085a66ff0f704d258eae3e4b3cf1ef2876038ab0fd9cb732ff606dc5518c88fa

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 2.0MB
Sample260826-2bs8bsxdla
SHA256 085a66ff0f704d258eae3e4b3cf1ef2876038ab0fd9cb732ff606dc5518c88fa
MD5 6bc1189317ecd0861bfc2ebdfa8746ba
SHA1 d634a5f6f6cae3b092b7ab614e96cfd4a260080b
SHA512 bd4eb0d3f78f62826ed0603b44909d7625f29fbdccdbec2453fe7eca2b81aee5d6dec83f317f70cbed1c636535ce6173b46c6af2542342785d1f983f222d6ad7
SSDEEP 49152:jMPwCZ+PtIL0M4ZdsKJ7BTwUOXiaNyWSx36:Oa6KJ75wiaNyhxK
TLSH
T1F9A57D43E2A260EDC45BC2358B175222B671B8411734AEEB6258DB352F73FD05E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c555-11.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Loads dropped DLL 3 IoCs

pid	Process
1480	chrome.exe
1480	chrome.exe
5816	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe\" --silent"	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe\" --silent"	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	icanhazip.com
1	ip-api.com
3	icanhazip.com
8	api.ipify.org

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\cele_wtest_000014c0.tmp	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Program Files\Google\Chrome\Application\cele_wtest_00001364.tmp	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3240	powershell.exe
1672	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1244	netsh.exe
3580	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5544	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322567140243157"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeShutdownPrivilege	1480	chrome.exe
Token: SeCreatePagefilePrivilege	1480	chrome.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1480	chrome.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5312 wrote to memory of 1244	5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 5312 wrote to memory of 4956	5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 5312 wrote to memory of 1480	5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 4964 wrote to memory of 3580	4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 4964 wrote to memory of 4412	4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 1480 wrote to memory of 5816	1480	chrome.exe	99
PID 1480 wrote to memory of 2476	1480	chrome.exe	101
PID 1480 wrote to memory of 5544	1480	chrome.exe	102
PID 1480 wrote to memory of 2476	1480	chrome.exe	101
PID 1480 wrote to memory of 968	1480	chrome.exe	103
PID 1480 wrote to memory of 968	1480	chrome.exe	103
PID 1480 wrote to memory of 416	1480	chrome.exe	105
PID 1480 wrote to memory of 416	1480	chrome.exe	105
PID 1480 wrote to memory of 4516	1480	chrome.exe	106
PID 1480 wrote to memory of 4516	1480	chrome.exe	106
PID 1480 wrote to memory of 756	1480	chrome.exe	107
PID 1480 wrote to memory of 3296	1480	chrome.exe	108
PID 1480 wrote to memory of 756	1480	chrome.exe	107
PID 1480 wrote to memory of 3296	1480	chrome.exe	108
PID 1480 wrote to memory of 4592	1480	chrome.exe	109
PID 1480 wrote to memory of 4592	1480	chrome.exe	109
PID 1480 wrote to memory of 4648	1480	chrome.exe	112
PID 1480 wrote to memory of 2412	1480	chrome.exe	113
PID 1480 wrote to memory of 3912	1480	chrome.exe	114
PID 1480 wrote to memory of 2412	1480	chrome.exe	113
PID 1480 wrote to memory of 3912	1480	chrome.exe	114
PID 1480 wrote to memory of 3496	1480	chrome.exe	116
PID 1480 wrote to memory of 3496	1480	chrome.exe	116
PID 1480 wrote to memory of 4444	1480	chrome.exe	119
PID 1480 wrote to memory of 4444	1480	chrome.exe	119
PID 1480 wrote to memory of 4576	1480	chrome.exe	120
PID 1480 wrote to memory of 4576	1480	chrome.exe	120
PID 1480 wrote to memory of 4048	1480	chrome.exe	121
PID 1480 wrote to memory of 4048	1480	chrome.exe	121
PID 1480 wrote to memory of 4504	1480	chrome.exe	122
PID 1480 wrote to memory of 4504	1480	chrome.exe	122
PID 1480 wrote to memory of 3580	1480	chrome.exe	123
PID 1480 wrote to memory of 3580	1480	chrome.exe	123
PID 4964 wrote to memory of 3240	4964	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	127
PID 5312 wrote to memory of 1672	5312	2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3580
- C:\Windows\SYSTEM32\cmdkey.exe
  cmdkey /list
  2⤵
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Compress-Archive -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\am_wg_export' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Celestium_85_203_46_187_20260826_232642.zip' -CompressionLevel Fastest -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3240

C:\Users\Admin\AppData\Local\Temp\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom.exe" --silent
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Windows\SYSTEM32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1244
- C:\Windows\SYSTEM32\cmdkey.exe
  cmdkey /list
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --headless=new --disable-gpu --no-first-run --no-default-browser-check --disable-background-networking about:blank
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1e4,0x1e8,0x1ec,0x1c0,0x1f0,0x7ffa82a3c728,0x7ffa82a3c734,0x7ffa82a3c740
    3⤵
    - Loads dropped DLL
    PID:5816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:2476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:13
    3⤵
    PID:968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    PID:416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:4516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:9
    3⤵
    PID:3296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
    3⤵
    PID:4592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --force-high-res-timeticks=disabled --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:4648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:3496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1920,i,2138056896796871885,10533009804274738448,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Compress-Archive -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\am_wg_export' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Celestium_85_203_46_187_20260826_232703.zip' -CompressionLevel Fastest -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clst_core.js

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\clst_core.js
Size 68KB
SHA256 efecf21aae9cf813861baa4d6f8faa0ab7962aa9d891ed6b531d71f1053f1299
MD5 fd129cdd274fa9498576e61490bff59d
SHA1 682e1c6a1f580967aed4ea60dbf0be5ed2b7124f
SHA512 aa9dcbd7a4da6a1170e0c5c77bb371c52d92a057e3c8ce19ef42d50d11ac896ee3481de2481b8810f39615d7475fda6dbe236ad96d88495d4803074987ef3645
SSDEEP 768:BVHXf6tyc+oQawX/BaatiWD4l/l9as9oYg0OAGVuOsiHzqkHdjxRaRJkyoX/QtRu:HHXkrwZDIpoYgjXMLiTqknuU
TLSH
T11963B8AA21FB25314263906A4A5F6414B23BD403354DFDD0BE9CC2186FDD669C6F2FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ce3f941012ffd6288d2e988cee8ef26ebbb688b55f7f82f29db6ca811afa0db2
MD5 186920c419cd9b0355f141556e577404
SHA1 ff387c5c92df7898ccc861580566f58af3949d70
SHA512 a03e60bb443ee66f884f4a2b6567dc02c10273deb489a7266639e38a4e0fbfde9c738e77d79e543544a31ac67858889c0dd1615c77ceebf4e81b37de79c933a7
TLSH
T10231BB33F3DC86E5D889413A00C9EC203AB693D751DECED7BB84D608B52F298CE601A0
MD5 SHA1 SHA512 TLSH

Submit Download

Celestium_85_203_46_187_20260826_232642.zip

Path C:\Users\Admin\AppData\Local\Temp\Celestium_85_203_46_187_20260826_232642.zip
Size 135KB
SHA256 578b0ce048d55680e6f71019e52c2fea219199254ddae6785675ac0fc61eac24
MD5 8439b84eca89cfdfbea5aa642e654c33
SHA1 1ec2e0c65f5a48a126012da795bf667cff0c725a
SHA512 b3288ed02c1da18f389bf2812a72ccca3a1fc58d1085f5541db28153643afd8291d3cf71f3b48c8457b877b38399ff6dcfd96f67ab4f5334dae7bd8a4cb78c0a
SSDEEP 3072:J0HumXCKUJp6ddC+r6+mw5Kb9LEFoCwG/W5X8v:6yKFC+9f5KxCwGf
TLSH
T16AD302EF580CDD1BE5B941F072E79C122D4F181619BE396EB34D5E9920A8DBCE4C209D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Celestium_85_203_46_187_20260826_232703.zip

Path C:\Users\Admin\AppData\Local\Temp\Celestium_85_203_46_187_20260826_232703.zip
Size 135KB
SHA256 bad77f7f7a7a4e02efc0976cf2436cb0d2c9d30e7031600ca883a77fff3b09d9
MD5 4c52af86799cb7b6bf8288d01b06e659
SHA1 983cd9c907aaa143efe157ce74ca4b6f58ace744
SHA512 db8cb9fb6d2f46601330ac61f6ae1c4d2a419714dfbbc5f4a397018bf02534005f5b99184f6bca7381bef7e7846fba97dc32a7f0b7538a6c3bd1d9c13f2113db
SSDEEP 3072:ysHumXCKUJp6ddC+r6+mw5Kb9LEtoCwG/W5X8+:ryKFC+9f5KBCwGO
TLSH
T1A8D302FF590CDD1BE5B941F072E79C122D4F181619BA396EB34D5E9920A8DFCA0C209D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_znlke5k5.byq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_znlke5k5.byq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

am_wg_cache.log

Path C:\Users\Admin\AppData\Local\Temp\am_wg_cache.log
Size 4KB
SHA256 962d2b7dd0e8b32e19782d16b93075bcd34329d340e1626e35d6d2a663cba7dc
MD5 d24c9918e3c5bcb9aa18a11579e5895a
SHA1 46ddfe1e5d8f4837f372d90c26e37b397cfadeb3
SHA512 16617c67b1d8f5c2e6fac8d7921bc07c8ae26257275a07ceac101b68aeec10ce2eda96858445c7e8c550c53d0e24e7b1a0cbf415498fc3f5c2918fdcd47f1827
SSDEEP 96:jRYU+E4gJYt+jc6F0nVC8O6FiGwHibrfswMnXhn/ynkTB7zTunuCBNhD8AxeP6Nr:jRYUF3JYIjtF0Vf3FdwHOrfswGXh/ykK
TLSH
T19C91A05F05FD5D3BF935D25A9918BCA8B796B50009081D78BF09581329AD81E7FC770C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_wg_cache.log

Path C:\Users\Admin\AppData\Local\Temp\am_wg_cache.log
Size 13KB
SHA256 7f623def6910c9d6633077ea335326b39bb619e68920581d9716b37943a1585b
MD5 0f568ae9697f75a3bfd68c23ecf6c471
SHA1 8536b009fa45936d026225a0769fb4a716d91fbf
SHA512 df24100cf0abfbe67751970d25beaf74376980436363887d9db8e34873d63d170a522f4590de5b94433987857ec536388a4b1ca7a56bb6c6cf37e286e9b37690
SSDEEP 192:jRYUF3JYIjtF0Vf3FdwHOrfswGXh/ykTB3TWuCBNmAxeiNhrk+EY5nQ5JAo//Qpq:PFJbi7IrbiuIeZ7
TLSH
T1E852246F01FDAD3AB95641578A58BCECFB63B1021A052D78BF4E04176ACD80E79C3B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_wg_cache.log

Path C:\Users\Admin\AppData\Local\Temp\am_wg_cache.log
Size 25KB
SHA256 7e74d80fc50f3d357bca65be8168cb574c6f9ecd2dc7a5ca8c77f7ca8a3acd16
MD5 39445f7e9d71b197d39265f7d7dd2da7
SHA1 cd0bf294a8310420e2caf3f79961f8faf2c996c3
SHA512 c61524efe155f7845fb147dadc83c75f5f8e0c888185eb602dc50b4af30d0870276de79492e5c5337a30e2d9cda72392d811874ea0bdf6cafeff240c97acb908
SSDEEP 192:jRYUF3JYIjtF0Vf3FdwHOrfswGXh/ykTB3TWuCBNmAxeiNhrk+EY5nQ5JAo//QpP:PFJbi7Iy/xzSIqB8u4c5NV0V
TLSH
T1E0C2C32B06FC5F7AB81690578F38BC6DBB63B94415512A68FF09445922CDC1EB6C3B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\autofill.txt
Size 15B
SHA256 5e5a36ac166c6450c367f4e701c7da02fb0cf60261a1284abd346866361271b6
MD5 32d279e56cd873d346cebfa11ef5975f
SHA1 c271dfedfda456d687d27a6d23d3c0c5a342472b
SHA512 b34ed5f49878f89993db754c158bbaf7a59a0f981a666e6dbf352a9e08ccd82a0e2291722da199bd0bf561e9343a35c32e1aec3a5d70aa5248f0fea9e1938e1a
MD5 SHA1 SHA512

Submit Download

cards.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\cards.txt
Size 19B
SHA256 f5ea7253cca46b404a34ca757144d9a1c9a0eb1f4853e66de0a8aef1b4c95708
MD5 3f7798bd3bb06d35fed9608055cb4d53
SHA1 fcb8ea5e68f6860841d426c2aa982902daee46e6
SHA512 6a18d1ef2d13908aa5785855c3f2c322f3597be508ca1ea2e3d1e699dbd93543a8e4fa2d529ec702b1becc01689accca12059c6edf399bded744a8da4e21a2d0
MD5 SHA1 SHA512

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\cookies.txt
Size 290B
SHA256 3db89d9d1d7e1f49680ede1422291db10e7ac755b322e301bb83499fb8a6d779
MD5 d3b4a246b5d648ee6fb37a8ab1a2471b
SHA1 63a7a228e9254d2904bf066f3bcff57e969c463c
SHA512 fcbdb35863a554a3f7a227c2785f278af149dee6b17524d432e4b6101d89ae9039ad5d0aa4497c5d536df4b32ec32db3987fc803459775f8da673a263d11fe28
TLSH
T142D02B16F895A19D5DB8C26B3777F297DD88A050530052397087D015930EB17D6ED2EF
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\history.txt
Size 71B
SHA256 b64a3045fb95f19c48dfe99923b1e457f8fec882766cab298c237e4f23ea5f95
MD5 07c39c6991c5cbb15e1c4844b9a39215
SHA1 07f6835eec5c2c4b9f2403e35da32e3dfe1516d6
SHA512 8e5f7ed7579bbd6339ad489252ddfb01a3f4c8a0baf9064839636781f787865e02996b2eceb097b906fefc7ea63945d521ddb51ca7a534a5f32a59a1b02c1b8a
TLSH
T14AA0220BB083B82CECA2C2232808F0EE8F008022C2230380308B0A0800A8A23802BB8C
MD5 SHA1 SHA512 TLSH

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\passwords.txt
Size 86B
SHA256 6632d81d2058411721f82c6db5512095a08f8c7bcbd9b9a4cb697ccd26919ac9
MD5 1aa790f8edc9fae8381ccc85beaff83d
SHA1 5278a4d479a8232833c812ead33646a17e483432
SHA512 c634e3c22b75dc7d7a237145beee450e9b07f757c20ed3b941bde6d5031fbada4f8b2882c2ba19bff6d8a4c13a8e63bd9402be2afb4c8ecdd2d38133f4085626
TLSH
T186A0128338D5806D9C92921A040D3191CE006118C22111342093D03102073021008B68
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\raw\Local State
Size 4KB
SHA256 45b3e8f3f69c462d8a1a1001e6cf8385961a08f49f452cc5d0a1947d37299c6d
MD5 3df1c162865842763faedea184d9879b
SHA1 e667daa9acbc691542bc28ea9e70903a6c649d9e
SHA512 ad8a02bb36c05aa7ccc1ea9996cdddf300c88d1ba5329b1d9b83a7b497d1851b2e13feb9dc22dfab902c19f777ddbf75765b074953cd03b8dfc1ffa8529e7a52
SSDEEP 96:5KC6jd+oJm4V0FH+pqf+HBKyoytsRDotok53HDjB6eGyvktndob1V4a:MCIHJm5FHuPgXDUDz9WBndobj
TLSH
T1E9A12AB178BA4CB719B7D244F9923A83DEA4A22765A0FF84D9DD1F0C11F31D81341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\raw\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network_Cookies

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Browsers\chrome\Default\raw\Network_Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdkey_list.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Credentials\RDP\cmdkey_list.txt
Size 181B
SHA256 2bf707a12dae32cc83c868da7a1ff6f52b6314840cc58d27a788cf0c9352c645
MD5 ec7d4a0e6b26e390521cfb052e89a2e8
SHA1 c1c639e7037fdcdf03f109daca4facf488a53101
SHA512 dbb0dc4c2acf87600ae3cd913ee738560bd196c0c14e724567a1ba9b783f6696a863573d4e3ce7f059c32cf3ba4906d6fec6cb084cb77c7982b89e3d52ec8bcf
TLSH
T11BC080447465C0747F339375E1118354E25C34EB57430931754D514B5F341955F46257
MD5 SHA1 SHA512 TLSH

Submit Download

outlook_profiles.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Mail\Outlook\outlook_profiles.txt
Size 51B
SHA256 110542af71afd01e8ca5a70506666228a159c1fe365ec62f3b00f1f7da0a90e7
MD5 c9d914c3a121bd841222c6814d9620ac
SHA1 9e5f42f83cafe6224d67433b8fcb8f1c467fd696
SHA512 0c70307c73b43641db23eaf17ad6be833f827e2cb2eea1dbd8e1e5a03b161dcedafe58119e8c20e08e5741c6be52769c7363a0429e344b977ee64245a4a27e46
TLSH
T14B90028606240019416069E1705092E222170851A56394850090DB141C0272405CD051
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.jpg

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Screenshot\screenshot.jpg
Size 94KB
SHA256 ecaa83847a6c64d10e87113fd45f6cfc00d9f40f8f619b1420f848fae548b79d
MD5 d5190d10e47bb7e0f7d2679992ff4f36
SHA1 030c1075ee620487e2f1f7437d08fa251fa1ff13
SHA512 447939a5b7a7ccca847df9c0d8a2d3bfc3ffee3827a33191fca5f8a54976578d94a0c2c05d2963448e062ec91bb9d6b0689fcaf455951ba6d31367242b8643f4
SSDEEP 1536:Ukb8HDHUtwGg27ndjA4s2xc5uCXLdw5FYFZbiy5h10xremV0e7HT:yHDgwGg27ndxsuCbu5F4ZuyDqZemVj7T
TLSH
T1979387079D588B83945897E8BE074DAD5F0A6B0CE4927BFF51634ECB7F502260C9E12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.jpg

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Screenshot\screenshot.jpg
Size 104KB
SHA256 c1dcbda0d3afac982b6c567a2565754007b49f174cc5f493f82ae165b74399a6
MD5 6fc9401bb04710f6da873b6ae4a0ff6f
SHA1 13dfc78b7ff8c8ac05746bb6025d1cc45b172b7f
SHA512 edef0048711a15ec437ef86186087f7053db37d0ca0405f8216940e77e62f03956f86c3d17665a3e4f7be4771bac92cc86cae293210ab330481b2324786cd446
SSDEEP 1536:Ukb8HDHUtwGg8E/kVab96+lelIMq3/f7e6ZrambvDmT91zip0Dnu:yHDgwGg8E/kapXlbMq7e68S42pku
TLSH
T189A376479C48CB93A52887D5BE034EDD6F476B0CE9967AFF10524ECB3E206624C9D12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wifi.txt

Path C:\Users\Admin\AppData\Local\Temp\am_wg_export\Wifi\wifi.txt
Size 36B
SHA256 23ad3d2e8d28269430247d68d215b649037983e00c6919db058717316f9448e0
MD5 d516ff7393e8cc68dc313ac5e71c6172
SHA1 44c9fc57f03c8a1906e13d8c0825309370acfc21
SHA512 1e04d797d9c5d884d0a4505b43c64aa7be72f37d818c18c8bd834b1a1ed7245b0d02795ae9647ab23f434c01afe572168855fc57d11a29f7cfa7caa86ff5a3f3
MD5 SHA1 SHA512

Submit Download

am_wg_inj_000014c0.dll

Path C:\Users\Admin\AppData\Local\Temp\am_wg_inj_000014c0.dll
Size 280KB
SHA256 ac5d203d97c0ff9c8c7bde7f5c59540cceae12b230083f1592e1be0ab99984f5
MD5 fd394016ef3b095443d4aa4982286e43
SHA1 e12d5a3e2013ea2a4dc2e286e4e94308c3a7efcc
SHA512 7b8c38e1810e677584c2c3822a2d8dde769f8f56a18c0ec5b4ca4a93fe2ce6cd165a2c0ec5d23f0d374165901e162552a69efddd5eed9891b761428b0061a564
SSDEEP 3072:++/bmdgPnIoeNDQcY4TfOj2gdG7Zbrb3s3lLpy/kcq5y1y9j/q62vsRsOB/ygV4h:9GknIoYks4A3bTZk9QvsbBjg2ZtBTqP
TLSH
T194545A07A29250BAE857C63ACD139B1AB77278110330EFDB23558B35AE377C11D3A7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_wg_key_00001364.bin

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key_00001364.bin
Size 32B
SHA256 f36926ae958b4bd224c5e4500ee0f457752f38f893b5045d6e2682af03b5bd57
MD5 c241e2acc97537faa1d56bf123f1fcda
SHA1 02c906e34c51faffd6e9e1a8e42776f298afcdd5
SHA512 7ecccff136211c1df33138d5527133a64e14a1331b9e8c9bc69c31a1b3850db2c242bb89ced9f0e3e2cb83f4003819d7a37f25d58b3317071d46ef0370d53707
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key__ud_000014c0\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

am_wg_key_elev.job

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key_elev.job
Size 126B
SHA256 7c600ae7e69ec64c8678cc0e828be17b2c83010a68515cdcdc7ce31e31fdd350
MD5 ab4bab2490601c92805980ddbe7bb7a1
SHA1 9197f971389ab26c2e5552e993561c9d5b4e0c1f
SHA512 f0c2827457af7e5afd71f866ae146f878f0f41fba5241f84bc818304617fed304a2fda72a386f092279460e692d2351e202e50060bdbbf2a5d2a8eadc7e5293b
TLSH
T179B09B10D2C6F53D8958D06F4565795CC8B55C087FC73701C700D40C11C544DF5C1307
MD5 SHA1 SHA512 TLSH

Submit Download

am_wg_key_elev.job

Path C:\Users\Admin\AppData\Local\Temp\am_wg_key_elev.job
Size 126B
SHA256 ba1d4e2cddab033f5f0acb387bcfdc2c28e9367241a67e33b73b22a38c0c1c6d
MD5 2c5c48392cd5c9cfc05811ef80688c1e
SHA1 ff43e3d2d99fcb83f8d8a2538c7972e90e1d9744
SHA512 ce4846de0a924648b3c68423b039f6dc3bac584828f530064044c8ee9dca519aa90068ef0dee6114952bc0ac604cad26dd596854b3ab252d466c87bdd6a806df
TLSH
T13DB09B0091C6F92D4D58D06F5565695DC8B45C097FDB3701C700D40C11C644DF5C6307
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1672-498-0x0000017F36E10000-0x0000017F36EC2000-memory.dmp

Download

memory/3240-479-0x0000028FB1AA0000-0x0000028FB1AB2000-memory.dmp

Download

memory/3240-480-0x0000028F998A0000-0x0000028F998AA000-memory.dmp

Download

memory/3240-478-0x0000028F99540000-0x0000028F9954A000-memory.dmp

Download

memory/3240-477-0x0000028F998C0000-0x0000028F99972000-memory.dmp

Download

memory/3240-476-0x0000028F998A0000-0x0000028F998BE000-memory.dmp

Download

memory/3240-471-0x0000028F99480000-0x0000028F994A2000-memory.dmp

Download