3bbdfcff44817d1298097bcc8a8b20f09036d43cacce5b50e49a5e10b809027a

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 2.3MB
Sample261027-e1q3yabt6k
SHA256 3bbdfcff44817d1298097bcc8a8b20f09036d43cacce5b50e49a5e10b809027a
MD5 e3583c2361b3825d7b282b2e14e8adf4
SHA1 d15671bd93a326b533e18963d713ebc409ff99d0
SHA512 aaccf6b463800fde3711414b2467f4bb4ba7f10cc6405434c60a840d0b6adc2de1dd8acbcd001ad9048bd70a20a42ea698fab1901aa2550c7ba1b23c8e577a27
SSDEEP 49152:Xy5H6Rtx+4ECK8KGKQR4QzXJFpf/Vp71EJvgo6WGY6l:PNKGKC/p/Vp71EJvgo
TLSH
T160B59E0B67D800F8D27EC178CA4AD483E6727825C364D6EF17D49A690F236E75EBA701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
33	4896	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Executes dropped EXE 1 IoCs

pid	Process
3656	laddon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5428_2078983373\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5428_2078983373\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5428_2078983373\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	laddon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	laddon.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4488	powershell.exe
4488	powershell.exe
4896	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4896	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4896	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4896	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
4776	powershell.exe
4776	powershell.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
4776	powershell.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe
3656	laddon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5428	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe
Token: SeDebugPrivilege	3656	laddon.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4488	4896	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	91
PID 4896 wrote to memory of 5428	4896	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	93
PID 5428 wrote to memory of 1292	5428	msedgewebview2.exe	94
PID 5428 wrote to memory of 4316	5428	msedgewebview2.exe	95
PID 5428 wrote to memory of 4316	5428	msedgewebview2.exe	95
PID 5428 wrote to memory of 4316	5428	msedgewebview2.exe	95
PID 5428 wrote to memory of 4316	5428	msedgewebview2.exe	95
PID 5428 wrote to memory of 5592	5428	msedgewebview2.exe	96
PID 5428 wrote to memory of 5920	5428	msedgewebview2.exe	97
PID 5428 wrote to memory of 5920	5428	msedgewebview2.exe	97
PID 5428 wrote to memory of 5920	5428	msedgewebview2.exe	97
PID 5428 wrote to memory of 5476	5428	msedgewebview2.exe	98
PID 5428 wrote to memory of 5476	5428	msedgewebview2.exe	98
PID 5428 wrote to memory of 5476	5428	msedgewebview2.exe	98
PID 5428 wrote to memory of 5476	5428	msedgewebview2.exe	98
PID 5428 wrote to memory of 5476	5428	msedgewebview2.exe	98
PID 4896 wrote to memory of 3656	4896	2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	100
PID 3656 wrote to memory of 4776	3656	laddon.exe	104
PID 5428 wrote to memory of 5568	5428	msedgewebview2.exe	108
PID 5428 wrote to memory of 5568	5428	msedgewebview2.exe	108
PID 5428 wrote to memory of 5568	5428	msedgewebview2.exe	108
PID 5428 wrote to memory of 4648	5428	msedgewebview2.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /C Get-Service -Name WpnUserService* | Restart-Service -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --allow-running-insecure-content --disable-features=msSmartScreenProtection --disable-gpu-vsync --disable-web-security --dns-over-https-servers=https://cloudflare-dns.com/dns-query;https://dns.google/dns-query;https://dns.quad9.net/dns-query --enable-features=MojoIpcz,UseSkiaRenderer,UseDnsOverHttps --enable-gpu-rasterization --enable-smooth-scrolling --enable-threaded-animation --enable-zero-copy --ignore-certificate-errors --ignore-gpu-blacklist --run-all-compositor-stages-before-draw --user-agent=LoaderVnm --mojo-named-platform-channel-pipe=4896.4312.13495034038126144083 /pfhostedapp:8c6f26a17a7226ab89a871e7928b397b4eb317af
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView /prefetch:4 /pfhostedapp:8c6f26a17a7226ab89a871e7928b397b4eb317af --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff981095fd8,0x7ff981095fe4,0x7ff981095ff0
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1888 --field-trial-handle=1892,i,14217776330166430479,4380136752990421860,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:8c6f26a17a7226ab89a871e7928b397b4eb317af
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1892,i,14217776330166430479,4380136752990421860,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:8c6f26a17a7226ab89a871e7928b397b4eb317af
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2520 --field-trial-handle=1892,i,14217776330166430479,4380136752990421860,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:8c6f26a17a7226ab89a871e7928b397b4eb317af
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --run-all-compositor-stages-before-draw --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3492 --field-trial-handle=1892,i,14217776330166430479,4380136752990421860,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:8c6f26a17a7226ab89a871e7928b397b4eb317af /prefetch:1
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ignore-certificate-errors --ignore-certificate-errors --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4368 --field-trial-handle=1892,i,14217776330166430479,4380136752990421860,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:8c6f26a17a7226ab89a871e7928b397b4eb317af
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --enable-gpu-rasterization --run-all-compositor-stages-before-draw --disable-gpu-vsync --noerrdialogs --user-agent=LoaderVnm --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView" --webview-exe-name=2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4364 --field-trial-handle=1892,i,14217776330166430479,4380136752990421860,262144 --enable-features=MojoIpcz,UseDnsOverHttps,UseSkiaRenderer --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:8c6f26a17a7226ab89a871e7928b397b4eb317af
    3⤵
    PID:4648
- C:\laddon.exe
  "C:\laddon.exe" 4896 33cbe12259dda0487aca32637a439413e4a91b36d1ae3c23acf2f6b8c9753810c4f25d1bee539767920f5a06316f51f13a9560eb24a0043d7de0d76363b9080f570cc78ffa93fd8fe91546a4aededfd7
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAAkAGMAcAB1ACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAgAHwAIABTAGUAbABlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAgAC0ARQB4AHAAYQBuAGQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYwBwAHUAIAAtAGwAaQBrAGUAIAAnACoASQBuAHQAZQBsACoAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAcwBrAEMAcgB5AHAAdAAoACIASQBuAHQAZQBsACIAKQAuAGMAXwBzAHQAcgAoACkACgAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIABzAGsAQwByAHkAcAB0ACgAIgBPAHQAaABlAHIAIgApAC4AYwBfAHMAdAByACgAKQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.log

Path C:\ProgramData\Intel\Logs\loader.log
Size 160B
SHA256 5c91e0e87d8dc08ec2d4c4b25f0cde3bafc21929994e222a2f91be8f676fcaa5
MD5 f8076a4784a31fcb7ef0393b93d155b4
SHA1 540a64c72d2f83c49e31f2251f227c23597265bb
SHA512 b592a6a58cdb2bb5afb77b396c275c2da7c4326e9a2fce7c4ab259006298d5aba6209279e2eb82945b92f66297aaa081c11dd318cb99f675b4ea7ad269d3a6c2
TLSH
T16FC040514992F1CDFB4F0CFF50D5559DD7E0940802BADD0E10835532170045CD84B551
MD5 SHA1 SHA512 TLSH

Submit Download

loader.log

Path C:\ProgramData\Intel\Logs\loader.log
Size 1KB
SHA256 4cb7fb0d7079948168d1de994b2659fe18a82185a08489b7f4bd0d50a954237a
MD5 a091fa0dff976ace509f86a1454ef284
SHA1 e4e478d8c60bbfdf99d19c4a460f395d163756f4
SHA512 2e31ef3e7e32fd98e4a907b05ba660f495d693f6de1cbaec2781e746952e406bdd7bb28d898770f6422f6a9adcd1fc2bf5a4a5e3d984d893b129764b71661775
TLSH
T15B31DCA76260F00CF801DD6FE0F4B588A76C559502B1DC2F168BDD76CFB01788C5813A
MD5 SHA1 SHA512 TLSH

Submit Download

17.0-laddon-temp.exe

Path C:\ProgramData\Intel\ldc\17.0-laddon-temp.exe
Size 6.8MB
SHA256 03a19e3d6e1d30056e4346bed7283dbbfddf3dcd915c319b331e401b90318506
MD5 23ac03b4cd73aa4b69b039db77a08653
SHA1 40cbb944e47d7e357ecf36a81f458e62f02742c4
SHA512 68dc8f81e734ea6e1aee070d430afb563aaf75fd729e121003f564a99fe959aa0941fee16c9e632d12f062d58bfd2d7cae700b109b0081ec84c1c7747cbfa9b6
SSDEEP 98304:O37IZaepHydMGKfALLgJhkybVGUtZOr3t2ibvMEdy3DeJiBSB9KMb+A5k/6uXfGK:O3k8ZL6my5GULObxvMEmeJi4T2vM5lD
TLSH
T14A6601CABB5144E4E443EB71A43624DB90DF8FDB6C40829757003AADB9BCBED0BB6544
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_3a9560eb24a0043d7de0d76363b9080f

Path C:\ProgramData\boost_interprocess\17000000\cfbi_3a9560eb24a0043d7de0d76363b9080f
Size 25.0MB
SHA256 eb454a25ccbdf8bb02fbf3d3db06329a2eb3ccafc7fbbd0f4f0b68ed8ad2b3fd
MD5 348ca5bc7c34d79ecc60c991b3846414
SHA1 1141b21973dbdb731cc1769e87edb0316f461882
SHA512 1b9da6daade59cdeb6e8b19cbf633f61241c2baae5abf9a28e351b4a8a141e105ac9f197a59cee5bda8bdff35d68a3bba5b3fb5067df1c25d3e7853b6c2a541a
SSDEEP 12:akXn0E0XlnSP63y6HSFlWLDpCyx0Hg+zmD:dEnXPLDpC60Hpz0
TLSH
T1F0475077D94BB1CBD456033C05963BF277373409DAD0874BC7A21A20EE792569F57901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_570cc78ffa93fd8fe91546a4aededfd7

Path C:\ProgramData\boost_interprocess\17000000\cfbi_570cc78ffa93fd8fe91546a4aededfd7
Size 25.0MB
SHA256 7a7bb6df6f6825284d49fb8cc7e5e7181da38188e1c453dcb7b6605de2c664a9
MD5 43076fb4ca9593e14fbc74d714acf0e8
SHA1 dedfdaf70547825cbfbadb8704752a69ffd35d72
SHA512 02222b57259d5ba4bda12acca49876019dd9a091f137f5e80e67faff2d8f55b5deccdcd97f0fe2f5e75b8a78038d40bad5847a358abdde5668ed271740da8d80
SSDEEP 6:akXn0E0XPl/nia+l/P66+l/3Ses620Sskl:akXn0E0XlnSP63y6HSFl
TLSH
T1D647C2B3880B228FD098037844DE1BB1777B0918A6508B03C3A60A24DE65686AF59C01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_570cc78ffa93fd8fe91546a4aededfd7

Path C:\ProgramData\boost_interprocess\17000000\cfbi_570cc78ffa93fd8fe91546a4aededfd7
Size 25.0MB
SHA256 6ba64bda8f43cd7550bf402c9a27c9862dc81c8bfb8e2e8042479c6cf40a67ba
MD5 fb1a7b2c9ab096a49be8a634111b230a
SHA1 15f005c153a3393b0b7676f325f0b439790efd37
SHA512 665acf289c8d32d2e2f9961cec04c500aa901a149ef0b85578d61086e2e332fce33e9372a3cfa2b56568388d808bd53477dc85d1f4c086f076ca30398bf28e04
SSDEEP 12:akXn0E0XlnSP63y6HSFlWLDMle+mUho7Djf9:dEnXPLDMldho7Djf9
TLSH
T1F847C072484A128BE455037405AF37B573BB3905DAD4C703C3921530CE34246EF86D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_c4f25d1bee539767920f5a06316f51f1

Path C:\ProgramData\boost_interprocess\17000000\cfbi_c4f25d1bee539767920f5a06316f51f1
Size 25.0MB
SHA256 ad1d6ed0dbdbd08b5f0bca6b160e74adbe7dcc5d9d39e0e95a8dbbdfd6a6f368
MD5 9af17fc838a12932c266fa763ae2422f
SHA1 7df5f51dd07c8a8debc9173ebaeacf792a00f4a9
SHA512 5dd97699e18772f70f358af7ca56d41cc81519e5dd03037e9406be72851452beb2115e7b20d5ee8d012602007ab19e0e5de7e2fd731a8e92449b8b937c04298d
SSDEEP 12:akXn0E0XlnSP63y6HSFlWLDqXKdz2bKS5bff+vDMlFj2NLur:dEnXPLDfNUTD2v4lZ2NLur
TLSH
T1CB47AC72450A10CBE0680236069A3B353B3B39059AD09703E3A30951DE692876F29816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbi_e4a91b36d1ae3c23acf2f6b8c9753810

Path C:\ProgramData\boost_interprocess\17000000\cfbi_e4a91b36d1ae3c23acf2f6b8c9753810
Size 25.0MB
SHA256 de841e691987da308174146e246c335d1268db1c51b6675b0b6b13ec54bb761a
MD5 58e626ed266ee8a3d602152cec8c7665
SHA1 6b73d81a6ce93b5f84fc3135b861ae8dac5327fb
SHA512 30721f562de1f90b355710b8de18aecdebe5e0c9a18a6470ff40003d0680348521b3e28f313180b67ca1bdd52d57a605e04f95170ac6c9bc06152c3342a6355e
SSDEEP 12:sUSkXn0E0XlnSP63y6HSFlWLDQWX4dY/ArT2ZSRf8:NEnXPLDQzdY/+Gaf
TLSH
T1DB470C77880E018FC0E612B818CE7BB2777B7918ABE0871B93925920DDB63492F02802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82ee6a5851d263a3d9638b5d4242a9a115420c116bc297950dde8c16551d5f13
MD5 eba5318163768e0210e23582b74e1f98
SHA1 7b36b41c455914237255a73f1fcfb160cd216ce8
SHA512 163152fd12b50ef7822c5bde5f028e9299a939c384b5d6f39b3ad4159fa8fe5302a4e444fd7014324777ebe3225650535ac154851d02ebbbbf0c9f3ddbbda881
TLSH
T1C8215633F3CC8724C89A403650CEAC1136B687DB81DEDF6BBB84D144B56F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lbpyskjc.lh4.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lbpyskjc.lh4.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

363531303031303931305253434647.ini

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\363531303031303931305253434647.ini
Size 81B
SHA256 5b0962d0eeb8de6e30f11f3859f99375972e7fa31e6ec97ac7cece6dba034a4f
MD5 3c0fba4c005cc76afad9aa8a0937bd61
SHA1 b7449380a2f3b85b838ac042f56ce3f84065811c
SHA512 1bbd451e0f6cc7ae6ead018ea5a2dbca2c338d17585906d9cb95ed34d1bd3b1b44991c1dee53f84718945a65aade8ff56311aaa57228aa4fa46e64ece038feab
TLSH
T112A002BD0612E4285C0DFC2B628269C9CFC791C161391D9FD6343E73B1AA2D0B50E40F
MD5 SHA1 SHA512 TLSH

Submit Download

21c27f43-fa4f-46a5-865b-af9c9e8cdc87.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\21c27f43-fa4f-46a5-865b-af9c9e8cdc87.tmp
Size 2KB
SHA256 9edfbb5779c75ad8ca28fbe274fd9e73a4a61b3850a19541d08f25ee4a8f1781
MD5 1bfa43013e2f1dff9182e5610b596e28
SHA1 cb59766aa65fdde3d1b91254b941a5184e640bc3
SHA512 dd981bdc8b9014efe69ab1a53871f3dfc5e37a5e5c16263181a5362286cdfe42e42560c68615aa451b963b9084fe81e560f4170f973739c6eddede255f29be5e
TLSH
T1C0519533A924BA7B8AF29748BD4B3F23DE36A15296521F109ADD0B1C01D751E2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

5237ea3d-80d4-4538-a086-756301e68c54.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\5237ea3d-80d4-4538-a086-756301e68c54.tmp
Size 3KB
SHA256 96dd30b3ae31050d9734464945ce6aaeb1b82afd03e87cba4c0272d6676f5468
MD5 6d9432dcb12e2f6eb310b7ed8bef0338
SHA1 06b7b145ce620667fcc18a82a1322b26f0a00e8d
SHA512 19778da3ed69749d6924099ef051f4c9faed727cee9cc968964a9415e608a0518a3fc21025ec80805b9402ea4ad94e1ee5e7aacdeb59ed737d9adac5b0641f1c
TLSH
T136618627A974A93B4EF2D704B9872B12EB75A123D5927F54D5ED0F1C01D72891342C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8bd47177b2c367375f773fd7db00ee3617406a61c76f8f2fd07efd513ce1009b
MD5 ee6d05a70b1d86c6cb03c740195f640a
SHA1 7b6184675a47b031901a01728872e819d9fd98e1
SHA512 693b550924e4d74625132b98b26c717d863c1d801167a7c69c590bb8ce4317ff3adf3668a3fefc90c5738c7e5d4a188ee30d3b5a4313b82b813f226103fa0bbc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 70f0bbba2447861d49c22d16d949bdb795bb898892e786f4a2dc8b54f396c025
MD5 fb52ffe2e7d7ad336d9c41c19dc4bfb7
SHA1 54ecd142ea3395dfdff3d4b1cb25d52d0e6d3a86
SHA512 0ccccabd47d75f4a39855ef701e5bbcbbd044458e033f118acea7004f9a1b60ec4e1b1f4ad41f6e14af651c2ca486076e72833ecafd3d82d31da688cd4d710b0
TLSH
T16ED024173313017DC41030330003F70C0401C50F41C541405C3CC77F1F140540D07453
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

26426953-4ce0-4cc9-8c4a-2e5efeffb44c.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\26426953-4ce0-4cc9-8c4a-2e5efeffb44c.tmp
Size 6KB
SHA256 48c9f1e3eac5c5c950645cf62d8fa186ddb715e144ab592a78577b2f762782be
MD5 f37e6c6c06d7781b2d40e42c40733d77
SHA1 494c29ba093ef9521b11673f9b45b2e885ae8ac7
SHA512 6b2a3408d0f0b58b70328290d8e06cb13f2eb9222dda3065c2ac22b62e2e8efaadb7f26d0ede4f1c2872fd8eeff164cb3a6ab2baa962f9d3c5b44524c6726de2
SSDEEP 96:stm/dJxayGJb9Vk7o5h16ZZks7/x+6MhmuecGEPS1ejeyK+glS2+28XM1C7K:steVo2o0ksV+FKE6Qj2D+G6K
TLSH
T1DCD1B8025E24B97B4CCAE618BA29BB03E2F5A03261D11E58EBFD452C04EB6DD6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 288B
SHA256 45a6d6ca8c0f1c549eb319b05107c8e0a43119e504ed1631a1a369b794e5e939
MD5 04eeca889fa9e345051a93e0193ea6e9
SHA1 04a4d23c41596e73a8f6ab0de1a7f8932c1d8cf2
SHA512 e29cda43ad913ca9637281edd89b5fc9cdba5a69ed4fe254d06b3823c01edad3c5f8d68af51f3829158bdce3d20e87edb3ac70975a822c4eafc05b52ef29aca6
TLSH
T181D01227D0E69FA0DF55797962C66CC972382C6449C37F5724E8043994237D544A3817
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3414f42218ae60e48d1eb3c1afa739cfc8f536c7574fbd974b2689bb9e1cd304
MD5 4421f9009dfe13e0c7f9d9a03ca994bc
SHA1 9ec28ed50b4875b3c2d88e053a5c3134fd1a527b
SHA512 58c8ce72702cb9c7828bc0e3d9cf447d09420b260d855dba2c035619c919fb6c43acda78865e890b3d8032dac3b73ba9fe20e3029c627e481fada3df05d65e83
MD5 SHA1 SHA512

Submit Download

02870a1b-8058-4cca-94c4-dc5e84facb54.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\02870a1b-8058-4cca-94c4-dc5e84facb54.tmp
Size 1KB
SHA256 bdc05445a0947f20d1e370d7fbc8ef45c601f78f15058ba0fcffff700c8b5ed8
MD5 c26dc5957a6631f16460d96979dff5ed
SHA1 0d1a4f46918268068cb95d1d198926da9556b50b
SHA512 e483c1c8b8aa0b27041cdf3135efb6310d3098fad94ec736cfd6d2ae8a45e49e0551df1967a1f33c988ff1e7138e267c4e584991cea87f5ff2f73540414d9e2c
TLSH
T1CF218BF2C5D48A6C89A152F86B602A1BEE2D041553283E19C9DCFF9FEBF0578E211909
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 de6330d4e1c3e0e8dc012cb1ffac0d9074da4f94eb2b864908d53d9dc1b46d33
MD5 88b90ff9b0414f3665a947a8d02eff78
SHA1 3830a954bfff1bffe5c5f703c11bfabc87920701
SHA512 f237e5eae300ce4154f59f4d9695af10fff2be7e58dc831a13ae5033c43d0b957b68b5d0bad490c114d45b77c385f174f3e64f21687046e1e8ee98d1954bd454
TLSH
T142E0DFB3D0AAA56B2038097A2F497E45BE36B134129266F8DE57976EA1900E62A02452
MD5 SHA1 SHA512 TLSH

Submit Download

e0e5c80a-8b67-481c-a526-b7c8391994f4.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Network\e0e5c80a-8b67-481c-a526-b7c8391994f4.tmp
Size 356B
SHA256 ef3438bbe2e1e28f597c95c5d93bf3357317c3005a6bc6ff857a6e732778ae4c
MD5 908bdd4ef4941c5000b0cfeb1bb4fee8
SHA1 764f92f1fe0dda57868a2da878a98a36d8b20864
SHA512 0dba4fe848156c00e5ac629e782a39ec8ce663865af70bf4fdfd6887f4d30d8b07c67e5b0e46efd48a14090f6b6789321774cee2dc0d412fd15637bd3510607c
TLSH
T1F6E0D873C0AAA467603809791E887E44BE76B134529166F4D957977D61900E21502412
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

bd029d6b-c574-45d4-9a6d-edd5467a77b3.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Default\bd029d6b-c574-45d4-9a6d-edd5467a77b3.tmp
Size 6KB
SHA256 6832cdee2f88a4bc2787b232fa7753391fed75fb53d0dc567078f62490e73a8c
MD5 f06c42cbb8ceb7e0d9abe5e31dfa814a
SHA1 385317518a22a0f7650b324cf94e216ffc7b60c5
SHA512 61ee6b2e779cf13a81ca4def3a2aade9caff3643fb96a6821c8d35e5e9bfb42d5064ecf6a373dd4af1117d9149f2e55cfef0ed3f83c14cb0a50f82ece8453142
SSDEEP 96:stm/dJxazJb9Vk7o5h16ZZks7/x+6MhmuecGEPS1ejeyK+gkST+28XM1C7K:steVO2o0ksV+FKE6Qj27+G6K
TLSH
T13FD198015E24B97B4CCAE619BA39BB02E2F9A13274D11D58EBFD456C04E76DD6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\Local State
Size 1KB
SHA256 b40f069b8433d40b062e084e48c4374274ec8b8ce0b117f5f24cdf8e85fdfeda
MD5 e80a908e78c89d561ff594477330a5b6
SHA1 38df14dc62b67bfa0844b5de52557b5c963b122b
SHA512 5425ea29d98d8fe3e90d990966a87a29314e26da9854e04f5a7d7615810397be308a3fe435dfe3221a3eaac371809639c4195c9c3c6b175a8bf2ead98a0d1079
TLSH
T19A2195B3D5746A76ADE4B34572177BA35E32B0638152CE0065CE4A2C02E704EA126933
MD5 SHA1 SHA512 TLSH

Submit Download

b429a380-1569-409f-88e5-a2d7e79091c4.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_e3583c2361b3825d7b282b2e14e8adf4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe\EBWebView\b429a380-1569-409f-88e5-a2d7e79091c4.tmp
Size 15KB
SHA256 78bb53552e633024b53bc8e4f9356697f684efca179af88021e0b953670183cb
MD5 abdcadfce6190bb270471846f18a49b3
SHA1 e170f4b77466f4fb50239b6efe0a937b9c1318fb
SHA512 9440c3ea808f5f8e73f1f595b6197c24f4c191a154a2f3510cdaffada16d9688a38f619050071634290a8458e1d8578610001925da1664b4d8a01981e41a2a7c
SSDEEP 384:o+OBqImmJvGBLx3NaFMJFNNBS2v5CsQg6rx:RcvGtlNposOt
TLSH
T13972AD771C656A372CFAC609BE8E2B47CB61A253C0D1BBE4DCECAF0F022B4451352916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5428_2078983373\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 733B
SHA256 06d4bbbe22fe73c4846f5a873a7daef703ef3616bb2aa0ca1315a00bb6655b55
MD5 5770c8ca3717491a4c7a07130fb33036
SHA1 1a6ab9466a25d2d7c1d2535cf263bd20373de196
SHA512 83c7b2e31f6aab02c4e4456235fca8f7749e7e4cd653953922b9128c1c7ca9e806cbdad2fefe40fad4e3135803bda7f3197afc6753493bd498488a53e9d6d1e8
TLSH
T1E601FD4BA28B23EFB5243FAA2D21F20256D450A1317602D266C602111C22A3EA1F3409
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 3KB
SHA256 30473d0bec464aa4507b841140571fb5dc121e1ccb0caf6b95e9ae4c87bd614d
MD5 5e8c7cb7586d8149be8ba72b807908e4
SHA1 3946afe2b32f14d5b8acecd658be70b7a14ad5bc
SHA512 0825955d37f82a6c3ca28471f2170c005925902dc545801079957dc9e7ee2149a47f07b24b4be1f9b4d52b8d870054f19758ac1cb0e902785a8c85615a886657
TLSH
T1A5711F9BF2AF33DF75103AAC1E60B64326A8C060A6E7D3C0F5CA0259503697E75F3089
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json

Path C:\chair_cache.json
Size 1KB
SHA256 d57808c2cfb463051ea7ccb58d5eac292b6a57901b4f77bf2686b843bd3692f6
MD5 57443ae23a5ddc9d0b2314b196917792
SHA1 439909c62169c773d1716741bb780fc3343c6608
SHA512 09120fea9d8aec237ad1f87453a2e6986567029c26955649b442f1030d3027a3b584340ccf0923ae335cc9ba97a0c2b221b894580d536348d29141a8fb6f36e6
TLSH
T17D2110DBA76E37DF70043B7D1E14B3439AA8D07022DB93C1A6C602591432D3A66F3119
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 385B
SHA256 89e5d97a54822022e5df15e31abc356a60f699c78034c86270684654c837f7a1
MD5 57185eec1ee3735feb0749528b0c190c
SHA1 ce55a06827ef6f416add57d77a738cf7a6d5c24c
SHA512 92e61518d418dc729be09e32652a69c06709b028a43324f84f6de4b3b2fecd0b32dc0799a9b8aca83861cca2f780d042b66d60226ba3200297dda97c7cc97c77
TLSH
T1C9E0615BA59717FFF9143FF95930F54366C45051713246D1B9C507155C2393E61B340E
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 1KB
SHA256 ad71953ece59035cf91c6b7ef92b084387c0554d855b0e26e0517aae28130c6b
MD5 21669272a74f79b1ccd2b702825e7f19
SHA1 1a41e6c95df409d44f780207a0caf18c2ded3197
SHA512 535f43fb5de8e40d997f89c1cc5d6c45431c6965bdebc48c27b4a77180e0fdb512888a8943763c987ba675bc0a98be8f7996345a28df3eef6b7fa69a6354a8e7
TLSH
T15241219BA39E37DFB1103FBD1D20B64366A8907022DB97D1B6D6016C1832A3A66F3109
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 2KB
SHA256 7e696bf5c1ba8afc2e22847a7eae71f0759751318051971542a815d312eb496f
MD5 b750acb46ac3aae05d2429749ca9fc68
SHA1 56e659a3b1201d1a54419a6146b9219ddef1ce4a
SHA512 b611acbe7ac0466c3f8dcaea649c7ec42cf01100f5b1e81d30a1a2d58cd8841fe72924e7000ad6664a956e3011acce7d2da0b24cd067d289a0ae86bb0969b9be
TLSH
T14841119BE29E27DFB5103FBD1E20B64366D8907072D697C1B9C605681832A7A75F3109
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 2KB
SHA256 e79a920e21892a75e273e27722d94352ffe9e2268c11eca8ed2ca8db8a93ad1a
MD5 3fb6a2d9b23d7bb9e8270062b6008508
SHA1 ef626c2c43c1158adc910766ec535a73e92e5c0d
SHA512 7b8b559a70d3011bd4d39688a0a9a84f054174911b69b0561caadb41caa6bc184d9ecb779b055075f33e15a6c919ff6596e67a3e05eb1f8800ad831e4cd0292d
TLSH
T14A41219BE28E27DFB5203EBD2E20B6426698903072E657C1F9C60129183693E79F3149
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 3KB
SHA256 2bd8dbacaa71b8363ab62a947e1fe60575cc0c184b2c06404893b13979ae729c
MD5 e2bc3d838695bd7e01c552ae5db78dcb
SHA1 b36f38044290d9e7b88ff03785660e33794705e0
SHA512 5d82762873709c28ca10071d2291b21c18cc27702ec70691c270b0f7aed9b9d7941465c1587f2ae9bf9f9958255f75e11ff16c52f4c47e6d28b473334f73a1fe
TLSH
T1E261FF9BB3AF33DF75103AAC1D60B64326A4D060A6E7D3C0F5CA0259543597E75E318A
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 3KB
SHA256 0607aca72623c163e2ee9b9c957cfa875f2f3bd8e145011aa4f4e55cdeabd423
MD5 c6f2f3b0f2b4b486de1d7dbfabf6087a
SHA1 a98eadf319ddc17bfed248ef4ea87e72170fa641
SHA512 fc29984e1cfe54e96aecd6c2f1c3732517aae780913c3764864fd4b40df42f1bf99a197b0f31bf4984767460ce05bee7d7b5dacee19e959a11dfda8d621ee104
TLSH
T1E061209BB3AF33DF75103AAC1E60B24216A4C060A6E7D3C0F5CA0259543697F75F3189
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 1KB
SHA256 2d82b6c518d4ad4fe302b071db24f873fcc66e89d53c3415b991e4d652b53d40
MD5 2e3d59c8c53ee0554501a5c0a589d200
SHA1 49cdf1ed80633d347bdd72a97c6e0adc446b0203
SHA512 8e84cdb7f1fc83ac9b2d126f65f2668a1825f0910bb2c5efbef225f07e1f6f8e091089fcb5f9d039fa21a4a60fe7767dc91b0484dfa9c0c52bef72667026aa21
TLSH
T1BF31119BA39E37DFB1143B7D1D24B74396E8907032DB57D1B6C602691432A3A75F3109
MD5 SHA1 SHA512 TLSH

Submit Download

chair_cache.json.tmp

Path C:\chair_cache.json.tmp
Size 3KB
SHA256 76ba19b5fa6bae15d1f6549619b504f916f35d6ef41eef22b8c4639d96147bbe
MD5 02fae305ff1d76c95aca7036fb6c0803
SHA1 6abe4a7836a18589d20a9b374d544b9be9ef1fcb
SHA512 f057f5e889897e0118292c8ccb23f5f7ebb683dd7cadc98f873e811a846bf267319df3ddbb1c412910e876c1db12fef4b986c89070d30a03a70c50c7365847f7
TLSH
T1EE71205BA29F33DFB9103AAD1E60B6431AE4C060A6F7D3C0F9CA0659143A57F66F2149
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3656-993-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-255-0x00007FF6388D0000-0x00007FF639A38000-memory.dmp

Download

memory/3656-236-0x00007FF6388D0000-0x00007FF639A38000-memory.dmp

Download

memory/3656-235-0x00007FF6388D0000-0x00007FF639A38000-memory.dmp

Download

memory/3656-233-0x00007FF6388D0000-0x00007FF639A38000-memory.dmp

Download

memory/3656-234-0x00007FF6388D0000-0x00007FF639A38000-memory.dmp

Download

memory/3656-1276-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-254-0x00007FF6388D0000-0x00007FF639A38000-memory.dmp

Download

memory/3656-320-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-331-0x000001A2F6B70000-0x000001A2F6B71000-memory.dmp

Download

memory/3656-330-0x000001A2F6B70000-0x000001A2F6B71000-memory.dmp

Download

memory/3656-1275-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1222-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-365-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1218-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-253-0x000001A2F6B10000-0x000001A2F6B11000-memory.dmp

Download

memory/3656-1196-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1194-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-257-0x00007FF6388D0000-0x00007FF639A38000-memory.dmp

Download

memory/3656-1186-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1182-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-259-0x00007FF6388D0000-0x00007FF639A38000-memory.dmp

Download

memory/3656-390-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-462-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-467-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-484-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-258-0x00007FF6388D0000-0x00007FF639A38000-memory.dmp

Download

memory/3656-500-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-674-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1140-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-553-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-558-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-565-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-569-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-570-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-579-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-605-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-609-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-252-0x000001A2F6AB0000-0x000001A2F6AB1000-memory.dmp

Download

memory/3656-1087-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1064-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-687-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-689-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-734-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-765-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-779-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-781-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-809-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-827-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-846-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-860-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-861-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-867-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1084-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-683-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1030-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-940-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-948-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-614-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1003-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1002-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/3656-1019-0x000001A2F6AA0000-0x000001A2F6AA1000-memory.dmp

Download

memory/4316-49-0x00007FF9A1330000-0x00007FF9A1331000-memory.dmp

Download

memory/4488-18-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-20-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-14-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-13-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-15-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-16-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-12-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-10-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-17-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-3-0x00007FF97F35F000-0x00007FF97F360000-memory.dmp

Download

memory/4488-11-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-6-0x000001BE10060000-0x000001BE10082000-memory.dmp

Download

memory/4488-9-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-8-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/4488-7-0x00007FF97F1D0000-0x00007FF97FB74000-memory.dmp

Download

memory/5476-133-0x00007FF9A1330000-0x00007FF9A1331000-memory.dmp

Download