3bbdfcff44817d1298097bcc8a8b20f09036d43cacce5b50e49a5e10b809027a

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 2.3MB
Sample261027-e1q3yabt6k
SHA256 3bbdfcff44817d1298097bcc8a8b20f09036d43cacce5b50e49a5e10b809027a
MD5 e3583c2361b3825d7b282b2e14e8adf4
SHA1 d15671bd93a326b533e18963d713ebc409ff99d0
SHA512 aaccf6b463800fde3711414b2467f4bb4ba7f10cc6405434c60a840d0b6adc2de1dd8acbcd001ad9048bd70a20a42ea698fab1901aa2550c7ba1b23c8e577a27
SSDEEP 49152:Xy5H6Rtx+4ECK8KGKQR4QzXJFpf/Vp71EJvgo6WGY6l:PNKGKC/p/Vp71EJvgo
TLSH
T160B59E0B67D800F8D27EC178CA4AD483E6727825C364D6EF17D49A690F236E75EBA701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
41	5048	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Executes dropped EXE 1 IoCs

pid	Process
3852	laddon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_669595502\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_669595502\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4544_669595502\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	laddon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	laddon.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5216	powershell.exe
5216	powershell.exe
5048	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5048	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5048	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5048	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
1312	powershell.exe
1312	powershell.exe
1312	powershell.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe
3852	laddon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4544	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3852	laddon.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 5216	5048	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	85
PID 5048 wrote to memory of 4544	5048	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	87
PID 4544 wrote to memory of 3224	4544	msedgewebview2.exe	88
PID 4544 wrote to memory of 2172	4544	msedgewebview2.exe	89
PID 4544 wrote to memory of 2172	4544	msedgewebview2.exe	89
PID 4544 wrote to memory of 2172	4544	msedgewebview2.exe	89
PID 4544 wrote to memory of 4640	4544	msedgewebview2.exe	90
PID 4544 wrote to memory of 1480	4544	msedgewebview2.exe	91
PID 4544 wrote to memory of 1480	4544	msedgewebview2.exe	91
PID 4544 wrote to memory of 5572	4544	msedgewebview2.exe	92
PID 4544 wrote to memory of 5572	4544	msedgewebview2.exe	92
PID 4544 wrote to memory of 5572	4544	msedgewebview2.exe	92
PID 5048 wrote to memory of 3852	5048	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 3852 wrote to memory of 1312	3852	laddon.exe	108
PID 4544 wrote to memory of 5220	4544	msedgewebview2.exe	116
PID 4544 wrote to memory of 4816	4544	msedgewebview2.exe	117
PID 4544 wrote to memory of 4816	4544	msedgewebview2.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /C Get-Service -Name WpnUserService* | Restart-Service -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5216
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --allow-running-insecure-content --disable-features=msSmartScreenProtection --disable-gpu-vsync --disable-web-security --dns-over-https-servers=https://cloudflare-dns.com/dns-query;https://dns.google/dns-query;https://dns.quad9.net/dns-query --enable-features=UseSkiaRenderer,UseDnsOverHttps --enable-gpu-rasterization --enable-smooth-scrolling --enable-threaded-animation --enable-zero-copy --ignore-certificate-errors --ignore-gpu-blacklist --run-all-compositor-stages-before-draw --user-agent=LoaderVnm --mojo-named-platform-channel-pipe=5048.1592.6145174002669060368
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffeafb3b078,0x7ffeafb3b084,0x7ffeafb3b090
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,5063616957196138883,12429931903690390251,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,5063616957196138883,12429931903690390251,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2360,i,5063616957196138883,12429931903690390251,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --run-all-compositor-stages-before-draw --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3540,i,5063616957196138883,12429931903690390251,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2084,i,5063616957196138883,12429931903690390251,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:8
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --string-annotations --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3836,i,5063616957196138883,12429931903690390251,262144 --enable-features=UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
    3⤵
    PID:4816
- C:\laddon.exe
  "C:\laddon.exe" 5048 686427f3384b44e6c51feb5d03303c51aea72df04ac560058a2180b2262da7890509cbbade79386823cef256e0553e61aff1d270aba9404e54a2a052be1d4ff48c2f943c5557b5eaaa03ac3ae61c8dbf
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAAkAGMAcAB1ACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAgAHwAIABTAGUAbABlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAgAC0ARQB4AHAAYQBuAGQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYwBwAHUAIAAtAGwAaQBrAGUAIAAnACoASQBuAHQAZQBsACoAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAcwBrAEMAcgB5AHAAdAAoACIASQBuAHQAZQBsACIAKQAuAGMAXwBzAHQAcgAoACkACgAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIABzAGsAQwByAHkAcAB0ACgAIgBPAHQAaABlAHIAIgApAC4AYwBfAHMAdAByACgAKQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4544_669595502\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

loader.log

Path C:\ProgramData\Intel\Logs\loader.log
Size 328B
SHA256 0996fdb13dd810e08c35267f15eeb968777b9f5cfe6353dabfe0601a0db3a410
MD5 1682edb64f9ef3859be686a5557bbf6a
SHA1 cc81e89786adf5a856d5a5f18e4378dcb736b7c0
SHA512 dac587599449fcfd71bc1fa96a39e03041a77ff22a837bf5f71aeef561bd79dd33d814391cded12d6f300680b169c7967930fde5de8370edc6bec25f93186397
TLSH
T1E1E0865B0585F04DFF2E2CCF69917EE86334CC058AF1EDAE00972936CBD11668C57291
MD5 SHA1 SHA512 TLSH

Submit Download

loader.log

Path C:\ProgramData\Intel\Logs\loader.log
Size 1KB
SHA256 1449c0f435c3f010cd946a43e7767b4da26bccf8a75ae52fed45f4089fa01da7
MD5 8f8c459282352fb5fd5246f831bc82f6
SHA1 e409a880855bc9b628b94e822f1e670844b2cc87
SHA512 7a18a12a7f8fd26bb37714325e2669dc7bee8d0523d7b77cf98a08d55d59e1ecbbc028850e519a2783fe1c8a8ee2022ceeee855fd5275c53b421a4dd59e7169d
TLSH
T17C3100E78581F02DFF429C4FB4E1B5C45778A69B85F09C2F1507DE729FA05E484A8223
MD5 SHA1 SHA512 TLSH

Submit Download

17.0-laddon-temp.exe

Path C:\ProgramData\Intel\ldc\17.0-laddon-temp.exe
Size 6.8MB
SHA256 03a19e3d6e1d30056e4346bed7283dbbfddf3dcd915c319b331e401b90318506
MD5 23ac03b4cd73aa4b69b039db77a08653
SHA1 40cbb944e47d7e357ecf36a81f458e62f02742c4
SHA512 68dc8f81e734ea6e1aee070d430afb563aaf75fd729e121003f564a99fe959aa0941fee16c9e632d12f062d58bfd2d7cae700b109b0081ec84c1c7747cbfa9b6
SSDEEP 98304:O37IZaepHydMGKfALLgJhkybVGUtZOr3t2ibvMEdy3DeJiBSB9KMb+A5k/6uXfGK:O3k8ZL6my5GULObxvMEmeJi4T2vM5lD
TLSH
T14A6601CABB5144E4E443EB71A43624DB90DF8FDB6C40829757003AADB9BCBED0BB6544
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_0509cbbade79386823cef256e0553e61

Path C:\ProgramData\boost_interprocess\17000000\cfbi_0509cbbade79386823cef256e0553e61
Size 25.0MB
SHA256 fe4c5120bb8b709c75aae59d3b07e5a44de570270eca980cadd05d8faadae452
MD5 9188a3b2aac9c96916ab459d63494727
SHA1 2fac463d31e7932c7a873b1a596ff2de03b9fc6a
SHA512 8f6e4de6613999dcc188c79bb539ea912b9e64fd2316849c9392062beed2fddb761c000ab66f26a6566df787eb4ad74ea74a1699e3698f0ee4372ee579aecd4a
SSDEEP 12:sEkSkXn0E0XlnSP63y6HSFlWLDRE4jVeQdvBzqnVzo8Aj4ONaNdH:kEnXPLDREIVPjqnVs844OG
TLSH
T16847AC73D50E228FE085027844DE37B237BF3606AAD58743C2963B18FE2558AAF55442
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_8c2f943c5557b5eaaa03ac3ae61c8dbf

Path C:\ProgramData\boost_interprocess\17000000\cfbi_8c2f943c5557b5eaaa03ac3ae61c8dbf
Size 25.0MB
SHA256 7a7bb6df6f6825284d49fb8cc7e5e7181da38188e1c453dcb7b6605de2c664a9
MD5 43076fb4ca9593e14fbc74d714acf0e8
SHA1 dedfdaf70547825cbfbadb8704752a69ffd35d72
SHA512 02222b57259d5ba4bda12acca49876019dd9a091f137f5e80e67faff2d8f55b5deccdcd97f0fe2f5e75b8a78038d40bad5847a358abdde5668ed271740da8d80
SSDEEP 6:akXn0E0XPl/nia+l/P66+l/3Ses620Sskl:akXn0E0XlnSP63y6HSFl
TLSH
T1D647C2B3880B228FD098037844DE1BB1777B0918A6508B03C3A60A24DE65686AF59C01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_8c2f943c5557b5eaaa03ac3ae61c8dbf

Path C:\ProgramData\boost_interprocess\17000000\cfbi_8c2f943c5557b5eaaa03ac3ae61c8dbf
Size 25.0MB
SHA256 a9c34974391c3d0ec9586068bc7b6e5bff00d98fccccadfaf713c45fb371d6ca
MD5 aebe4f786fab715c21494c5c64d5f627
SHA1 3545a1adb070fa55b344f634638254ea60585994
SHA512 59c2300b5045d8253399ca7fa7f41ae7dfb88334145c67bb3c58678cedadf5bf4ea680cab7838c980823abcceb8af39a95abe25d0f280d2eb514f21a1beb9f41
SSDEEP 12:akXn0E0XlnSP63y6HSFlWLDI9ArHEdXEtyr:dEnXPLDI9Arkuo
TLSH
T1EF475973880A128BE054437986DE37B27B7A3524EFD1C747C6960920CD652895F1BD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_aea72df04ac560058a2180b2262da789

Path C:\ProgramData\boost_interprocess\17000000\cfbi_aea72df04ac560058a2180b2262da789
Size 25.0MB
SHA256 34d284deec91acacd308f5ae33f8ba2aa08640621dea6e2185e83de4b2cbd197
MD5 8c625e46e05b797a69770ad334e3ddda
SHA1 288408117aff81ea352203ee36e90901c550e01c
SHA512 9019861f0d90272fa31531d685e64e94b5d64aec0ebb20901a8929b4f7be4a4793a018666e6246c83c3b4a26e05d5d8a1781421b98fba208ca82ce43e94247b1
SSDEEP 12:8km8SkXn0E0XlnSP63y6HSFlWLDn84SuOKtloMImFBt:TEnXPLDn84S2l6m
TLSH
T1454702379A0E328FD458177C089F37B13B37B800D7D08B8382534A10DD247655F4AC52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_aff1d270aba9404e54a2a052be1d4ff4

Path C:\ProgramData\boost_interprocess\17000000\cfbi_aff1d270aba9404e54a2a052be1d4ff4
Size 25.0MB
SHA256 7338519e32dcda8f5172a61a1cd872cd7fb8579b9aae042b0ed3dd8353341909
MD5 511376f6f641e40d4091afb5046ab76e
SHA1 99d5f8eae0a80586728fa1834df33066daf20e97
SHA512 6ffa5000a10533eeda415fbce4f83934f80bae806f1f47b74635c132f2c8c2b2b4b7e8061059cc814587b57e59ca90e1b3919ccfa4b29db3510e6f6f9ac71887
SSDEEP 12:akXn0E0XlnSP63y6HSFlWLDvcm1rWHxxM:dEnXPLDkm1C
TLSH
T12E47C0B6844E52DBD4682234989E3FB1773A3D45B6D08743C2660A10FEA52865F0ED01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 73123d6e562b26b1fd2cf4fece67930d95fc4738bad8d1f386345a5311274739
MD5 92f89789864052cac0862ed6b4f1e706
SHA1 aa6594951427e103fa025c8ebef3ec5a5f85866c
SHA512 71a0261ee6ffcd2e9bb336dde7110f80ac6fa01df5433e77cc170649b7936653d89229255fbeac15692e8736c9f3e5d15d62b2372865fe3d7ab933c511c2894e
TLSH
T1D0610D313375F1E888167F071E28198053BF4355EA94AF5CB298621EEA2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a590b67d7330f0013ca3a97e256a09c3773cfe89375c0f7e92c34c9721a0a092
MD5 df0ab8323484a5b8b6424cb1bc8dc77b
SHA1 48b44801ed1c1524d487146c31af4a9f7251484c
SHA512 cf6c11751e0d8a187a675cbf0373096c83428feff757452b20261d498df3c1f88b15a04e6f9d801d7f42dfcb88ae6a1e1b674a4313865d81ed4f8cc1ffaa283c
TLSH
T118217827F3CC8A21CC95163A509D9C1176B282C7859FDF9FAFC0E201A5BF599CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_plng41tt.jkf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_plng41tt.jkf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

363531303031303931305253434647.ini

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\363531303031303931305253434647.ini
Size 81B
SHA256 5b0962d0eeb8de6e30f11f3859f99375972e7fa31e6ec97ac7cece6dba034a4f
MD5 3c0fba4c005cc76afad9aa8a0937bd61
SHA1 b7449380a2f3b85b838ac042f56ce3f84065811c
SHA512 1bbd451e0f6cc7ae6ead018ea5a2dbca2c338d17585906d9cb95ed34d1bd3b1b44991c1dee53f84718945a65aade8ff56311aaa57228aa4fa46e64ece038feab
TLSH
T112A002BD0612E4285C0DFC2B628269C9CFC791C161391D9FD6343E73B1AA2D0B50E40F
MD5 SHA1 SHA512 TLSH

Submit Download

08f2c6d1-a40f-43f3-8c23-df8a5bec6ce0.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\08f2c6d1-a40f-43f3-8c23-df8a5bec6ce0.tmp
Size 3KB
SHA256 753a09070e6ad7e435f9009416ace57f032f215044c564e6a2898ea7d5e98d20
MD5 f5497362779ddccfc91b6dfcfd66b716
SHA1 1ac5188e5f5bdcdac1b168de7b6bd66b93d01c07
SHA512 0ab816914e65e378bb9e430ccfd262d085f38965a79b44faa25e7890acab06710a8d248348b28b78a596e8f426ae2835566330f8c694accb0e8a9b09a0d40f38
TLSH
T10E719532ACA8FA370DE29A45B9852B17B7615123E5D53F98C6ED0F1C01DB2982303C1B
MD5 SHA1 SHA512 TLSH

Submit Download

1253b2c6-24ca-43fd-bb7e-c92956b94d18.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\1253b2c6-24ca-43fd-bb7e-c92956b94d18.tmp
Size 16KB
SHA256 3ff341cdca8d1fa6b7c0a5276dd4881f4ffd7d5bd0d5916fe9316b9c8a43c3a8
MD5 dd2b223f67c03dcf8b5a946fc909fa16
SHA1 9e30591926f71d4c5b8b28726b3d775417cf6ffe
SHA512 bb0ae49a5eb76d966623ef6d7b11deed21df93188526cd312659b8890adc3841972c273ae3ebbbc99b0bbf64b07a3a0114d3be4f7865d53cf74dfcb8954e6fbd
SSDEEP 384:z2+OBqImmJvGBLx3NaFMJFNNbBiuCQHSQg6rP:3cvGtlNrdHVD
TLSH
T10272AE6A1CB56A232CEA8549BACD2B47D771A293C1D1BFE4CDED9F0E116F0842353D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1489cf1f-49ed-48d9-ba4b-a0b1c618c286.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\1489cf1f-49ed-48d9-ba4b-a0b1c618c286.tmp
Size 2KB
SHA256 0a2df05a6afab9cbe965e9273ca0d9013d4ef75cf08b1bfd62676a96e1e5c690
MD5 fb5727af3680205f9c8882a575ed3703
SHA1 d790ce188be668b42f2e0e2d5974db05e0254eb5
SHA512 0e4599ac3f107b47697436a0668043185197cff846d5843459fe35f45c54869b3bfce85434907d89804c249a52ad640a2a8ed522b216b8e41fa2663cfdda94cd
TLSH
T1B951A773AC58FB7745D29A44BD4A3F13EA359261D6922F5496ED4B1C00DB59C2303C2B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eff052083a22544dfca53df36c95fb0878f98fc05b588f87dfdcd5f8f8f616e9
MD5 54329c9610bb0e0e071a1abd55fcfa1d
SHA1 c3a12f5f0994e1228df663cc1a87ab571c454bd9
SHA512 54c2227281a3436e84a63e9b6c37377e7b22be3b01c969a91b2a3a019ba563f1eb6269e731aa9040d0a8bf246bd404794d917d43c5fba35f64cbd081cff30c50
TLSH
T14AD0041051005441C04551710457C101415054005C4501044170001D1DC11040405555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 22c6c1f604ff766ea1bf48fc448ad65679a2e1339bc47d01eb9fe005b4a83c3f
MD5 519277fbee7a4b6573fea3aba32f7a8e
SHA1 4331dc8cb7fdbaab815de0e0cd400db94bd29273
SHA512 98683df7945a18a5158055b17be4db7690c922c6a36f2323f663d5122b6df467c26ef4f86858fe1019920de9f7cd433a2e20e267b76e496f04c5a76936500777
TLSH
T112D0241333014574C01031730443F10D0440D10FC44D4004D43CC53F3F440540D07CD3
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

6b5260f3-937c-4b52-867a-d106891c2a0a.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\6b5260f3-937c-4b52-867a-d106891c2a0a.tmp
Size 6KB
SHA256 4c277e543fbcd15e987a1539e2e244e8cadf620cc7ea83404220e91f14ed3c35
MD5 546eaa2f6c73dc3398e63593f4393ba5
SHA1 2432d2e0b6738a50c8845493d14c462ebb273772
SHA512 3bc213d45da3471c94278cfc6ed574c1f498f29d84ea2217cee71f2becbe9dd219057a79c8e723da3cb453e6e3c6d791643bbdbca506207acb4e1f7caca99a28
SSDEEP 96:st+05/xZ0Db9uff4Z8i0vhERk+um/7qx+WVHMSm+uecG/Y1idQjs+gCiMOB:st+03bfQZ8pal7/S+WiE/YwdNgiMC
TLSH
T12BD1B8025E38B9774CCBF2197A35BB42E2F6512265C10E98EBFDC61C09E66DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 288B
SHA256 74d22c05c79c162485307bb746ec095716eb0ee33bf25fda1aad6a7b07280e98
MD5 ea6d78dbfcc09a77d310a7029c848b68
SHA1 a72f7cca152430822f45d8bd3286ca31e40fb763
SHA512 5b663367d87db37ffaf118f6d017ed2f366efb7d9935c263f3a06b0b79c4a42abd1f56c0812bd0071d89b8b1e84736ce47320fb75a58815e54a661484b43b91f
TLSH
T1A1D0C910D7D67FC2EF485AB026928CF82272A814308B377719B59075E7336D601A3857
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ee900783192719bab6deb52d3a67fc39e690b66df375d6c5b641eff2e07c6cee
MD5 30691f37689be4845dbbadfbf081be56
SHA1 1554cbaf0d93cee9ebc24fa10f06ed0db0223e58
SHA512 36b4d6e17e89a00044a055daf71a4bde4fd14b9fd464da7ac96a628c376cfcdcdd156fae99f4bd9abc6274a3b763534f62348858a57549f11dab94fd897cb405
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 a0fb8f327430cea77b402e79a61eb9c355cad1d86c5e988672eb26d96fe80493
MD5 78b5e19ecc005da35fcb3fc94cd61294
SHA1 787d220bdbd7cc69d8248ad70026ae2b537fbc09
SHA512 239c5b02cc4fbacf7db4118b31dacc5c1a632827013a9aa2cdce28d473e0598aef584fb48eae36a2b372022b9f7907c3f830e98b0091fdf211915cd0132d6a42
SSDEEP 3:LstlNllkll/lfxKll:LsX3lEtfxKll
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

7af6f0d6-f6bc-418a-ba86-7f311fcaab86.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\7af6f0d6-f6bc-418a-ba86-7f311fcaab86.tmp
Size 1KB
SHA256 83f79f4371eb4f386474f5a85967c767907ad48dbf8bb052bfda66fbe405b0b6
MD5 92b08c7a34ed4fe22ec677d5708ceaec
SHA1 d958e1a728d755814b2893f541ae965c7e5e756d
SHA512 04ae4c96043b653ce571a23412d9e48ae9e760edabfc8f5a6b680bb3171c13322425461cf6b4d9112647f309e89183173c0d0e03990325ce6da9d65c5e67c865
TLSH
T139317AF2C5D48A6C889251F86B602A27EE2D040543282D19D9EDFF9FEBF1534E211A0D
MD5 SHA1 SHA512 TLSH

Submit Download

8ff3605e-957d-4b03-bcd3-33dfcbbe601e.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\8ff3605e-957d-4b03-bcd3-33dfcbbe601e.tmp
Size 356B
SHA256 33fd224b7cde0f0f4d7755869d02d33b9cb087c15f2ae696bb122d77527ac81e
MD5 6023c5b2557d472868dfd39c8768049d
SHA1 c8abb0d5bd921a141c0d27bb22694463b8bb687a
SHA512 c56244995c7305baf441cd93a8c4f335a47d7ec086fdeb9390a0fada735e8770572b747eae51a7b212238064db7b932578d8befcb9d3014c1a84797f3190697c
TLSH
T1B7E020E1C07E647B203C49AA1E49BD457E36F134128160ECD657972DA0E14B61F03422
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 c2b7703b9b6d7cd81487197f10f5ff2b1b12f678b25f77128b9a69fcd6c61456
MD5 d402fb358ce6ef377fb2991fe31eaefa
SHA1 f375b61aff5de48c0a5945fb6b973e649acc8ce1
SHA512 b133331aba8ef3af9eeb28ac5bde1bd61b5d89cc090059742ff11ec47031399001b2e30cb0212f83368baebfa52b38736508ade63e893dbea21e27ba9d430ef4
TLSH
T15CE020E1C0BF6D77303C49BA1E597D547E36F035128150E8D55B972D70E54B71E43862
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 9266e5a8632ae0fb0ed6f91da1e9f4b07b47822c769bc75b828a024293c23db6
MD5 bec8ca77c522b22d6d11c1c14d160e12
SHA1 9864b1cf4a83ae8bde7d7050c5f347d16242b6bf
SHA512 8fb4b3bc73abc44b6cc17562f9149740d4caa5943cac95a79595ff6ab951c3373d439ed58b05daca3355e4041aff041b42abfedebeeaa5dd189a2b1afd81fa4e
SSDEEP 96:st+05/xZ0Db9cff4Z8i0vhERk+um/7qx+WVHMSm+uecG/Y1idQjs+gIiMEB:st+03tfQZ8pal7/S+WiE/YwdNGiM8
TLSH
T1B3D1A7025E38B9774CCBE2197A35BB42E2FA516265D10D98EBFDC51C08E66DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 1KB
SHA256 d7f67e081783093d4708ad5c8941a46d91eac3dbcb88505ad5408d86f59ab2e6
MD5 fe5371f2f30625f27d2dfa95fd65b539
SHA1 20f479090d2d7b60da7923083433f49c68286fea
SHA512 3dd697f47dccdf6e26cbbf84a9d506093d621208fb9faab511a4176b722103a60c65aa0f3b07597dcea5aab5317b421963f4eedf18872b573d46b243489e1599
TLSH
T143219272DCDCBA7238C44842B6027B476E208226D2519F0C92EE432D21DB8CCA727C7B
MD5 SHA1 SHA512 TLSH

Submit Download

c8b4889a-a562-4454-9106-f59638374eab.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\c8b4889a-a562-4454-9106-f59638374eab.tmp
Size 1KB
SHA256 ea304ab29cd5bf971cf05fdfcae8cb127d9a68c4d8b94250fb67075ff3c9f4b9
MD5 136c1a83c10647359a3c4bfe6f8f8cd1
SHA1 a549e16549b8fe96531b6f4ac1e0f755be4503eb
SHA512 3221ffe307fe67510ce01b4cd3b966170f3eb03d853cfb1ff238c1c85c1328cb4423a24192f9ff3b0375451b373cd0d5ad2c5c51d02b33ca4aada204ed471426
TLSH
T1C131B772ECD87B7228C15542B6013A07AF314126D2519F0852EE8B2C11D75CCA627C3B
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 1KB
SHA256 5454498c760cf7e49db878cef317f68aa0c941608cfa73d829f27bfd3501ccab
MD5 8cb29180a1d459a2127056bdea8d0587
SHA1 4ac8f39a8f5698f6380b64effa12398d85ea13ed
SHA512 9f4b66f98b0bb66b80193911fd131eea828d99f6028807be506ca1380c13a34138c38458d5e8b4071f271a48429c9288be57c2459765790a07833fca125e5c28
TLSH
T1332122DBA36E37DF71043B7D2E14B2439AA8D07022DB53C1A6C602691836D3A6AF3119
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 1KB
SHA256 aabd8166f74a5845279c6b6e430370cc1bee20499696b16761331041a2faec8e
MD5 d334a61b4335b2bca0e5e5a7127aad24
SHA1 6ea6fc6ce63a61e14905967c0802e196b1e529e7
SHA512 d7630db830cd4b58c7d4053f775c9631cdc61539ec74df49421e354791dbbe3d20b6adcd6bc8b9d320d11c87160822d441a257c2b624e1ef78f3ad72b356539d
TLSH
T12F41239BA39E37DFB1103F6D1D20B6436698907022D797D1B6D601691836A3A6AF3109
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 3KB
SHA256 ed7289c01b4c11197fddaa9b0594471e7b87db0c3004ed914c428029f370c06e
MD5 e12693f0f73e4a926e56b521fee2758c
SHA1 8b983d4232c5472e44ffb21fba6a9c576a2521f8
SHA512 98594ec4e0263ffe9198b689e432f1bfa12ce21b974c40b7a6f44db93053fa29f9df834478c1eeb3f57c59686bf6430227758e622cac4dd4326a45b45aec8144
TLSH
T13B711E9BE2AF33DFB5103AAD1E60B64316A8D060A6E7D3C0F5CA0259143697E75F3049
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 385B
SHA256 89e5d97a54822022e5df15e31abc356a60f699c78034c86270684654c837f7a1
MD5 57185eec1ee3735feb0749528b0c190c
SHA1 ce55a06827ef6f416add57d77a738cf7a6d5c24c
SHA512 92e61518d418dc729be09e32652a69c06709b028a43324f84f6de4b3b2fecd0b32dc0799a9b8aca83861cca2f780d042b66d60226ba3200297dda97c7cc97c77
TLSH
T1C9E0615BA59717FFF9143FF95930F54366C45051713246D1B9C507155C2393E61B340E
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 733B
SHA256 a74b22f5f4896eaef89b6c5830edec46f1ada57ced758c0bc8a153be53d667d6
MD5 ca6eb3de797a39173801d20d459c4fe3
SHA1 c65ebc4a96323a8e840b81156f23276ca1161df6
SHA512 00a41b5da9477ef869d2d941519f13c2b2c40eddbc2c6766468ee947db2c65474421031e75a52639b9b5c86f2ceb563823011bb148ce1e415c246f47e84d116d
TLSH
T14201D04BA79B23EFB6243FAA1D21F64396D451A1757702D266C602115C2293FA5F340D
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 1KB
SHA256 4cb872fc40d616a9b2aaff2c72d6786ff504d40cb3aa03194cb15da05621f74e
MD5 b1c59dae8d2a10f824f139a1e6297083
SHA1 8e52f40f003d9cc6d60893246fbe9e46dfd9e4df
SHA512 d4517123f07722629a2735d8159aa2bbf1f07dc1ecdc581e825ac7c91d8c3a4b82cd2e9e9dc7844ed5af3884991dfc30ab009e3b8ba879255c2a63915c78bc22
TLSH
T1B53153DBA3AE37DFB1043B7D2E24B24396A8907022DB53D1B6C702591436D3A79F3109
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 1KB
SHA256 12e35650052e5e669756901336a03a42481df0e5b280c63c0aa5e48a62dfad7b
MD5 17acd14c84e97e69d1dd7a81e8da9e79
SHA1 76f6f688eec7b717f69603b6f1e1a643696ae1ee
SHA512 72a0ce9a339a66bcf56d5041cace69259e9ec68e42339d0f5ed63bd0e131e205a8aa3888ab2f88fbd4e5f6b2f965231e6627abcd3aeccf369d4472cc8738ef3a
TLSH
T11631119BA39E37DFB1143B7D2D24B64396D8907032DB57D1B6C602691832A3A79F3109
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 2KB
SHA256 fe85a8831968c58ffef8a46cfd823f392ed8db4d0d953587f926f088c625853f
MD5 830581101590b0c81329d31a13fa5c04
SHA1 76f8403a80f6a71871b83db46b937d7cd525a545
SHA512 9edfe013572d8bd07afd8e674630f4828c405128589810f22e84247c712fd19989ada665dad34c38645097f3ff07acb4d39f1eef9fb1f961032fd6ed9e3de89e
TLSH
T12B41339BE29E27DFB5103FBD2E20B6436698907032E657C1F5D60129183693E79F3109
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 3KB
SHA256 75491e4b5d02c0595ec63c8d2db4947bfe346e1afe6c32d86ee8a2b80918975b
MD5 9ff0fbc7f1123e527313dcee2e99254e
SHA1 0458f5f82a842c1a3be261857f4c497b1d668a94
SHA512 3688077f82b60fb3578643de07a2ce4aa6c06b333fdba8308dd976764cd3488d1bccbc12f9279c25baf2a0bb4fb6e99be0a56c45988ba9b11cb9698ae61e1405
TLSH
T104610E9BA3AF33CF75103AAC1D60B64316A4D060A6E7D3C0F5CA0259143997E75F314A
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 3KB
SHA256 a131e8d40f4a888db2e41a194bd3f06196e19eae417fe9dabac92ab3c888efb8
MD5 2d104f6cb21c7a7827cd66d4354937ce
SHA1 7c7594103339ca48abc092a969b80124d8db6729
SHA512 9d3ddf3c62e2f1f793b31905c4b058cb2ce27fa209d08eb068149f7621aabb373018a37d9722a145548fca39436f3612e8cefa9022cb03dbce288a66565e793a
TLSH
T13A612F9BB3AF33DF75103AAC1E60B2421694D060A5E7D3C0F5CA0259543697F75F3149
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 2KB
SHA256 56c810b537e3e2858b552ac9fccfe7738db681943589d923003ff42f50888f93
MD5 4961d6ee5d49f5bc0480a7827635618f
SHA1 d2b5cacf43ce0daa1b7ec9a221f6c056e0ec1c68
SHA512 98807332eef73d8c50070cc7a7ed9d33eb0c78b5b281fce0e761e3635890456f5f8b16fcd1ea3bc53e7ffca18d479d69065bb43771e8727076955790f8a68c0f
TLSH
T12A41239BE29E27DFB5103F7D2E20B6436698907062D697C1B5C60129183297A79F3109
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 3KB
SHA256 6425fab245ec82955ea1a070b5800975cba6c56228a1e430dfe04bdaaeb76a1d
MD5 66da2930803ca31d5afa502858bd4738
SHA1 f520c9875edcad8d70e9b002a15b10c62ff5a654
SHA512 f3e5013e88bb8a8066a9e1a68697b5efd11b73b1b68eb5bd09051fea7fe71a47d0f6710638131abe92badb417dbcdd9e595cd8ff64c8a8f2baae4039b20cc5d6
TLSH
T1B8711E9BF2AF33DFB5103AAD1E60B6431698D060A6E7D3C0F5CA0259503A97E75F3149
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1480-67-0x00007FFECAAC0000-0x00007FFECAAC1000-memory.dmp

Download

memory/1480-68-0x00007FFECA6B0000-0x00007FFECA6B1000-memory.dmp

Download

memory/2172-319-0x0000022788510000-0x00000227885BD000-memory.dmp

Download

memory/2172-42-0x00007FFECC0C0000-0x00007FFECC0C1000-memory.dmp

Download

memory/3852-301-0x00007FF6B9320000-0x00007FF6BA488000-memory.dmp

Download

memory/3852-756-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-327-0x00007FF6B9320000-0x00007FF6BA488000-memory.dmp

Download

memory/3852-325-0x00007FF6B9320000-0x00007FF6BA488000-memory.dmp

Download

memory/3852-326-0x00007FF6B9320000-0x00007FF6BA488000-memory.dmp

Download

memory/3852-323-0x00007FF6B9320000-0x00007FF6BA488000-memory.dmp

Download

memory/3852-321-0x0000017D9F790000-0x0000017D9F791000-memory.dmp

Download

memory/3852-525-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-528-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-532-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-322-0x00007FF6B9320000-0x00007FF6BA488000-memory.dmp

Download

memory/3852-547-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-320-0x0000017D9F780000-0x0000017D9F781000-memory.dmp

Download

memory/3852-303-0x00007FF6B9320000-0x00007FF6BA488000-memory.dmp

Download

memory/3852-577-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-579-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-582-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-612-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-615-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-624-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-652-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-653-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-680-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-688-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-701-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-702-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-703-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-708-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-711-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-735-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-754-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-361-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-776-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-778-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-791-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-795-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-798-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-799-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-809-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-810-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-815-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-818-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-836-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-846-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-851-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-855-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-865-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-875-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-879-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-884-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-899-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-908-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-909-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-913-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-915-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-924-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-937-0x0000017D9F770000-0x0000017D9F771000-memory.dmp

Download

memory/3852-302-0x00007FF6B9320000-0x00007FF6BA488000-memory.dmp

Download

memory/3852-304-0x00007FF6B9320000-0x00007FF6BA488000-memory.dmp

Download

memory/5216-3-0x00000243FB060000-0x00000243FB070000-memory.dmp

Download

memory/5216-13-0x00000243FB060000-0x00000243FB070000-memory.dmp

Download

memory/5216-12-0x00000243FD1A0000-0x00000243FD1C2000-memory.dmp

Download

memory/5216-4-0x00000243FB060000-0x00000243FB070000-memory.dmp

Download

memory/5572-164-0x00007FFECC0C0000-0x00007FFECC0C1000-memory.dmp

Download