darkgate | hxxps://temp[.]sh/JYdCE/data[.]zip

Analysis

max time kernel
108s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://temp.sh/JYdCE/data.zip

Score

10^/10

darkgate kaitoshiba123 stealer

Malware Config

Extracted

Family

darkgate

Botnet

kaitoshiba123

45.63.52.184

Attributes

anti_analysis
true
anti_debug
false
anti_vm
true
c2_port
8094
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
EhuJByqk
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
kaitoshiba123

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 2 IoCs

resource	yara_rule
behavioral1/memory/2952-98-0x0000000005970000-0x0000000005CFA000-memory.dmp	family_darkgate_v6
behavioral1/memory/2952-99-0x0000000005970000-0x0000000005CFA000-memory.dmp	family_darkgate_v6

Executes dropped EXE 1 IoCs

pid	Process
2952	Autoit3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
920	msedge.exe
920	msedge.exe
3824	identity_helper.exe
3824	identity_helper.exe
3704	msedge.exe
3704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 2612	920	msedge.exe	84
PID 920 wrote to memory of 2612	920	msedge.exe	84
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 2728	920	msedge.exe	87
PID 920 wrote to memory of 400	920	msedge.exe	88
PID 920 wrote to memory of 400	920	msedge.exe	88
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89
PID 920 wrote to memory of 2256	920	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://temp.sh/JYdCE/data.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe947746f8,0x7ffe94774708,0x7ffe94774718
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2244,246606469749912783,5312624212105234051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2748

C:\Users\Admin\Desktop\abc.exe
"C:\Users\Admin\Desktop\abc.exe"
1⤵
PID:3564
- \??\c:\st\Autoit3.exe
  "c:\st\Autoit3.exe" c:\st\script.a3x
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5cb4ad9d1de245ba45d8fce431dc69d

SHA1
ece8605e9cf2e6930d0e3b6ad64ec095d4cf231f

SHA256
c15af750e0d6805737a40f44898ace9113beed7a03317d8d1d48612fd9b258f9

SHA512
ecd73ef9bd6d014f3dc94950a2ab75d0d9d87933f357db590d78e7c2039248168c66a2face611c346b8e56c2d4c560f9fd908b2764215743fe50b4754eb66559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40d0d30fd28e6c71c01767e0ea7bab2f

SHA1
00b6a14bde1c05739a3aaf963e244293cd2741d7

SHA256
5488b0092ea8e9865bf61b2610fac7265dba5de94f24b39ab51c7abc7253748c

SHA512
6539a8f96d1e3f756fd870081e1cdc5418b833217bf1590478dad742de4e0cd90dcde65933b38bcaced0b92e12fc3ce433388e813de90caa05e97219a0b27961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2f7801459b8c5768897448610fd4632

SHA1
680685e5be5b9378b388a981670af660737b961c

SHA256
630c5c24f58dda787ce6bf62a7800119bac81b8f9ee8800fb2f8ab835598cbe7

SHA512
c7acd162184bb07bf87766fbdf5cd37818ca329a674cb3b4b98478a2889fba26d32532046eaad9bb3d9ef9e855610fb24cee4b7d04b36610689232987464bbbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ee9b77cddef7451fcb0be4fd1d8dab96

SHA1
7378a660b2b756b03be0afb4e48234bbb9172dde

SHA256
91398fac6052713b1bf7ae6e13952722399d713a9158ba6e525d5909f3df29af

SHA512
a2c1a96189126ea3e97ed0a6d4b91058d3aa8522af260615ac7abbf76877066cae2e945967d5b72dbede83d184d3a54cde70fd3add63a484d874140ca2e544c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c347e3c4942b590b2522e655a1fc7f01

SHA1
d9760d9e5f8050c48312ead5de6619f61b8e6f54

SHA256
e4aab6f3b2c7f05cecb4c556fc21e58e4758dc2892663a9ea65d5947df283c1d

SHA512
ba61d74b6d640af7443c9114991cc799d765b46572580d9121611c6063a678474ff3f95e73461815001f72eddb69d8c505a3b16d36846e597f4f8cb6c52ec408

Download Submit
C:\Users\Admin\Downloads\data.zip

Filesize
1.4MB

MD5
f12f73f6680af8008ead5f36bf0bb603

SHA1
a2baed066b275e827604cc537dc141237c3cd4a1

SHA256
5b3382faf060e55b994fb6fb9adc023b75ead723e0213c64fabd22a65f59e88c

SHA512
e56ac0c33e5e9f25a53b1df948b429a76b76a17a9209aa1e8e4f020f8eeed1214374217964c3e4dd84183362de07059762702f79256422e0e2ec5b139012b6c5

Download Submit
C:\st\Autoit3.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\??\c:\st\script.a3x

Filesize
497KB

MD5
c0c95d1fdb4869d5dcdebf71f1020f70

SHA1
53185cef67cbdfc5f691aeeba5cdf2dba27b359a

SHA256
025bd7399df23c0c8c4335b74a77eac8f0ec79ab0860279f73f78a4e6393cff1

SHA512
90dc03c63e139ed6398bc5676d3cf8b56c72d23497ea841b68cd8e4c953e7085f1754f6414bec603ced4679432ea1a7c412881e5cce45e3df1afc7590235df6f

Download Submit
\??\c:\st\test.txt

Filesize
76B

MD5
0ba726a9e4dc56556d86a1f7b2e7be74

SHA1
60e8031fc78884c5e593f645656544fade59435c

SHA256
79a979299ea480989fe7cfefe64da2f99e527418bdc6db7f109fd132e3183ac2

SHA512
cdb206f9d8fac3d1533760a79129fd562d580e9b300117663e0fb877f31dfdc7121a5c051fd2af6380a04cd5bac370f9b6bb1c55bdfd25dadda7d6ec386f2d3c

Download Submit
memory/2952-97-0x0000000004460000-0x0000000005430000-memory.dmp

Filesize
15.8MB

Download
memory/2952-98-0x0000000005970000-0x0000000005CFA000-memory.dmp

Filesize
3.5MB

Download
memory/2952-99-0x0000000005970000-0x0000000005CFA000-memory.dmp

Filesize
3.5MB

Download
memory/3564-85-0x0000000002540000-0x00000000026A7000-memory.dmp

Filesize
1.4MB

Download
memory/3564-92-0x0000000002540000-0x00000000026A7000-memory.dmp

Filesize
1.4MB

Download