9b879dc97b458ed770c9b777dd22b088edffe72ee9cfcde98766cfc764685d97

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 2.3MB
Sample261003-mdb99scf59
SHA256 9b879dc97b458ed770c9b777dd22b088edffe72ee9cfcde98766cfc764685d97
MD5 7191c562871597ad9adad5ea39f6d627
SHA1 847469f06ff5bf3e385472e7c385f6e8de47d72d
SHA512 ee4cdfd24dd0cd364f4fdfab6faf865e0bc1b456ff0afbbdb9313ab4eb5eab40f3ad926c0beba11f96f472abf7445ea0253ed4fbc274fd3967a4047d254e466b
SSDEEP 49152:srZ6zsqv56eG8ONQvf88nb+J/TlUJSLYVMxeDP:NrrG8OmN+lUJSLYVMxe
TLSH
T107B5AF0766D900F8C27EC578C52A9583E772B429C3A4D6EF17D899A50F232DB1BF6702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 40 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1282462868\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1282462868\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\Part-ZH	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4900	powershell.exe
4900	powershell.exe
5052	msedgewebview2.exe
5052	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3532	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 4900	1752	2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 1752 wrote to memory of 3532	1752	2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	91
PID 3532 wrote to memory of 6000	3532	msedgewebview2.exe	92
PID 3532 wrote to memory of 4972	3532	msedgewebview2.exe	93
PID 3532 wrote to memory of 4972	3532	msedgewebview2.exe	93
PID 3532 wrote to memory of 4972	3532	msedgewebview2.exe	93
PID 3532 wrote to memory of 4972	3532	msedgewebview2.exe	93
PID 3532 wrote to memory of 5788	3532	msedgewebview2.exe	94
PID 3532 wrote to memory of 264	3532	msedgewebview2.exe	95
PID 3532 wrote to memory of 264	3532	msedgewebview2.exe	95
PID 3532 wrote to memory of 264	3532	msedgewebview2.exe	95
PID 3532 wrote to memory of 2756	3532	msedgewebview2.exe	96
PID 3532 wrote to memory of 2756	3532	msedgewebview2.exe	96
PID 3532 wrote to memory of 2756	3532	msedgewebview2.exe	96
PID 3532 wrote to memory of 2756	3532	msedgewebview2.exe	96
PID 3532 wrote to memory of 2756	3532	msedgewebview2.exe	96
PID 3532 wrote to memory of 4572	3532	msedgewebview2.exe	100
PID 3532 wrote to memory of 4572	3532	msedgewebview2.exe	100
PID 3532 wrote to memory of 4572	3532	msedgewebview2.exe	100
PID 3532 wrote to memory of 5220	3532	msedgewebview2.exe	101
PID 3532 wrote to memory of 5220	3532	msedgewebview2.exe	101
PID 3532 wrote to memory of 5220	3532	msedgewebview2.exe	101
PID 3532 wrote to memory of 5052	3532	msedgewebview2.exe	102
PID 3532 wrote to memory of 3628	3532	msedgewebview2.exe	103
PID 3532 wrote to memory of 3628	3532	msedgewebview2.exe	103
PID 3532 wrote to memory of 3628	3532	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /C Get-Service -Name WpnUserService* | Restart-Service -Force
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --allow-running-insecure-content --disable-features=msSmartScreenProtection --disable-gpu-vsync --disable-web-security --dns-over-https-servers=https://cloudflare-dns.com/dns-query;https://dns.google/dns-query;https://dns.quad9.net/dns-query --enable-features=MojoIpcz,UseSkiaRenderer,UseDnsOverHttps --enable-gpu-rasterization --enable-smooth-scrolling --enable-threaded-animation --enable-zero-copy --ignore-certificate-errors --ignore-gpu-blacklist --run-all-compositor-stages-before-draw --user-agent=LoaderVnm --mojo-named-platform-channel-pipe=1752.2460.11196869909128883845 /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView /prefetch:4 /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd0bd15fd8,0x7ffd0bd15fe4,0x7ffd0bd15ff0
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1744,i,8579526159731268887,10148897439337822692,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=1744,i,8579526159731268887,10148897439337822692,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=1744,i,8579526159731268887,10148897439337822692,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --run-all-compositor-stages-before-draw --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3392 --field-trial-handle=1744,i,8579526159731268887,10148897439337822692,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4424 --field-trial-handle=1744,i,8579526159731268887,10148897439337822692,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1744,i,8579526159731268887,10148897439337822692,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4548 --field-trial-handle=1744,i,8579526159731268887,10148897439337822692,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4704 --field-trial-handle=1744,i,8579526159731268887,10148897439337822692,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:7bb60b70ec89e18e77afde1fd49f2ece9980c614
    3⤵
    PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0d10be88-531b-4dcb-aac0-9ade3ab06891.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\0d10be88-531b-4dcb-aac0-9ade3ab06891.tmp
Size 3KB
SHA256 f6bb62fdd00de2d1c7d796ca0f40f5455362dac43c9eaf6f44d0dedd346eaf8f
MD5 c199a1ff1fdeb5513eb6a461ba471c78
SHA1 8b3d36bd0f0e8e09e032fec10e7d754683493ff7
SHA512 5b1efb0fcd30d337494db413e6a25e3ee0e922fa0e64b9b4dd368d8139de53c11d21a8f1da83566670d1eb715d51152eaa72c8702f973aa7a29f4f6348244c6f
TLSH
T16B61B4366974AA774DF39B4578933B02ABB95223E5813F99C6EC0F0C01DB2980342C6B
MD5 SHA1 SHA512 TLSH

Submit Download

68bc4cc7-c0e0-4cc3-af06-bc760e8c7417.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\68bc4cc7-c0e0-4cc3-af06-bc760e8c7417.tmp
Size 15KB
SHA256 556066c92d8dc75f1e4ae54e117d6b9fc9d1549824d276304ab5bfa2e2520c5a
MD5 0798900a245de2e4fafd642229cce6b5
SHA1 598a896009ee92f6354a1681321ae4f9dc565259
SHA512 836172c753e8508e56bfa70946521eb5069f767e062d282e857387c97a6a67ea2b7293572956cbe20f2cb0e074859606ed264ff3286f4febeab1a5f31a78e991
SSDEEP 384:j+aQikB+z/xvxjg/qhEwNBSpWSVU4ZBU9zF:C/UxvxjgC+DbZyFF
TLSH
T140729E3B68783E2395F7F6097D5A174BCEB994B294C26AB84AED5F0C06C72980343D47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 647a47a6855f200a05da22f4dce9f0897bd12c2c5b9044d75903cb08e1b3adba
MD5 3df7179a39c011a3dcef4e0aa46f52f2
SHA1 bdce8fbcfc57338f3dab460c8bfc78d260770a3c
SHA512 ce963d39b0c6fa2e9173b884dca3bc46a967389af9612945668a51f8bbd0741b06c388bc680c6ae99d3f70311d3b06e61faff28ae6005d3e6000dc2940ba40f6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 47d979801454c00f310c8d9f2ef3366932627c09e3b2144b0a3814a1bf5f3e2c
MD5 690c43bee332b38e799a0cf8ca21e089
SHA1 3a0095148abb3185d8ff7fab9460e61b19c74298
SHA512 6e214d00b58c9f05886331305b0baa3b7c7ceb0ec2e1533b22894e80aa5941c5af811b03e0c94e41ef0bf2d126b30ebd0e20bf5ab6f8e6742cf1361b04fd1b9d
TLSH
T186D0112B33A20AB8C02020B38082A2880A00E22F800A8008E828CA2E3B080A00A22882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

09af822f-3f37-45a0-a657-bc3a2901a716.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\09af822f-3f37-45a0-a657-bc3a2901a716.tmp
Size 6KB
SHA256 a14afdd68f393be2bf03b3efd7bef6cf14424212bf7513f30a80f77da43b9e4e
MD5 2552094d524eb58cd0955323645cf28d
SHA1 bd15f92802d492fcf035e95fd04075a6510ea231
SHA512 c91cc9f4da62d9ad5a97155055b471099abefae3e2b0ef70708323068984dbbe02e5dd1eb426f012a8164bcb548e3c59d1329a8172d1bce75604818b681c29a5
SSDEEP 96:stfW/dJxbLcb9Ak6o5h16ZZd1s7/x+6MhmuecGqpj1eje8K+gsG28XM1C7K:stfOVxjo0d1sV+FKqpjQjEDG6K
TLSH
T1CED1B7415E2878BB4CCAF54ABA3ABA12E2F9603274D51D5CE7F8462C04DA6DC630784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 288B
SHA256 307f87c9b07b1bc55d9bde050fe433f2584ef5c959026b5cfe54266343d431aa
MD5 3a46aaef0adc90305a66002edb8a8929
SHA1 9fbc337e015ecf8a1e319753db1d3846c4c092eb
SHA512 ba224aa4d3c0691e34eb4fc6ac597f75d0fc828fe86aa06d1c70aa5afd51a70155ce4a04f2465051ffe955ecea32a9bb006a8073fb250eeca4dbe097dfeb5337
TLSH
T18AD06CD845AE168DEB878CFD62C20C493375AB5430461F1B04A14DE6BC73EDA03E2755
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c85749f237c664461c3672e784ab88587700a302745f6b0d54d5de72717cdc3e
MD5 96d4bf009f251a9e4ad40aa282a4b31d
SHA1 2ca11e9f3016f7eeae59a3a243df5ec7baf3107e
SHA512 17b1dac2ed432a42773a5d04d36c1349cbfea8df47a8d4ef8bfc7a809e1d2c9d44d2d84e9d818c1e8ee63d76e04af67263678275f891294a567d606b3a6acb27
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cb0fe5bd-8033-44f5-80a4-f46f44f54e8a.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\cb0fe5bd-8033-44f5-80a4-f46f44f54e8a.tmp
Size 1KB
SHA256 d37f064c6632fd698d8493f4c48fbb9db84d56e34735061a6fb032e93d0b7fdb
MD5 c2db8a948bddf138bc6815281e0d86b4
SHA1 9e6303994c1acb27b683abee486bd5e66679d789
SHA512 7384644b0e1e105648541fec8c3b179d17471381cb2f0a882112190cf580a87de1d37119a2d191489be250fbc6241c5bd04292edda72cd3a7b20069a17caa853
TLSH
T1E2317AF2D6D48A6C899112F86B603A17EE1E080553282E1DC9DDEF9FEBF0474F211A09
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a11996f3-4ca2-48ff-a725-d745e73bd249.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\a11996f3-4ca2-48ff-a725-d745e73bd249.tmp
Size 6KB
SHA256 6608a851c9762c62098847bcbb33b3ad9a117a211f0c7ed751683cf1d7754766
MD5 dc5b8f01793ad0829bcf24094f47217b
SHA1 45a7c0d3a14be1c35490aeb8281de1b8541f8994
SHA512 6edc165ec2ad8c4e0173b36dbd05b3d9518e85b0ba05e82c451aa0bb0ec9a35520e6a9c9311003529d47f9b439594a858c5da496d0b6a3bb45c722b4f047b51c
SSDEEP 96:stfW/dJxbaGcb9Ak6o5h16ZZd1s7/x+6MhmuecGqpj1eje8K+gsu28XM1C7K:stfOVbjo0d1sV+FKqpjQjEbG6K
TLSH
T130D1B7425E68787B4CCAE559BA2ABA12E2F9603264D41E5CE7F8461C04D66DC630784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 1KB
SHA256 93de8c7819dba73f31a2e2e564ecbf42614179d8970eb89b481439abbc2dfd87
MD5 f98c5608f97e79667837f42a4eb89b1a
SHA1 0a4e26bb879fa9d64f8b4d15e6eaef9c444665d2
SHA512 b3decc1ad36cd4f8b8117504d015a803e2eb750621e12e36f3bffc711983c10fd0be864804ab5afc281504c17db1a883b71f5d23782cc08015615ea76aa93877
TLSH
T1C92142B2A4746F7398D3578A21737E574D35236782114F4862DD4B0C42EA15DC62B87A
MD5 SHA1 SHA512 TLSH

Submit Download

a03257b0-9b4d-4b35-898d-06f2d96e7ad1.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-02_7191c562871597ad9adad5ea39f6d627_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\a03257b0-9b4d-4b35-898d-06f2d96e7ad1.tmp
Size 2KB
SHA256 3413a5d57574e48d75b1dc9c3146ceda14d846fb683614f206bb3a7d4c38fa38
MD5 7b00cdd284dc0277aebd83205c88f0e8
SHA1 932e9d1d74c020f596b7f34a2a18c15ccffc8b52
SHA512 7f07e1c5dfbcd692fbf964e0bef55c0c8b5072c31f6dd89c7e84c4691d0c75fa01a6b8cc8523eb8729a3f41811fd8f0d12e04e4f022f71bad626195298058bb0
TLSH
T1F35195737824AB7785E34B8979573F13CE3D5362AA521F5596DC0B0C41DA55C1302CBB
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1066072446\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_1282462868\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3532_869136172\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2756-235-0x000001F7D6000000-0x000001F7D60A7000-memory.dmp

Download

memory/2756-132-0x00007FFD2DB10000-0x00007FFD2DB11000-memory.dmp

Download

memory/4572-299-0x00007FFD2CFC0000-0x00007FFD2CFC1000-memory.dmp

Download

memory/4572-298-0x00007FFD2E540000-0x00007FFD2E541000-memory.dmp

Download

memory/4900-10-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-9-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-6-0x0000019DE90B0000-0x0000019DE90D2000-memory.dmp

Download

memory/4900-15-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-16-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-14-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-7-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-12-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-11-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-3-0x00007FFD0BA5F000-0x00007FFD0BA60000-memory.dmp

Download

memory/4900-18-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-13-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-19-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4900-8-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4972-47-0x00007FFD2DB10000-0x00007FFD2DB11000-memory.dmp

Download

memory/4972-234-0x00000146B6DA0000-0x00000146B6E47000-memory.dmp

Download

memory/5052-451-0x000001FC1FA70000-0x000001FC1FA71000-memory.dmp

Download

memory/5052-449-0x000001FC1FA70000-0x000001FC1FA71000-memory.dmp

Download

memory/5052-460-0x000001FC1FA70000-0x000001FC1FA71000-memory.dmp

Download

memory/5052-459-0x000001FC1FA70000-0x000001FC1FA71000-memory.dmp

Download

memory/5052-458-0x000001FC1FA70000-0x000001FC1FA71000-memory.dmp

Download

memory/5052-457-0x000001FC1FA70000-0x000001FC1FA71000-memory.dmp

Download

memory/5052-456-0x000001FC1FA70000-0x000001FC1FA71000-memory.dmp

Download

memory/5052-455-0x000001FC1FA70000-0x000001FC1FA71000-memory.dmp

Download