darksiderat | ee6384ee8602414e44faeefc43b9e3e43ccde6f7d091eb8f1bc30b6cd87cfb77

Analysis

user interaction
yes
max time kernel
11s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
private (5).exe
Size 788KB
Sample261001-vbml8atvdw
SHA256 ee6384ee8602414e44faeefc43b9e3e43ccde6f7d091eb8f1bc30b6cd87cfb77
MD5 0139194078242e70ddae6bdf46702a84
SHA1 aef9e47e84090f6daea639705ef785f892518446
SHA512 4c898f342adc387f5c9b850f153c1bdcff614e5e6594314c6d5df5976668d9ee276418ccb8820719f8ba7e16b06fbe5e002492701f27df418a43380ed77819a8
SSDEEP 12288:IFNSRzEdUhzGcaRlXEpsbRbVTZUsZWmFVb+xbDJbPb4b2bCmb4AbgbDbbCmgm3Zf:ISRzEdUhzGcQCm5Ks+Gk9c1qA
TLSH
T1AE05BF15E69510BED277C278CE538941EB727C434731AACF33945AA61F23AD48E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245dc-158.dat	family_darksiderat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	5196	private (5).exe

Executes dropped EXE 1 IoCs

pid	Process
2500	ox_1790873345390.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	private (5).exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	private (5).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	private (5).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ox_1790873345390.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ox_1790873345390.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5196	private (5).exe
5196	private (5).exe
5196	private (5).exe
5196	private (5).exe
5196	private (5).exe
5196	private (5).exe
5196	private (5).exe
5196	private (5).exe
6048	taskmgr.exe
6048	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5660	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6048	taskmgr.exe
Token: SeSystemProfilePrivilege	6048	taskmgr.exe
Token: SeCreateGlobalPrivilege	6048	taskmgr.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5196	private (5).exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe
6048	taskmgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 5660	5196	private (5).exe	84
PID 5660 wrote to memory of 3728	5660	msedgewebview2.exe	85
PID 5660 wrote to memory of 5008	5660	msedgewebview2.exe	86
PID 5660 wrote to memory of 5008	5660	msedgewebview2.exe	86
PID 5660 wrote to memory of 5008	5660	msedgewebview2.exe	86
PID 5660 wrote to memory of 1368	5660	msedgewebview2.exe	87
PID 5660 wrote to memory of 2644	5660	msedgewebview2.exe	88
PID 5660 wrote to memory of 2644	5660	msedgewebview2.exe	88
PID 5660 wrote to memory of 3232	5660	msedgewebview2.exe	89
PID 5660 wrote to memory of 3232	5660	msedgewebview2.exe	89
PID 5660 wrote to memory of 3232	5660	msedgewebview2.exe	89
PID 5196 wrote to memory of 3516	5196	private (5).exe	90
PID 3516 wrote to memory of 2500	3516	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\private (5).exe
"C:\Users\Admin\AppData\Local\Temp\private (5).exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="private (5).exe" --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5196.3316.12805753093627026243
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff8a167b078,0x7ff8a167b084,0x7ff8a167b090
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView" --webview-exe-name="private (5).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,2652792533712041590,9314889469176929636,262144 --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView" --webview-exe-name="private (5).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2040,i,2652792533712041590,9314889469176929636,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView" --webview-exe-name="private (5).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2380,i,2652792533712041590,9314889469176929636,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView" --webview-exe-name="private (5).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3600,i,2652792533712041590,9314889469176929636,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:3232
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1790873345390.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Users\Admin\AppData\Local\Temp\ox_1790873345390.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1790873345390.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:2500
  - - C:\Windows\System32\licensingdiag.exe
      "C:\Windows\System32\licensingdiag.exe"
      4⤵
      PID:4784

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 141bcf9cd746a6655963715077ea59c6afacbf225b1c3b16471c83e6472fbb59
MD5 3efed458f5ba1206c097b80b440b8d9d
SHA1 3e1819b67d14c6f49928eb7f69078a3f2ec1d512
SHA512 794925826993be88d9b0497f72ce4174b467cd105e25c180183d0120b5af79dcbba5ef9382e1ff44b5c49ae0e49b9396caee32747b954737b0cb5373588f46c2
TLSH
T12BC08C2C5AA24A06F6A8437C42C139839B208142E2418F062AF12A48C996B162878C2B
MD5 SHA1 SHA512 TLSH

Submit Download

4e9f977e-54cf-4547-9cf6-ee3f30b47e5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\4e9f977e-54cf-4547-9cf6-ee3f30b47e5c.tmp
Size 3KB
SHA256 0f3adffa671bf4e8639aeb57c5337bdce28eced6ae0bc4be0d8d7fd31091af72
MD5 639e1f7f0060e9b26aabb86ff0cfaa37
SHA1 6a49256a0581903691f0cee43e70fb45c9c4cbe7
SHA512 f41d720bf8fb465e82039e62c7f43c1433d1abdc57f135b23a5af8056e6e65ea63d875c0e2891583d2c42fbdd70c671e6ccafea6e7c7d02c40e7a706b04b4126
TLSH
T14B71B8B2BCA4AA3B4EE78D45B5852B02B6A51133D1913F98C9ED0F1C01D7B881352C17
MD5 SHA1 SHA512 TLSH

Submit Download

50652401-1356-45d8-8dd1-3f939dadacdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\50652401-1356-45d8-8dd1-3f939dadacdc.tmp
Size 2KB
SHA256 68f6c0eca19a7ec3c795e04015ffc5271fc7f634a862cacedf01be1cc21a976f
MD5 368e553392a378345b3602e7f391c5d9
SHA1 2c63891b4b9dfc60279b47792a1c4a28c0d2d723
SHA512 756e4f3d683e0baf1a626fc7028b5240dcda30a74da9bf01be78d99324e6c6e9d52a3b7896388e357c40fb369110622f0154e471082b8b1ef0258dcbe1b5e594
TLSH
T13951C4F3FC546B378AE78A8475493B53AA782122D1622F5499DD0B1C01D7B4C2706C6B
MD5 SHA1 SHA512 TLSH

Submit Download

6a9c7254-dee6-4172-b8e4-7ec994d62ad6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\6a9c7254-dee6-4172-b8e4-7ec994d62ad6.tmp
Size 1KB
SHA256 d860b5cb156fa2ccf0cb195ff3c22ef7f92a250f212d882dba06c0d435f8adf4
MD5 e9d18b646fa78af5e77ffbd6bf577c1d
SHA1 83cf20d80ab7a06100b4ed3642a90995868499c5
SHA512 05799ab5a97fcd235e94b617e743ee2e46030af4deab32b53860802a0e199dc11114f37632c001a8a38806f232f7130927edf08f928db381b009cf3dd5777afc
TLSH
T1263192F2E8E03F375D9A898672516B936E602026C0104F4851DE4B1C02E3E8C993EC37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ea276b7688f41d63b0e6e87e5a6bf908f65c7c2d4077ba6152b788fa3fe9aa21
MD5 a55cda0efb7c3e56112ad0aa2bc87864
SHA1 91ffdb0586851fd20ee117647a9332bba2be7c0e
SHA512 1a434b8e77f3331215ba9a4ede37220cf1fb14807386a4f213b9b84a81fe220844b2329cb67cc0d3f8f21169649c1771bce3a42202d3b40c8b2ef0d93f0ca1df
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 67add9c7c14210a89551202d7df312eebbc1ab9e2b3fd1e71d934cd322ac46e3
MD5 83a22b5332634b6e39ed8002c438c67b
SHA1 01f32321aa2d5c788a7ba9bb11cd60b6ef313019
SHA512 1d58fd7c23bd5c76da56697fe834836eec5552f96ad2981e158c34769e2d3e8ba80ee0ecd84f00b39f52c3ab50bed786ca2509059f1059678d5745b6fc72dfde
TLSH
T12ED0122232814338C01035730042B5090500CE4B80494400D429956F2B140505907481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 71bdd5d8e72bf412f1aa7277094d71773b2900e1527a7d88c7c065f813b7554e
MD5 a27c0b9e0dcce63377c6bbd14fccbebf
SHA1 ed900ca0062822448d4b80c49e8faed4c42ea3da
SHA512 423ca9da260c847ba3381e8a28b8cd6480e313e04361ac04d6cc3d294d608b03ee8a5b4edc39b4a26deb360c59f05eba78cf74276bac907b8e6985caa9943c9f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 82760b845740810fcc034418cf2dd81daadea53aef0832706fa2382de51a91d3
MD5 cd0c4ddba9d0d01c6bf5723505ea279c
SHA1 e7646c512d7c9dc228422518d1d054fec830c067
SHA512 28f5be64b1387412ce7f605480a6e9cdb8b70053e998c32d04210c0f17a7dac3cf6ffd328eefdabc224a61bb4176592a58767b232d1f2e823dd7b1974a5776d8
SSDEEP 3:LstlNllkll/lwfk+l:LsX3lEtwf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\Local State
Size 1KB
SHA256 3541876a0eade7dd3529fb8cd71b1006d3ac9898709974f4b338eab2e10bf703
MD5 8bea873be0b37c2188fdc3347d630f28
SHA1 74bd2967a40b747f74027b80d4cc6b39a01c4896
SHA512 492a8866239514347a3678cac9c64857a2378accbb217d226e77b2f6955c1ef50ffbb8efc41a4f0af1baf3c9059c2d427416ef4e12f9fe55ab04bf3fe27c3801
TLSH
T1E02142F2E8E43E779A9A48857251AB872E902136D0104F0891DE461902A7E988A7EC77
MD5 SHA1 SHA512 TLSH

Submit Download

e6553c1e-7875-49be-a925-0296e73dbda2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\6B2F9A41-3C7E-4D18-A9E2-5F0C7B3D8E61\wv2\EBWebView\e6553c1e-7875-49be-a925-0296e73dbda2.tmp
Size 16KB
SHA256 c7c8de46d31b6b3b09a335efb7342eab57b168895ea794c299afb91ec21170d8
MD5 83c12fb0cdbaf16f9008bde291dce4aa
SHA1 02f4bf97e47c0356a80401b995d30fef739028a0
SHA512 efe6a88c2820b3c7461b94d15ef84759a209689ea3e75095d3721028bba4323e8367167940b2ce35ad65162dc81cacf5c8f27da07cec9e53a3571c33c45bb43f
SSDEEP 384:zt7+aQikB+z/xvxjg/qhETNb7PDLbWBfp9zW:Za/UxvxjgC+BiBRFW
TLSH
T1AF729D3B69783E2395F3EA057A5C074BDBB854A290C22EB84EED4F0906C77D81357C5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retev[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FB6DDX4X\Retev[1].htm
Size 56KB
SHA256 0d0a91c58d930d76a2600f1b75965a4edfb63357284c5965fb3b3f08266f0237
MD5 68ddf5f041cc9d80252e243352728396
SHA1 fb5c316bd6f4411aec73516adb311624e707d83b
SHA512 9f9a0bc1bc25f6eea49ed3f9a9e0025562ff6865e06d6c08917b182c8017aa3afecd23ea4a622e713a0430909b8dd992d0a9b33e97c8e4e7b8edba16f7c3463c
SSDEEP 768:Eb9OnCKoatcLZBTjwFrECxGazpOWp54vg5d5YP98yxA1XbXP7kW7rCVr8Z0kP:I9vatZ5tsWp0g5rBSmLYW7rCVoekP
TLSH
T13043F834EA5AB06FD35ED834DD430D16CD12BCCA97A0BB9B57915CD20EAAF209B2D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2644-95-0x00007FF8BCAB0000-0x00007FF8BCAB1000-memory.dmp

Download

memory/2644-94-0x00007FF8BDBD0000-0x00007FF8BDBD1000-memory.dmp

Download

memory/3232-153-0x00007FF8BBDA0000-0x00007FF8BBDA1000-memory.dmp

Download

memory/4784-285-0x00000188AFD60000-0x00000188AFD61000-memory.dmp

Download

memory/4784-295-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-300-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-301-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-302-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-304-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-303-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-296-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-291-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-297-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-299-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-298-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-292-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-294-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-284-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-286-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/4784-293-0x00000188AF640000-0x00000188AFD59000-memory.dmp

Download

memory/5008-277-0x000001F438E60000-0x000001F438F8A000-memory.dmp

Download

memory/5008-35-0x00007FF8BBDA0000-0x00007FF8BBDA1000-memory.dmp

Download

memory/5196-248-0x0000000140000000-0x00000001400C5000-memory.dmp

Download

memory/5196-0-0x0000000140000000-0x00000001400C5000-memory.dmp

Download

memory/6048-258-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download

memory/6048-257-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download

memory/6048-256-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download

memory/6048-259-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download

memory/6048-260-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download

memory/6048-261-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download

memory/6048-262-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download

memory/6048-250-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download

memory/6048-251-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download

memory/6048-252-0x000001DACD6F0000-0x000001DACD6F1000-memory.dmp

Download