655123D5913F98DAEC0F0C02D73982346C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 16KB
SHA256 5c6be769d14d3fffea50c7e0fe87b2864089072a02762e01052b8b182afa9c7d
MD5 bc8d96ed956a384a73ca3a675525ff64
SHA1 9fef1497d0416507b8a91df9db7f5bb225247d94
SHA512 cfbaf447488f2512f33ae45fd0741c91b5861e651dc3636c6488c173c5c7e8f860dd3bf0d5ddb414ce11d4054786b323da4015669cee948ae0d1a73705a100a5
SSDEEP 384:zG+aQikB+z/xvxjg/qhEwNbh4HC05lxqM9zE:F/UxvxjgC+1i8lxqMFE
TLSH
T197729E3755A87E3398F2F904B94D0F4BDBB994B290C16AA84EFD5F0907CB3A41306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58ca9e.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-14_39115f628645f2e7fca7f90771c0f163_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State~RFe58ca9e.TMP
Size 1KB
SHA256 fcfea495bb3561375c1a83c1380e852f19551e7a51bcc7286079f557d566a438
MD5 44d5d8785b986b31f554b417f77356af
SHA1 d168ae32a7c41b51b9dc91086fe2130f2f578464
SHA512 d10d5bcf999121f289191cb6e07192b5151a015d29b8874f90c3efebe997ae597326c163042f99a9b470f1691662683d2a111e5d1221d122598732f9d5a3cdbf
TLSH
T1BB219573D8D43BB258C12840F20A7A8B2F3060659110CD08E1DD9B1D03C75AC953EC32
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 663B
SHA256 f69151e5597bbb9b8f3d571f9dc6072cac04ee1d6593e2a5d17d8b51e26829ce
MD5 9f8b3e606db15845c06d76722ed6eb63
SHA1 5cbd7f46ed26f7337201470019f51b277f56d481
SHA512 767251429033640c342a76f9489bbb2549a06f2ed66c7228b5e5fa639761df9dd80e439f96aa198105f443c21448e056e20f97e647d184eea8f12ce022123842
TLSH
T18801FEEAA37C36C72040337C9E1C3783DA68C83003CFA3C5E2D6219D1039D362AD1265
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 3KB
SHA256 170d49586650a50cc99123b8c6926f19013277d59580be28bdf96e09bacb4ef9
MD5 0b94d8932a75a486d543d2269f2b183c
SHA1 1c5c7f5628899e2b217db2a58c36cc9a606727b9
SHA512 5d6881ac83abdc5f3c6054fef0aa1c4b7c69962744e770c593af9a09f48aadffa5b48b99fd66e4448ab193abc86e68c9d873527da4825583e95498e333697c59
TLSH
T1B261FD9AA3AF33CF75103AAD1D60B64216A4D060A6E793C0B5CA0259543997E75E314A
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 3KB
SHA256 759e62881b3e0b51df088220b7e7fd780c07900ecfd6d1952658b4e72a5fd39e
MD5 2a24c9413a7e58a99c9cceff61d4cb9f
SHA1 7151fa86626cfbc1d1459dabad942c5a38449398
SHA512 f3679e14662ae7c030b294b65aed573533ade2c68be7a2bfeb944a5935ce24ef17c5a5b7f3238bcff362812eb834aacd5a3ce4a975311f75947bcfad9cc9e9b1
TLSH
T1D3711E9BE2AF33DFB5103AAD1E60B6435698D060A6E7D3C0F5CA025D503697E75F3049
MD5 SHA1 SHA512 TLSH

Submit Download

memory/224-62-0x00007FFAC4CD0000-0x00007FFAC4CD1000-memory.dmp

Download

memory/224-63-0x00007FFAC4750000-0x00007FFAC4751000-memory.dmp

Download

memory/1664-275-0x00007FF66F760000-0x00007FF67055D000-memory.dmp

Download

memory/1664-998-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-291-0x00007FF66F760000-0x00007FF67055D000-memory.dmp

Download

memory/1664-494-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-500-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-294-0x00007FF66F760000-0x00007FF67055D000-memory.dmp

Download

memory/1664-290-0x00007FF66F760000-0x00007FF67055D000-memory.dmp

Download

memory/1664-511-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-554-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-570-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-293-0x00007FF66F760000-0x00007FF67055D000-memory.dmp

Download

memory/1664-295-0x00007FF66F760000-0x00007FF67055D000-memory.dmp

Download

memory/1664-606-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-611-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-619-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-633-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-640-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-684-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-688-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-706-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-720-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-735-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-289-0x000001B649270000-0x000001B649271000-memory.dmp

Download

memory/1664-288-0x000001B649220000-0x000001B649221000-memory.dmp

Download

memory/1664-820-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1578-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-276-0x00007FF66F760000-0x00007FF67055D000-memory.dmp

Download

memory/1664-274-0x00007FF66F760000-0x00007FF67055D000-memory.dmp

Download

memory/1664-862-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-880-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-950-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-969-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-982-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-319-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1025-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1027-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1577-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1543-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1528-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1522-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1284-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1287-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1292-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1297-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1346-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1503-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1500-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1486-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1470-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1419-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/1664-1403-0x000001B649210000-0x000001B649211000-memory.dmp

Download

memory/3056-161-0x00007FFAC4AC0000-0x00007FFAC4AC1000-memory.dmp

Download

memory/3252-3-0x000001A1F9580000-0x000001A1F9590000-memory.dmp

Download

memory/3252-2-0x000001A1F9580000-0x000001A1F9590000-memory.dmp

Download

memory/3252-12-0x000001A1F9580000-0x000001A1F9590000-memory.dmp

Download

memory/3252-11-0x000001A1F9AC0000-0x000001A1F9AE2000-memory.dmp

Download

memory/3520-40-0x00007FFAC4AC0000-0x00007FFAC4AC1000-memory.dmp

Download

memory/5716-1392-0x0000023784FC0000-0x0000023784FC1000-memory.dmp

Download

memory/5716-1383-0x0000023784FC0000-0x0000023784FC1000-memory.dmp

Download

memory/5716-1384-0x0000023784FC0000-0x0000023784FC1000-memory.dmp

Download

memory/5716-1385-0x0000023784FC0000-0x0000023784FC1000-memory.dmp

Download

memory/5716-1394-0x0000023784FC0000-0x0000023784FC1000-memory.dmp

Download

memory/5716-1393-0x0000023784FC0000-0x0000023784FC1000-memory.dmp

Download

memory/5716-1391-0x0000023784FC0000-0x0000023784FC1000-memory.dmp

Download

memory/5716-1389-0x0000023784FC0000-0x0000023784FC1000-memory.dmp

Download

memory/5716-1390-0x0000023784FC0000-0x0000023784FC1000-memory.dmp

Download