darksiderat | 83ebf5fe0bc4aba9b1a25e5a5b156de7f24e9f7fa4da2bd0811950d734fdf210

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 4.2MB
Sample260909-e7ctws1yfv
SHA256 83ebf5fe0bc4aba9b1a25e5a5b156de7f24e9f7fa4da2bd0811950d734fdf210
MD5 2e2e9e77d492306071d422dd63ed8bbb
SHA1 2da04fc5d78783f182195d2e056045856e5567de
SHA512 67b664d4519e99017442ba1770c91bc2342893f0405286eca1d3b9bc38430f2ce9294748444cf979246f519aa6d53c79507b6b443efa7409427d9dbdbc6d76b6
SSDEEP 49152:afLTXBV2MRT5OR20Oq5X08MRT5OR20Oq5X0t+LA5Z/h92e9G6svtc55:crJRT5OR2Fq5X8RT5OR2Fq5Xk2eQP1I
TLSH
T19116F252EAD0905CC673C2744D277501D72AB5FB27F4A6CB76DE802D6F62A808E37B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery darksiderat stealer trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/2956-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2956-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
256	msedgewebview2.exe
2812	msedgewebview2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 2956	1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	89

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_434530653\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_886476590\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_434530653\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_886476590\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_434530653\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_886476590\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_434530653\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_886476590\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_1756897218\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping256_434530653\crs.pb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
256	msedgewebview2.exe
256	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
256	msedgewebview2.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 2956	1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	89
PID 1164 wrote to memory of 2956	1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	89
PID 1164 wrote to memory of 2956	1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	89
PID 1164 wrote to memory of 2956	1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	89
PID 1164 wrote to memory of 2956	1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	89
PID 1164 wrote to memory of 2956	1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	89
PID 1164 wrote to memory of 2956	1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	89
PID 1164 wrote to memory of 256	1164	2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	90
PID 256 wrote to memory of 264	256	msedgewebview2.exe	91
PID 256 wrote to memory of 1476	256	msedgewebview2.exe	92
PID 256 wrote to memory of 1476	256	msedgewebview2.exe	92
PID 256 wrote to memory of 1476	256	msedgewebview2.exe	92
PID 256 wrote to memory of 1476	256	msedgewebview2.exe	92
PID 256 wrote to memory of 4544	256	msedgewebview2.exe	93
PID 256 wrote to memory of 5384	256	msedgewebview2.exe	94
PID 256 wrote to memory of 5384	256	msedgewebview2.exe	94
PID 256 wrote to memory of 5384	256	msedgewebview2.exe	94
PID 256 wrote to memory of 2812	256	msedgewebview2.exe	95
PID 256 wrote to memory of 2812	256	msedgewebview2.exe	95
PID 256 wrote to memory of 2812	256	msedgewebview2.exe	95
PID 256 wrote to memory of 2812	256	msedgewebview2.exe	95
PID 256 wrote to memory of 2812	256	msedgewebview2.exe	95
PID 256 wrote to memory of 936	256	msedgewebview2.exe	99
PID 256 wrote to memory of 936	256	msedgewebview2.exe	99
PID 256 wrote to memory of 936	256	msedgewebview2.exe	99
PID 256 wrote to memory of 5116	256	msedgewebview2.exe	100
PID 256 wrote to memory of 5116	256	msedgewebview2.exe	100
PID 256 wrote to memory of 5116	256	msedgewebview2.exe	100
PID 256 wrote to memory of 704	256	msedgewebview2.exe	101
PID 256 wrote to memory of 704	256	msedgewebview2.exe	101
PID 256 wrote to memory of 704	256	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-gpu --disable-gpu-compositing --enable-features=MojoIpcz --remote-debugging-port=9222 --mojo-named-platform-channel-pipe=1164.1068.17666801417071954160 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView /prefetch:4 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc6d9e5fd8,0x7ffc6d9e5fe4,0x7ffc6d9e5ff0
    3⤵
    PID:264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1732 --field-trial-handle=1744,i,2914541608255737247,549186356812702595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1744,i,2914541608255737247,549186356812702595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2212 --field-trial-handle=1744,i,2914541608255737247,549186356812702595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3484 --field-trial-handle=1744,i,2914541608255737247,549186356812702595,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4556 --field-trial-handle=1744,i,2914541608255737247,549186356812702595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4584 --field-trial-handle=1744,i,2914541608255737247,549186356812702595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3164 --field-trial-handle=1744,i,2914541608255737247,549186356812702595,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 82cce1ffe185e43348e6ef5ea4e0183ec1d3bfc7e3e2346b93c645f8ff0a882f
MD5 848c0cc4a4684290824a37e6e7b87ed4
SHA1 7fbcfb05c4a86089e4afb900c307f4c346cc9be0
SHA512 0a1ee4e44a783707ee833650a508079a6f0d0f2b17680f722c2cf17075b239ab8bacb0919d7b3ce52b78b03da62f395fcf6518241f5b524117ffbbf8acf224d1
TLSH
T169D0122236054BB5C4102133110272191441C10B52454060582C852D6A440600A13841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f957fcc06d68c744ac7a5a347d59eed4bf6b6d986b320738b4d3c9705682546c
MD5 4d5b434c134a61ffc04caafcca82b475
SHA1 7d68e39f6d3a1d3e6ef08b469080fb70bc614948
SHA512 1f186fcb90dc9767e923f7629f6750f7f109db55c1aaa902ded6a5135ab41eccc3964cba1f2d7f65d76f4d2ce003eadda21d3331153602012eff84227a5cf4db
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2e8e83ea-dc41-4173-89e4-000fc5be5d09.tmp

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\2e8e83ea-dc41-4173-89e4-000fc5be5d09.tmp
Size 6KB
SHA256 01d283fef0f03e7319b176c0499f71a8581eab263d45cea45712edfa505cf620
MD5 c9cc185b70fabd3eeeea14204b6734ab
SHA1 b6bf7f909b6a68f4a4dba1c4028036171a178d61
SHA512 b0dbd7a6b24f9ebe90baf66c2b0b9728ef490557ec77cffd2bd7ee3fee09ae150293dba0fe551e357c1263f78b3e6be7bc3d77151dd279c743b72fe49e99aba6
SSDEEP 96:stXUj/dDiPjb9/kJo5h16ZdIs7/x+6MhmuecmAHzt1ueIK+gAT+28XM1C7K:stXUbh+8osIsV+FiAHzt1uMWT+G6K
TLSH
T1E6D1A702AE28697B4CC6E619FA29FB1AD2F5503264D51E94E7FC862C05DB5DC6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 713c0cf75b6485922d6549f7090a3ff518b242e5d8e09c86e15037f2740b8401
MD5 af84e50d3fd5f29eb1e1dc5eaa237ba9
SHA1 49324ff130d4e6d448c9094beb89e6ae53809f6b
SHA512 87710998148b898fa55b2ce5e544897b5e4dc3748e63d8142bb79fd6da43d5df4f653a926e85593d9230d284ceb10f05189465cb5f82c233d8bf54698e5a9638
TLSH
T13F5143BAC7D847BD895212E41B366926CD5E955A42283D178CF9AF8F23E18B0D20129F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7512.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\Network Persistent State~RFe5a7512.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Preferences
Size 6KB
SHA256 c95671092464a6f1e285b3fa47ff29fd406b5085f6716536f4a805c76e56ae1d
MD5 a73e0a9266ff1a30d9200e4d29494fb5
SHA1 7373e660d8cd8d415b054f454b2a6c99067111e5
SHA512 b83c7b9a4e938c56bd7a553477d0808fd67d334a23d2c7b1f8319032f268d1667ba64eb15e9e235d274f65359e4d50ccb51fe9a439e65e2da60b0ebfdfd48cf0
SSDEEP 96:stXUj/dDiuGjb9/kJo5h16ZdIs7/x+6MhmuecmAHzt1ueIK+gAE+28XM1C7K:stXUbh88osIsV+FiAHzt1uMWE+G6K
TLSH
T149D1A702AA28797B8CC6E619FA29FB16D2F5503264E41E98E7FC852C05DB5DC6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 15KB
SHA256 86bb1b5d7f6dfae9aa656418c38beedd5675856f1c61e645347c27114cd544a6
MD5 ff01eb6130791bacba5ee2ccce975f2f
SHA1 044da227833207d89afd88d91f79b12352463cd5
SHA512 4761c80580d748cbe7e0169e88583b067579b5f1cc9c822f78965b2f4a554e82578f3104b76fba0dc46452bf755fb81ed9c509dc61a75663aad4881b65efc75c
SSDEEP 384:/+aQikB+z/xvxjg/qhEKWNBSso5+JPoVDt9zt:O/UxvxjgC+hG+loVDtFt
TLSH
T121728D3BA9397E2796F3A6047A4D074BDAB9987290C16A784AFD1F0A46C72DC1342C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 2KB
SHA256 36b46e6c8faf43d9c59b19e4fa1332873399abfd1950c00447a52ab19c8b39b2
MD5 ef867fcc5b6b02f22acd9741db6a102e
SHA1 f92f9a1ff31f6c3a3345e9b49abd6f40075590c6
SHA512 34b589d8ef18f94be03d11ce128bc569f7f33856d649729078a98408c1d6051809582532d2a729ee8a7fc5446b490b9fd3b3b7999bcdad0f1380a344b692af75
TLSH
T186517733BD25AB3BC9E24B48794A3F13CE7591619AA12F149AEC1F1D42D716C1302C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 3KB
SHA256 88c6ef20410e7b05ae0d80006c8468c90a21450e3e5a986626c15f7314345590
MD5 6faf5c9c2035e2c8c582fa45ff0b1784
SHA1 755817fc1fe8e995d3755fb9bbefebcb0f6809dd
SHA512 c505f8d81a11f8e12735557559767b2ea535f64fe81c3b2611309efd8cc333e5cc233c0d06fbdfd38a599559d47a2d532e899e318493d4744d32744bbdea08c6
TLSH
T15B616437B935E93B8DF28B05B98A3B06ABB55123D5913F58DAEC1F0D42D729C1342C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe596018.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State~RFe596018.TMP
Size 1KB
SHA256 70676cf382298611b62b92779b37cad8795cc042421b2dd30e288d6acd56d7f7
MD5 11143b68df7f50d3d9fd215bc19865b9
SHA1 322648198bc0eb10be298f4921c4c92357b477a5
SHA512 c08993ef67cf29a1509a3cd0e5e78ba567e73e06b76cb7e5b139df000725ad0558eae9352ae54f4645d62aacb8fc38b71f2e40f4c537b59e41f90727b42e3b83
TLSH
T10B2162B3F9259F33DC915B8A32467A075E71013782A04F0866DD5F1D83A31AC661B832
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_ui.html

Path C:\Users\Admin\AppData\Local\Temp\aspas_ui.html
Size 2.4MB
SHA256 34f87e1286f3d820838335350a67065c64ca73b373b2814b5c0f89d835a87548
MD5 2ae6738018f4c8abd736bc969dcfb6c5
SHA1 1bc12e27ff39d559583bf6fe7dd881a83fe52e82
SHA512 4898bd5e09a4e659d8e2bd388a555d3ce466620634c734cbbe3d2098ba6906c1e9bbae0c2a0d97d9083de926dce6c1c07a31bfbd28a53df241763cb600d64ab0
SSDEEP 24576:TlWZc0KM5eBbkgIbtpmBWapavA9OSE89nBr+dpTcXg76WZc0KM5eBbkgIbtpmBWx:TlMKM5i0hYBKWsRUMKM5i0hYBKWsRR
TLSH
T121C512201582197645778279AF975B0AFF299213420582FC3AEC434B5FFBD11DE2BEAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-221-0x00007FFC8EE40000-0x00007FFC8EE41000-memory.dmp

Download

memory/936-220-0x00007FFC8EB40000-0x00007FFC8EB41000-memory.dmp

Download

memory/1164-0-0x0000000140000000-0x0000000140448000-memory.dmp

Download

memory/1164-168-0x0000000140000000-0x0000000140448000-memory.dmp

Download

memory/1476-24-0x00007FFC8F220000-0x00007FFC8F221000-memory.dmp

Download

memory/2812-102-0x00007FFC8F220000-0x00007FFC8F221000-memory.dmp

Download

memory/2956-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2956-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download