085a66ff0f704d258eae3e4b3cf1ef2876038ab0fd9cb732ff606dc5518c88fa

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 2.0MB
Sample260826-2bs8bsxdla
SHA256 085a66ff0f704d258eae3e4b3cf1ef2876038ab0fd9cb732ff606dc5518c88fa
MD5 6bc1189317ecd0861bfc2ebdfa8746ba
SHA1 d634a5f6f6cae3b092b7ab614e96cfd4a260080b
SHA512 bd4eb0d3f78f62826ed0603b44909d7625f29fbdccdbec2453fe7eca2b81aee5d6dec83f317f70cbed1c636535ce6173b46c6af2542342785d1f983f222d6ad7
SSDEEP 49152:jMPwCZ+PtIL0M4ZdsKJ7BTwUOXiaNyWSx36:Oa6KJ75wiaNyhxK
TLSH
T1F9A57D43E2A260EDC45BC2358B175222B671B8411734AEEB6258DB352F73FD05E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000002466c-20.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Loads dropped DLL 2 IoCs

pid	Process
3980	chrome.exe
2180	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe\" --silent"	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe\" --silent"	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13	api.ipify.org
5	api.ipify.org
8	icanhazip.com
9	icanhazip.com
10	ip-api.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\cele_wtest_0000102c.tmp	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Program Files\Google\Chrome\Application\cele_wtest_00001244.tmp	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
872	powershell.exe
3500	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4592	netsh.exe
2260	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
436	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2180	chrome.exe
2180	chrome.exe
2180	chrome.exe
2180	chrome.exe
872	powershell.exe
872	powershell.exe
3500	powershell.exe
3500	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3980	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2260	4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 4140 wrote to memory of 712	4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4140 wrote to memory of 3980	4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 3980 wrote to memory of 2180	3980	chrome.exe	93
PID 3980 wrote to memory of 2940	3980	chrome.exe	94
PID 3980 wrote to memory of 436	3980	chrome.exe	95
PID 3980 wrote to memory of 2940	3980	chrome.exe	94
PID 3980 wrote to memory of 1820	3980	chrome.exe	96
PID 3980 wrote to memory of 1820	3980	chrome.exe	96
PID 3980 wrote to memory of 4236	3980	chrome.exe	97
PID 3980 wrote to memory of 4236	3980	chrome.exe	97
PID 3980 wrote to memory of 2192	3980	chrome.exe	98
PID 3980 wrote to memory of 2192	3980	chrome.exe	98
PID 3980 wrote to memory of 2312	3980	chrome.exe	99
PID 3980 wrote to memory of 4824	3980	chrome.exe	100
PID 3980 wrote to memory of 2312	3980	chrome.exe	99
PID 3980 wrote to memory of 4824	3980	chrome.exe	100
PID 3980 wrote to memory of 1792	3980	chrome.exe	102
PID 3980 wrote to memory of 1792	3980	chrome.exe	102
PID 4676 wrote to memory of 968	4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	104
PID 4676 wrote to memory of 4592	4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 4140 wrote to memory of 872	4140	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	118
PID 4676 wrote to memory of 3500	4676	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2260
- C:\Windows\SYSTEM32\cmdkey.exe
  cmdkey /list
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c" --headless=new --disable-gpu --no-first-run --no-default-browser-check --disable-background-networking about:blank
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1b8,0x1bc,0x1c0,0x194,0x1c4,0x7ff84db4c728,0x7ff84db4c734,0x7ff84db4c740
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2020,i,2399186084403096774,649293977847924249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:2940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c" --force-high-res-timeticks=disabled --field-trial-handle=2020,i,2399186084403096774,649293977847924249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:3
    3⤵
    - System Time Discovery
    PID:436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c" --force-high-res-timeticks=disabled --field-trial-handle=2020,i,2399186084403096774,649293977847924249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
    3⤵
    PID:1820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2020,i,2399186084403096774,649293977847924249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:1
    3⤵
    PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2020,i,2399186084403096774,649293977847924249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:2192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2020,i,2399186084403096774,649293977847924249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2020,i,2399186084403096774,649293977847924249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:2
    3⤵
    PID:4824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2020,i,2399186084403096774,649293977847924249,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:2
    3⤵
    PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Compress-Archive -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\am_wg_export' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Celestium_85_203_46_94_20260826_232651.zip' -CompressionLevel Fastest -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:872

C:\Users\Admin\AppData\Local\Temp\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe" --silent
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\system32\cmdkey.exe
  cmdkey /list
  2⤵
  PID:968
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Compress-Archive -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\am_wg_export' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Celestium_85_203_46_94_20260826_232654.zip' -CompressionLevel Fastest -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clst_core.js

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\clst_core.js
Size 68KB
SHA256 af504092a83d3e5b5cff79a8e7d765ef3cbd677f7cc58eb27539bc8498f49301
MD5 e51018f732a708ae6ae7d0cc4109d999
SHA1 aada9f2770b30eae73759d7044191a01c512fb4c
SHA512 53dc6f10d5373d79475b0d53ce03f8e5b867ae4462b104600643a6088729810ec5577935d780f0df97d76250d241f0b6167353a0d585d5594c463af9a94ee309
SSDEEP 768:2VHXf6tyc+oQawX/BaatiWD4l/l9as9oYg0OAGVuOsiHzqkHdjxRaRJkyoX/QtRu:0HXkrwZDIpoYgjXMLiTqknuU
TLSH
T14A63B8AA21FB25314263906A4A5F6414B23BD403354DFDD0BE9CC2186FDD669C6F2FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vfa44o3v.d1d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vfa44o3v.d1d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

am_wg_cache.log

Path C:\Users\Admin\AppData\Local\Temp\am_wg_cache.log
Size 2KB
SHA256 60ff4f5ef5a33d79b738398f43128d976ea52a62f4166d5aa1a460107b2e654a
MD5 f495a9380cf523f2775699e35b214402
SHA1 c3c773ecf8652f5a5ddd6d9214ae9b40ee49758f
SHA512 10a5a0e371a91207e28caeb3e93d42c036c3a0674eded96f84486e6ff89d4ecc86dd2b7344a7e33f9141414278af5d92b63162efa814e8ae0133017000badf81
TLSH
T1B2513BA610FEA977E939815BC919BC84F7C3F10416478DACAE096D412DCC85E76E7704
MD5 SHA1 SHA512 TLSH

Submit Download

am_wg_cache.log

Path C:\Users\Admin\AppData\Local\Temp\am_wg_cache.log
Size 10KB
SHA256 ff1e18028ca53e80e70ae7a051d16f221b7147cbf98eaf632dbe324467331a77
MD5 f7ef099277502625ee9548121b8bc7d0
SHA1 badfa00c24ce54fb26adfdd6ba01976fd1da7383
SHA512 5b8698f16cbf5f5101f671773ed5cb63c2c84b83fefc154d51e6b934b30d20a316df7683d9ba5711d06d84308835ec5ce7af22d97573ad70dd948d21a8953a9e
SSDEEP 192:E/FPEFXE6nsTe5JAo//QpwI1aWAA6j9k7ZVR:EtCEcvbi2IgWAA6xk7J
TLSH
T1BE22C02610FEA937E96A40178918BC89FBE3F20525579D6C3F4D6C4A6DCC80E76E7B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_wg_cache.log

Path C:\Users\Admin\AppData\Local\Temp\am_wg_cache.log
Size 24KB
SHA256 74a216884ce7f96bcff44b18f80e91cc3cf865d57aac8d25d24228c6da6b2451
MD5 b55f72bf87714ca2d8197071aba26bf5
SHA1 f2c32b3f68007963e7cd07b0ddb213aa79ff0d9f
SHA512 803e7df08d78b7ecd9bbfbec811cbe66500b0307a218d02ae697095db51ce459f5294cd37f749cb5b4863cbbe113a482d3567cf2fd8d6cee6c0e191c18d63942
SSDEEP 384:EtCEcvbi2IvbiVIl7iAqyim9oaBVf8A5CIUU2ZSur+mKDUCiJ+MRs1H10A1qEZQC:QKbxIvbyIZ7bR
TLSH
T109B2CF1A00FE9B37E956804A8D64AC49FFF3F60021D65E68AF5A485926CC81FF7D3760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions_report.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\Extensions\extensions_report.txt
Size 116B
SHA256 767a7d511244786d4fc79ad4d7e5635789b9656e1bc077a42f61346b02bf0215
MD5 020d07eaf760501ecafa5234892d1133
SHA1 e384e1715e7101ff4b9e380f224396b2c91d7b22
SHA512 9f67772fee0b5d870fa0c04cded12b0b81198fe0151831c8584304f6201c141d3d9a34dce624c8dcd0da1d4bf30e573aef7688c8fc72dda1d9c87d759d7d5799
TLSH
T1C6B0121BB14ADD1B3186DBBCEE18F23FBE320C18E2055D22505B5F2004303BB9761752
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\Local Extension Settings\000003.log
Size 68B
SHA256 d96b3d82465808c49ce3c948745074d143504d00f44a9ff3b26a42f0c88e1f61
MD5 f67672c18281ad476bb09676baee42c4
SHA1 fb4e31c9a39545d822b2f18b0b87ca465e7768c9
SHA512 ff37752848af570cb284f5fb65837472ddf9941992fffceb049a70c36d858c37e4e87016176b4e62d0eda63c235ca742411947d50d163cbc7823c50a734f0898
TLSH
T10CA002A3BB121111D502D9B8701067969726C521024B55D1450901355AC9694351A199
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\Local Extension Settings\LOG
Size 404B
SHA256 e26abff9078694c9c4072e510242de3dbe141111da83be09dbcde81103a00c0a
MD5 c4fd2fac9aa7a4546e3147a5c046c756
SHA1 3eac561d49ace5d613cd57f432040ccbd9dbb072
SHA512 9d727664d97e4f6bf4b60e4275cc55c397308e864558fc45514d4b70363ff1f83cd702d9ad0225231a31a265324d4d0fcb03ca2e48a4a77dbe5e7b58df1f5223
TLSH
T1C3E0E55E38CBEFAD2489906BC3658B4ECBE43409A2993A52DB8ED8841055744D2C4E66
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\Local Extension Settings\LOG.old
Size 361B
SHA256 1dc315a1c2c37beec4792a4ade0f837f506ad28a7c5255d3531fc1ee391e6c6e
MD5 8f03bae3b3ae269eb41943446c4938c6
SHA1 a4eac0d4757c4d900cfc5d0374f80fd354d9da6c
SHA512 91a266c4c789f48ae068b67cafced1fcf7b616711b633ab0e36c1e2f29644b9ea05f72e36cc425f2343c161b08198f24f79a551ffea5315cf92136d0bc86f615
TLSH
T14BE0D84E7CC6DAAE209880F5C731474FDFE4A40DA3D53B568F4ADD045096A4CD3E4667
MD5 SHA1 SHA512 TLSH

Submit Download

autofill.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\autofill.txt
Size 15B
SHA256 5e5a36ac166c6450c367f4e701c7da02fb0cf60261a1284abd346866361271b6
MD5 32d279e56cd873d346cebfa11ef5975f
SHA1 c271dfedfda456d687d27a6d23d3c0c5a342472b
SHA512 b34ed5f49878f89993db754c158bbaf7a59a0f981a666e6dbf352a9e08ccd82a0e2291722da199bd0bf561e9343a35c32e1aec3a5d70aa5248f0fea9e1938e1a
MD5 SHA1 SHA512

Submit Download

cards.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\cards.txt
Size 19B
SHA256 f5ea7253cca46b404a34ca757144d9a1c9a0eb1f4853e66de0a8aef1b4c95708
MD5 3f7798bd3bb06d35fed9608055cb4d53
SHA1 fcb8ea5e68f6860841d426c2aa982902daee46e6
SHA512 6a18d1ef2d13908aa5785855c3f2c322f3597be508ca1ea2e3d1e699dbd93543a8e4fa2d529ec702b1becc01689accca12059c6edf399bded744a8da4e21a2d0
MD5 SHA1 SHA512

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\cookies.txt
Size 480B
SHA256 69579e40cfcbd499778eada87140d57f1f17a9e3ad5555ab2c2c880ef8809aba
MD5 9a19ac80c39ccd4e37866de7aed27d1d
SHA1 b9d743ae4294242c010dfc98234c465b9fbce345
SHA512 6e090b45ce935c593e961e4e8a92e405472f7ea25f772f9b303386bbc1a463e38912d0b233bf1b06c63bf16cccf4b04f850027516a7d1afc61675b828af46d96
TLSH
T126F09E477AA2D5AC18A4DA366B3431D31F11A4D4511175B472835469734988662A11E9
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\history.txt
Size 71B
SHA256 b64a3045fb95f19c48dfe99923b1e457f8fec882766cab298c237e4f23ea5f95
MD5 07c39c6991c5cbb15e1c4844b9a39215
SHA1 07f6835eec5c2c4b9f2403e35da32e3dfe1516d6
SHA512 8e5f7ed7579bbd6339ad489252ddfb01a3f4c8a0baf9064839636781f787865e02996b2eceb097b906fefc7ea63945d521ddb51ca7a534a5f32a59a1b02c1b8a
TLSH
T14AA0220BB083B82CECA2C2232808F0EE8F008022C2230380308B0A0800A8A23802BB8C
MD5 SHA1 SHA512 TLSH

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\passwords.txt
Size 81B
SHA256 cbc153a90677b911d7cd6dfcbb4b13214f49bd102fc499b162bddcc1de5bddfa
MD5 c84dc5e6a71be229bb80521df4d5a161
SHA1 e632282d417152a73c5267533d74906d2915bdcc
SHA512 9d2cd26a4da277552c501c5cbe0f4e851d12628fd702188ca6c6e1fd7e0c066aa6f30cd99fb08364104d2205f96bd55e073cd2c7ad2a87323ee31f4ba2edad19
TLSH
T116A01182B882802CAEA2AA2A080EB0A0CE00B228C232223030838022030330A2008BA8
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\raw\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network_Cookies

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\raw\Network_Cookies
Size 20KB
SHA256 a1f2668fb16bb3c2284218c899a3dc42156323f3c6ec928ca7dd3d82f0ac8b60
MD5 728da7b6264c9acbaddc7e4a0a145d95
SHA1 f5b4c5667bfe3128676710dc6720e08089790bf5
SHA512 eba83fa60957ea92dec1504c5b13d86619d3bc8b57c419af0fbb73a2ac0c620abe2e49680cb302853869fb0d4926d9acf7fd197e15e49a3954ce67b835077168
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5YPj0VF9PFhlRgUH0Y8j:TeW9aw/aHLopFMavU1iBwHYj0X9th7Un
TLSH
T1F192EF8F1F703610C0F88636E9C619A71E7D112C93637A89AE5814F3DDD209FF5065E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DFBE70A7E5CC19A398EBF1B96859CE5D

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\LocalCredentials\DFBE70A7E5CC19A398EBF1B96859CE5D
Size 10KB
SHA256 884519eeea90b916d928bc6b0897c33662e0560d4c629cb4dceb2bf481d9457b
MD5 3f4a84566d281193a60622591862af9e
SHA1 6e2b92ad1e3ed1f32c4a69109003e7f4900f181e
SHA512 0f84a837011f1412c6e9003321afb25adb2c75af5a5eccae3a7c2e9e580358f6f7f70ec6469704d0b7fd1f535f1d9b869f1cd6995b3770dd1c7ece95364535ba
SSDEEP 192:dYW3kMHvFAwXsNx6U+/X7AbIcFjK6ji+n231NdEGYoOfniFa4QW+tLU9DIy:L3XvFjXCm7w1F3sklKFa4QZs
TLSH
T1B632BFED0B149957AC24A6D8C02D3195C9D3E8E7B0B0454ADC2589DFC13FD50C936BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdkey_list.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\RDP\cmdkey_list.txt
Size 322B
SHA256 6cdbeaa5ff4d13f5a7f0c16ef823821d175d1a658597a541dee0c4b64f49c504
MD5 ee8f514293d9ec1192fb0c897cd99700
SHA1 2b6e0dbede06be58566e641f78f9821ab83b4ef3
SHA512 b0cd7768e4752e1d5f08ceec7116a94c232e7be2815d2cf1b49b90630a8b3c4b3ceb03a86f7586e26d8b963728b24f70cf1ae642bdd5c8fc92152c71a883d92a
TLSH
T15CE0CD1895F4C078BD3247BBD4038360E10D74E76B03152974C977490F302454B8E325
MD5 SHA1 SHA512 TLSH

Submit Download

2FA1CAB4EFE3461D7529C3D858F6D5AB2D0B81BE.vcrd

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\2FA1CAB4EFE3461D7529C3D858F6D5AB2D0B81BE.vcrd
Size 585B
SHA256 5c591dcbc70f10df5db1389107bf2ebaaf199df99369a2d69b7449046f30c1e6
MD5 a9fee73452cbfb3692e57a671f6a088c
SHA1 605c749c5691200eb5f8b9c42654bca59500ab82
SHA512 ad09a83d1f8e6f7f31d98a465cbb69604039e92cc0972f3c2ce338639d022a2f5cbf9fbb786c12a3f5442e48e2b55773bd983bc1cd70940f526290f808af5c66
TLSH
T143F0DC15AF8D4655F8BB27B009F38682757CA410BF32452B38D4F6860CDA7464F26B3B
MD5 SHA1 SHA512 TLSH

Submit Download

3CCD5499-87A8-4B10-A215-608888DD3B55.vsch

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch
Size 262B
SHA256 ca469f2580e20b3d1077355a1e0e673be724ac15ab15e859b7bc3bcf60854120
MD5 0c19329f1a0959d6e069dd77dc32e7fc
SHA1 8216c5d18000ff6c11f0b562a85d650b3e07da7c
SHA512 fbbe1626c32f7b77c77fa1e0e5f0c22562d3bdc15a4290cf300625efa782c31d9ac461ea2b6552dbc42f16137bfc226d98ee2f002a353245eae6afca873e912d
TLSH
T127D09B0443D50345E1B3063404F533402571E834FFB1825C445073541D557E0C3263F9
MD5 SHA1 SHA512 TLSH

Submit Download

626DE2E964784C5E3F2A23D53F1FEC5D50FFB06F.vcrd

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\626DE2E964784C5E3F2A23D53F1FEC5D50FFB06F.vcrd
Size 537B
SHA256 2163170e0dd47982bbd6ed6f36aaebbec6dfb1afaebaba46bd85f41747492492
MD5 735e9062c4c1cfbeba738a73952d63d9
SHA1 26dcd462830d9c36cb28d0c288dd439cf31110ec
SHA512 8d42a2d38b14317c522086b37e6e5d44c5d48b477349f86398d1b96d36f053616ba1f3dbb6df062e480eaa2de55220d20cc7f9f477c73e348ae7b1d2778b81f0
TLSH
T1BBF05C8267A0460AE7B3037026F242A162BC9550BEF68217249872511EA77911A26738
MD5 SHA1 SHA512 TLSH

Submit Download

7D08D9427944A2802286F5F5F70D5F333108AF51.vcrd

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\7D08D9427944A2802286F5F5F70D5F333108AF51.vcrd
Size 553B
SHA256 799ff985aae12f27b2c548225d97582bd06abe4722e444594f1b847d8dce9a85
MD5 497cd0647187f4782aa7453a786aae2a
SHA1 b20ddaa3660cbefb9dd985d8aac301ef44951986
SHA512 3f0ee2953feea3d590c442045a4b21f17aea9d4a58ea96edbccce92933efc4989644caefd1c7037a6fa01b13db1b7649dd28ed382a706062915990369763d2bf
TLSH
T1E6F023192F85C64AE13343F45DF30380FE34B114FF930A091040B2B00FB2A498B91AB9
MD5 SHA1 SHA512 TLSH

Submit Download

D2BCB9E2C797E494C9C358C9F74F087DCD655562.vcrd

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\D2BCB9E2C797E494C9C358C9F74F087DCD655562.vcrd
Size 553B
SHA256 9b2f4bdba6543fa525e2bb615815ada0ae7be46e0eab2ae5dea358d802f13881
MD5 8cd779a9b4653d4f15cd199ba5918950
SHA1 c19587cf3a092177283b9efbef1b0a7ef1c76e15
SHA512 043c391587d85baefa06991a7d50b274b11800573ba29b209eb7fb3e5c0a2b561b650196b891b52fd85191f7349e63bca2f5e95c3c3ba8db8a7fa11ab2ea8fa8
TLSH
T1C2F0553127C9831AD5A7177819A2839AA17890C0FDB3C38F3058BA300DD32874B3A3BC
MD5 SHA1 SHA512 TLSH

Submit Download

E3726B043FE622BB3C99C7B112E83754BCA45405.vcrd

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\E3726B043FE622BB3C99C7B112E83754BCA45405.vcrd
Size 553B
SHA256 f669c1954ab1e78beba0996c166c1218748f5a5e0f96950564f879b7f03ce502
MD5 f23b29488b3cbf100104a2d2ba3f1efe
SHA1 edc78879fa7d4e54cdf7b91f737ca8e184d6b18a
SHA512 7b06a78e1972e38fb445a9c6c59df1b9be1273d379fe802a5dfd9c01d876eb7b56f81eb86e000ca1415b049bb33347d0e881fc1753a2c2b9827a7c3352f891d1
TLSH
T133F0DC159745020CF533473400B343C072BC7453AD7389076080661408E26580E32779
MD5 SHA1 SHA512 TLSH

Submit Download

Policy.vpol

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol
Size 436B
SHA256 07549c58334be57e15db7cf5f42ff3d62f59f614640febc5eac33c6568d7d2f2
MD5 65df4b8b78fad73b73d578ba960b37eb
SHA1 b2b02d44bfae0f575688eaa1ad70806a509f1f73
SHA512 6f0ec705a60434b7dea17159c8f7054f8ee2a3e41bf6b149c54ce89b3aa305b55c9ee8a831f5a981ad2a77c491a611699f431e3da2a6d68639672f705de2f1bf
TLSH
T13EE0AB1B2BD85286D005C778A4BA238C53C6ECD17B49928F150A12527EA1A33A99EB01
MD5 SHA1 SHA512 TLSH

Submit Download

Latest.dat

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\Vault\UserProfileRoaming\Latest.dat
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

outlook_profiles.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Mail\Outlook\outlook_profiles.txt
Size 51B
SHA256 28a32c0c35bde43700964d7948e5defedf4fe9cc9a382f8e0a9305f92793fffc
MD5 6f392981411e0a7d3b01deb869ed9d7f
SHA1 b441f87a710b795c35f65ab562c7d7be226d803f
SHA512 ef84c31eb95983a617f393f7a2d0600d2ddcae5520e1a126d98de076b9afbb7bad4e6c92291bb62512516b44309a4e53f3a87ea12af0e3fd7c3b7d5fdf3e9e56
TLSH
T1B79002890954000551316C91314182E136560CC366B380910604CE04490771411C9051
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.jpg

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Screenshot\screenshot.jpg
Size 89KB
SHA256 5054cc7b8f5efba98828b118ae21f8e9a0a4d032bf4c31e824f0efa4b231bc51
MD5 274a121edc548a79db384f5a78172035
SHA1 e2a7728124fada073126af444c6cc0a89f9a3957
SHA512 da9acf568bb5824d1b8485c0a2757d8182364e9624152b8a00e1f7057228db9d4fa40e601502b3074aa68ad69f7624c68fc348e1c0ad77a9381689c35196a8dd
SSDEEP 1536:UmNG2PWOdJBbghstyfxp4TE5C8rwYbMF6g+AYDaacU3mnLuazjqU:rNG2PWIHbghTfxpCaXrwzJZYDaaLWnLD
TLSH
T1F69321079C09DB53A42483E8BE435E6C6B472B1DE8923AFF10624DDF3E652251CCE56E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Account Web Data

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Session Files\Apps\GoogleAccounts\Chrome\Default\Account Web Data
Size 76KB
SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
MD5 b89fd902b32528a846212c73a9bfbe73
SHA1 b2bc3a06c5bf56df8b8245e2947e7f78fb6a416d
SHA512 ae387b21b2d3801abe3543f23d1705b51982e4f076c923cfee764f3ea525ce276d8360623be00d402ed7c804f801e36ba42b68d32a5f6e856e153d6b96ea750b
SSDEEP 96:pv+kOyOFXmT7i04MDDPtg3IM8n0ys5bSAoFLoeqclNz58rx2n:pln06Ca
TLSH
T15A73224A7A342505EDE28A362CF090F75D7C722D8F01A9412DA73028CDA5897F23A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Session Files\Apps\GoogleAccounts\Chrome\Default\Web Data
Size 138KB
SHA256 87508b57d67b30c8b9353641b7c92b714d3d8f647240327ab3e4e08db45bbf81
MD5 1e188d370e073b621aa4496f72fb01c4
SHA1 5c5ee50fcc995075c7ab9ac5408b98f067c94430
SHA512 232eaff324f181d92455609dab0af4c62b38a3deba7c44afa796ef9afa4ef2750f851dc5413b759affb15e20e9a45c1a6af5180dc955254848ec29c9fcf1cffa
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OGpX6gikqOsVumcbwko:zeuvBnhJsueMEGvIW1DcP2OOBiVummno
TLSH
T1AAD3864B3A743102EDE59A721CE051BB5E3C716D8F5295D438B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Session Files\Apps\GoogleAccounts\Chrome\Local State
Size 115KB
SHA256 a08ca9325279799dca3f2fca503ddace31b950776d635b5ac36111e87f428b00
MD5 540909bb9683e405dba15d2279aec79e
SHA1 7dee7125265d93fc2dd6f1921658ff36d0e2ef7d
SHA512 45a6bee67cb1f8f7201559d8760b5a88ec98d100c68a744e36145b4a3960f103d60cebc5c4db4fec9da4ceabc395a47338d14e06d9062dd523fa45488af57825
SSDEEP 3072:8Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMN:Pm7Rkm1tYpBeh2BAoN
TLSH
T157C3123B5D75ED379979A70EB08E0B1F1EF149A2D920DE92C8D86B0477EA7CD0A04934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Session Files\Apps\GoogleAccounts\Edge\Default\Web Data
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Session Files\Apps\GoogleAccounts\Edge\Local State
Size 8KB
SHA256 2e51290d1885539b29f26bbed7c2999f449ab8d6154050c385987262efdbf4af
MD5 32c00167a6ba8af12650d8c32127c675
SHA1 8ca51ed43d9d2758110e1f490d5e616633fbdbe5
SHA512 aab05b1cf5e00993597d0379e816372f34a0a2386c99d4c757e085e752aac9d11061059899a7d94ee96381b49e22e25396f0a5dd7ec44fd0073f5bfeb596c77b
SSDEEP 192:tONC6JkRtQmiUyjgW+RNfCk7Omto3ZRwe:tONC6UrPW+RNaEEoe
TLSH
T1940209356C386C7B8EF3AD05B48B27171FA4206BFA952F80DAD81B0C00D769C234793A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wifi.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Wifi\wifi.txt
Size 36B
SHA256 23ad3d2e8d28269430247d68d215b649037983e00c6919db058717316f9448e0
MD5 d516ff7393e8cc68dc313ac5e71c6172
SHA1 44c9fc57f03c8a1906e13d8c0825309370acfc21
SHA512 1e04d797d9c5d884d0a4505b43c64aa7be72f37d818c18c8bd834b1a1ed7245b0d02795ae9647ab23f434c01afe572168855fc57d11a29f7cfa7caa86ff5a3f3
MD5 SHA1 SHA512

Submit Download

am_wg_inj_0000102c.dll

Path C:\Users\Admin\AppData\Local\Temp\am_wg_inj_0000102c.dll
Size 280KB
SHA256 ac5d203d97c0ff9c8c7bde7f5c59540cceae12b230083f1592e1be0ab99984f5
MD5 fd394016ef3b095443d4aa4982286e43
SHA1 e12d5a3e2013ea2a4dc2e286e4e94308c3a7efcc
SHA512 7b8c38e1810e677584c2c3822a2d8dde769f8f56a18c0ec5b4ca4a93fe2ce6cd165a2c0ec5d23f0d374165901e162552a69efddd5eed9891b761428b0061a564
SSDEEP 3072:++/bmdgPnIoeNDQcY4TfOj2gdG7Zbrb3s3lLpy/kcq5y1y9j/q62vsRsOB/ygV4h:9GknIoYks4A3bTZk9QvsbBjg2ZtBTqP
TLSH
T194545A07A29250BAE857C63ACD139B1AB77278110330EFDB23558B35AE377C11D3A7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_wg_key_0000102c.bin

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key_0000102c.bin
Size 32B
SHA256 681b42ec8b6ead16d5d16a60d5f056d8c076776e2ca52528a2d6e25c21b65ed5
MD5 988154cc95c273726caf04ac5524d0d1
SHA1 154b9901f8870dc9638a0433d9e40c23ba6acb75
SHA512 6643b9b4bf9bde337d49d3891746fb2acbb0caf08db495d78012c4aa50520b65cfb59c0b2615fd74488368f47325fb84501a5581b3370d8ff6dd7cb327f25da5
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_0000102c\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

am_wg_key_elev.job

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key_elev.job
Size 126B
SHA256 3774a001cb44fc293de969f5cb09dd8388ddb45a0e31b25733fcf6089ef994d8
MD5 914b670088625faab9ce1531b386ad03
SHA1 2619c3c03ad6aae65669701abb66ca3b516f1726
SHA512 4cc01dc3e864ccaccde909334be20ea338c598273ee4ccee6b845b7fb6fbd6afb41777957dc2118acad41a6c3232b6584b23a74d0302544a556e09444c2be5bc
TLSH
T196B09B1092C6F92E4958D06F45657D5CC8B45C087FD73701C700D40C11C544DF6C1307
MD5 SHA1 SHA512 TLSH

Submit Download

memory/872-246-0x0000016B75D50000-0x0000016B75D5A000-memory.dmp

Download

memory/872-245-0x0000016B75D30000-0x0000016B75D42000-memory.dmp

Download

memory/872-237-0x0000016B75B70000-0x0000016B75B92000-memory.dmp

Download